Windows Explorer shuts down automatically when running appwiz.cpl

carwiz · 21 Jul 2014

The dumps are showing a memory corruption during a wrapped shell execute. This can only mean two things. There is a problem with memory or third party software has an errant filter installed. Seeing the over-temperature throttling that occurred earlier in the month would be a clue but that's where the syslog ended (7/7). The applog showed no symptoms of heat related problems after that date. You could be having memory faults but those normally show up with a system BSOD and other signs in the dump. That leaves third-party software. Many are known to be incompatible with certain Windows functions and others that are just so poorly written they crash the system. There's also many that don't interact well with each other simply because they install filters (drivers) that interfere with each other or Windows. We see this a lot with multiple AV suites and Torrent software.

Follow this tutorial and perform a Clean Startup/Boot. Uncheck ALL the non-Microsoft items except the two that are highlighted in the image below. We, here at WSF, know that MSC does not cause conflicts so if the problem continues, the culprit can easily be determined by allowing one startup process at a time and testing the system. Continue the test making sure each User account is used. After that, check ONE more item to allow it's startup and repeat the system test for each user. Many of us are wagering on the outcome but this is the only way to prove it to you.

accordeoniste · 21 Jul 2014

A Guy said:

Did you get a chance to test your .cpl files as suggested above? A Guy

I tested my .cpl files before I performed a repair installation, and after I was logged in to Windows for a awhile. All tested okay. I've seen the "Windows has stopped working" error message when I ran appwiz.cpl shortly after start-up, and randomly thereafter. I was under the impression that the error was caused by certain configuration files not loading into memory before I ran appwiz.cpl, but the minidump reports an access violation.

accordeoniste · 21 Jul 2014

Slartybart said:

Thanks - it is a mess. Is this SFC before or after the repair install?

I don't understand your decision not to run SURT, but it is your decision. The utility is often useful for finding and fixing things not found and fixed by SFC.

I was focused on msi being reported as the culprit - there are a few ways to address that a wonky msi. Since the installer service is integral to Windows Update, SURT is the easiest first test solution.

There are some very talented members working on the issue, I'll sit this one out.

Good luck,

Bill
.

The SFC was performed before the repair install.

I ran SURT several times after I had the trouble installing the SP1 Windows update. It didn't work.

Thanks, Bill for your support.

accordeoniste · 21 Jul 2014

carwiz said:

The dumps are showing a memory corruption during a wrapped shell execute. This can only mean two things. There is a problem with memory or third party software has an errant filter installed. Seeing the over-temperature throttling that occurred earlier in the month would be a clue but that's where the syslog ended (7/7). The applog showed no symptoms of heat related problems after that date. You could be having memory faults but those normally show up with a system BSOD and other signs in the dump. That leaves third-party software. Many are known to be incompatible with certain Windows functions and others that are just so poorly written they crash the system. There's also many that don't interact well with each other simply because they install filters (drivers) that interfere with each other or Windows. We see this a lot with multiple AV suites and Torrent software.

Follow this tutorial and perform a Clean Startup/Boot. Uncheck ALL the non-Microsoft items except the two that are highlighted in the image below. We, here at WSF, know that MSC does not cause conflicts so if the problem continues, the culprit can easily be determined by allowing one startup process at a time and testing the system. Continue the test making sure each User account is used. After that, check ONE more item to allow it's startup and repeat the system test for each user. Many of us are wagering on the outcome but this is the only way to prove it to you.

Thank you, Carwiz, for the analysis. I ran a memory diagnostic test two or three weeks ago, before I performed a repair installation. The memory test passed. Since the repair install, the system has performed very well except for the Windows Explorer error that I've been seeing. The ShellexView testing I did revealed that several programs may have been responsible for the Explorer crash. I also didn't see the error message when all of the non-Microsoft programs were disabled in ShellexView. I agree that the problem has to do with third-party software. I have some questions I'd appreciate if you'd answer that may help me understand better why this happened:

1) What is the difference between disabling extensions in ShellexView and performing a clean startup / boot where this problem is concerned?

2) Why does the error mostly occur shortly after start-up?

3) One extension in ShellexView that caused Explorer to crash, iCloud, was installed in February, but I don't remember seeing the Explorer error message then. Could it be that iCloud clashed with another program, and that caused Explorer to crash? Perhaps iCloud became corrupted since February.

