Solved What is correct explorer.exe for W7 x64 SP1? How to fix?

[maxseven]

I've been experiencing explorer.exe crashes recently, errors look like this:

Log Name:      Application
Source:        Application Error
Date:          4/8/2012 9:32:57 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Quadcore
Description:
Faulting application name: Explorer.EXE, version: 6.1.7601.17514, time stamp: 0x4ce7a144
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0150010
Fault offset: 0x000000000006f892
Faulting process id: 0x5b0
Faulting application start time: 0x01cd13724364afe0
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: bb82b8e0-8187-11e1-a97d-0014d1386dc9
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-04-08T14:32:57.000000000Z" />
    <EventRecordID>23780</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quadcore</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Explorer.EXE</Data>
    <Data>6.1.7601.17514</Data>
    <Data>4ce7a144</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7601.17725</Data>
    <Data>4ec4aa8e</Data>
    <Data>c0150010</Data>
    <Data>000000000006f892</Data>
    <Data>5b0</Data>
    <Data>01cd13724364afe0</Data>
    <Data>C:\Windows\Explorer.EXE</Data>
    <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
    <Data>bb82b8e0-8187-11e1-a97d-0014d1386dc9</Data>
  </EventData>
</Event>

Today I looked at another W7HP x64 SP1 (like the first, has all latest updates) I have here, but its explorer.exe is at a different, newer, rev level, 6.1.7601.17567.

My questions:

1. How might this PC have an older rev level of explorer.exe?

2. Can I copy the newer explorer.exe from PC #2 to PC #1