I plan to perform the clean start-up / boot procedure but it'll have to wait until the second week of August. I'll be going out of town next week and I'll be gone for a week. This week I have to prepare for the trip. When I get back I'll do the clean start-up and post the results here.

carwiz · 21 Jul 2014

1. The clean startup suppresses software programs from running at startup. It is not an uninstall and any drivers installed by the software installation will still be present on the system. The driver(s) may or may not "load" depending on the type of driver--Kernel vs User. Most will be User Mode drivers and won't "run" unless called upon by the software. The drivers are the interface between the Windows OS and software/hardware.

Shell extensions are special component objects that are similar to "drivers" in that they can be DLLs or EXE modules but have an association only to Windows Explorer and they have to follow certain "rules". They extend the functions of Windows Explorer by calling other programs or performing functions not otherwise included in Explorer. Disabling/removing a shell simply removes that path or link to other programs. It does not stop a program or driver from loading at startup.

2. Most likely because the program or driver is executed or run at startup. Most programs like Backup, Copy or your VM are only run when called. Shell extensions only run when you click on them in a menu.

3. You had other shell faults not related to Microsoft Installer (MSI) but they all had the same error--An invalid or corrupt address so some third party software wasn't playing well with Windows or not passing the correct address. Problems like this are not impossible to find, they just take time by a process of elimination. The clean start/boot and shell deactivation along with a controlled test is about the only way to find the culprit. If something was causing a system BSOD like a video driver, it would be easier to find but Windows components don't always trap errors where none are expected so they just stop.

accordeoniste · 21 Jul 2014

Thank you for the explanation, Carwiz. I have a feeling that none of the Hewlett-Packard start-up programs are the culprit, since they were on the system long before I started seeing the Windows Explorer error. Whatever program is causing this problem, I'll find out which one when I return in two weeks and perform the clean start-up boot procedure. There's one other thing I'm wondering about that perhaps you know the answer to: why is the Windows Explorer error related to Microsoft Installer?

carwiz · 21 Jul 2014

Windows Explorer is the file manager and primary graphical user interface to the Windows OS. Clicking on links or menu items generally go through Explorer. The MSinstaller was called by Appwiz within the shell wrap (multiple shells) so you must have clicked on something to initiate the sequence. The actual dump data shown below shows the trace of the stack that was executed. The most current is on top.

Added: Look for Stack Text and move the slider to the right for the text.

Code:

 
FAULTING_IP: 
msi!CreateDatabase+46
000007fe`f6b6c1e6 41ff5268        call    qword ptr [r10+68h]
EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fef6b6c1e6 (msi!CreateDatabase+0x0000000000000046)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
PROCESS_NAME:  explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1:  0000000000000000
EXCEPTION_PARAMETER2:  ffffffffffffffff
READ_ADDRESS:  ffffffffffffffff 
FOLLOWUP_IP: 
msi!CreateDatabase+46
000007fe`f6b6c1e6 41ff5268        call    qword ptr [r10+68h]
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG:  0
APPLICATION_VERIFIER_FLAGS:  0
FAULTING_THREAD:  000000000000106c
PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ
LAST_CONTROL_TRANSFER:  from 000007fef6a282b9 to 000007fef6b6c1e6
STACK_TEXT:  
00000000`046ce030 000007fe`f6a282b9 : 00000000`02b98a10 00000000`00000000 00000000`00000000 000007fe`e6ac2a40 : msi!CreateDatabase+0x46
00000000`046ce070 000007fe`e6a9ae46 : 000007fe`e6a8a7a0 00000000`00000000 00000000`0a8dd8b4 00000000`00357ce0 : msi!MsiOpenDatabaseW+0x18d
00000000`046ce100 000007fe`e6a99376 : 00000000`00000000 00000000`00000000 00000000`046cec78 00000000`00357ce0 : appwiz!CInstalledApp::_GetMSIPackageElevationFlags+0x6e
00000000`046ce390 000007fe`e6a939ad : 00000000`00000000 00000000`0a8dc850 00000000`00000704 00000000`00000004 : appwiz!CInstalledApp::GetElevationFlags+0x26
00000000`046ce3c0 000007fe`e6a92ee9 : 00000000`0a8dc858 00000000`00000001 00000000`00000000 4676ce2b`7b81be6a : appwiz!CARPFolderEnum::_CreateItemIDFromInstalledApp+0x165
00000000`046ce970 000007fe`e6a8e89c : 00000000`00000002 00000000`00000000 00000000`07d93a3c 00000000`00310000 : appwiz!CARPFolderEnum::Next+0x24d
00000000`046cec40 000007fe`e6a91eab : 00000000`00000000 00000000`0ad51f60 00000000`046cf070 00000000`04bea2e0 : appwiz!CalcItemCount+0x3c
00000000`046cec70 000007fe`fdc3cf3e : 00000000`00000000 00000000`046cf1f0 0000a432`fab2fccd 000007fe`fec83152 : appwiz!CARPFolder::GetDetailsEx+0x20f
00000000`046cef30 000007fe`fda1b501 : 00000000`0492e3e0 00000000`046cf0d0 00000000`00000000 00000000`046cf2e0 : shell32!CRegFolder::_GetPropertyFromRegItem+0x5a
00000000`046cef90 000007fe`fbb675aa : 70dd8bac`8b6ec381 000007fe`fbb62012 00000000`02bd9400 00000000`00000001 : shell32!CRegFolder::GetDetailsEx+0x299
00000000`046cf050 000007fe`fbb6750c : 00000000`046cf150 00000000`046cf0d4 00000000`00000000 000007fe`fd3d1dca : propsys!CPropertyStoreOverFolderFinal::_GetDetailsExProperty+0x66
00000000`046cf0c0 000007fe`fbb66112 : 00000000`04c9b370 00000000`00000000 00000000`00000000 00000000`77596925 : propsys!CPropertyStoreOverFolderFinal::_GetValue+0xe8
00000000`046cf150 000007fe`fbb64cc9 : 00000000`0031af10 00000000`04c92c60 00000000`00000000 00000000`00000000 : propsys!CPropertyStoreOverFolderFinal::GetValue+0x12
00000000`046cf190 000007fe`fbb65c1e : 00000000`00000000 00000000`00000000 00000000`046cf558 00000000`046cf558 : propsys!PSGetValueAndPath+0xae
00000000`046cf220 000007fe`fbb65b32 : 00000000`00000008 00000000`046cf580 00000000`00000000 00000000`000006c8 : propsys!CMultiplexPropertyStore::_GetValue+0xdd
00000000`046cf2d0 000007fe`fbb64cc9 : 00000000`00000002 00000000`00000040 00000000`046cf580 00000000`00000003 : propsys!CMultiplexPropertyStore::GetValue+0x12
00000000`046cf310 000007fe`fbb64bb9 : 00000000`00000000 00000000`00000000 00000000`046cf580 00000000`00000003 : propsys!PSGetValueAndPath+0xae
00000000`046cf3a0 000007fe`fbb64af1 : 0000a432`faba3798 00000000`8002802b 00000000`046cf558 00000000`04c2f0b0 : propsys!CPropertyProvider::_GetValue+0xc8
00000000`046cf430 000007fe`fbb64a5e : 00000000`00000000 000007fe`fbb75e0d 00000000`00000000 00000000`04bea1a0 : propsys!CPropertyProvider::_GetValueHelper+0x85
00000000`046cf4c0 000007fe`fdaf2fdd : 00000000`00000000 00000000`04c2f0b0 00000000`04c2eff0 000007fe`fbb6782d : propsys!CPropertyProvider::GetValue+0x12
00000000`046cf500 000007fe`fdaf9878 : 00000000`04cb5be0 00000000`00000002 00000000`00000001 00000000`04cb5be0 : shell32!CMetadataExtractorWorkItem::_AddToPropArray+0xe4
00000000`046cf5e0 000007fe`fdaf2de6 : 00000000`04cb5be0 00000000`00000000 00000000`04cb5be0 00000000`00000000 : shell32!CMetadataExtractorWorkItem::_ExtractNullSelection+0x155
00000000`046cf670 000007fe`fdaf2377 : 00000000`049c1110 00000000`04a92110 00000000`00000000 00000000`04a92110 : shell32!CMetadataExtractorWorkItem::DoWork+0x10f
00000000`046cf6b0 000007fe`fd9fc54c : 00000000`04a92230 00000000`04a92110 00000000`00000000 000007fe`fd9f4ec5 : shell32!CFrameTask::InternalResumeRT+0x17
00000000`046cf6e0 000007fe`fda2efcb : 80000000`01000000 00000000`046cf770 00000000`04a92230 00000000`0000000a : shell32!CRunnableTask::Run+0xda
00000000`046cf710 000007fe`fda32b56 : 00000000`04a92230 00000000`00000000 00000000`04a92230 00000000`00000002 : shell32!CShellTask::TT_Run+0x124
00000000`046cf740 000007fe`fda32cb2 : 00000000`049c1110 00000000`049c1110 00000000`00000000 00000000`00377c98 : shell32!CShellTaskThread::ThreadProc+0x1d2
00000000`046cf7e0 000007fe`ff503843 : 000007ff`fff96000 00000000`02be1830 00000000`0036af10 00000000`00377c98 : shell32!CShellTaskThread::s_ThreadProc+0x22
00000000`046cf810 00000000`775915db : 00000000`04937b30 00000000`04937b30 0000a432`fa8cda6a 00000000`00000005 : shlwapi!ExecuteWorkItemThreadProc+0xf
00000000`046cf840 00000000`77590c56 : 00000000`00000000 00000000`04948340 00000000`0036af10 00000000`04910228 : ntdll!RtlpTpWorkCallback+0x16b
00000000`046cf920 00000000`774659ed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x5ff
00000000`046cfc20 00000000`7759c541 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`046cfc50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
 
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  msi!CreateDatabase+46
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: msi
IMAGE_NAME:  msi.dll
DEBUG_FLR_IMAGE_TIMESTAMP:  4f80321a
STACK_COMMAND:  ~12s; .ecxr ; kb
FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_msi.dll!CreateDatabase
BUCKET_ID:  X64_APPLICATION_FAULT_INVALID_POINTER_READ_msi!CreateDatabase+46
WATSON_STAGEONE_URL:  Followup: MachineOwner
---------
0:012> lmvm msi
start             end                 module name
000007fe`f6980000 000007fe`f6c97000   msi        (pdb symbols)          d:\ms-websymbols\msi.pdb\F69431D2D57947BD8607EE4E6A31FC7F2\msi.pdb
    Loaded symbol image file: msi.dll
    Mapped memory image file: d:\ms-websymbols\msi.dll\4F80321A317000\msi.dll
    Image path: C:\Windows\System32\msi.dll
    Image name: msi.dll
    Timestamp:        Sat Apr 07 07:24:58 2012 (4F80321A)
    CheckSum:         0031D862
    ImageSize:        00317000
    File version:     5.0.7601.17807
    Product version:  5.0.7601.17807
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Windows Installer - Unicode
    InternalName:     msi
    OriginalFilename: msi.dll
    ProductVersion:   5.0.7601.17807
    FileVersion:      5.0.7601.17807
    FileDescription:  Windows Installer
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

accordeoniste · 21 Jul 2014

Yes, I ran appwiz.cpl by opening Control Panel / Programs and Features.

The stack text and the entire output of the dump looks very much like the output when I ran the debugger on the Explorer minidump file.

A Microsoft technician stated, on a forum I came across, that the c0000005 exception code refers to permissions. If that's true, can I solve the problem by changing the file permissions somehow?

carwiz · 22 Jul 2014

accordeoniste said:

Yes, I ran appwiz.cpl by opening Control Panel / Programs and Features.

The stack text and the entire output of the dump looks very much like the output when I ran the debugger on the Explorer minidump file.

A Microsoft technician stated, on a forum I came across, that the c0000005 exception code refers to permissions. If that's true, can I solve the problem by changing the file permissions somehow?

The debugger is the same. (WinDbg)

The exception code refers to an Access Violation. In this case, the thread was trying to access a memory address of all "f". It has nothing to do with permissions; However, it may have been caused by software that didn't pass the correct value because the software (run by a user) didn't have the permission to access or write a file. I believe I mentioned this early in this topic.

Windows Explorer shuts down automatically when running appwiz.cpl

Perform the tests. You still have to identify it.

accordeoniste · 22 Jul 2014

Yes, you did suggest that the software could've been installed under a single user or in a user restricted folder. I replied that I didn't know how that could be since I installed most programs in program file folders. Anyway, that didn't lead to a solution.

Why did you recommend that I uninstall the IObit uninstaller? What did you see in the minidump file I sent you that indicated that IObit uninstaller was the source of the problem?

Hope you don't mind the questions, Carwiz. What you told me has helped me understand the problem better, and what to do about it. I started the clean boot testing by disabling ASC in msconfig / services but Explorer still crashes. I'll continue the testing when I return from my trip.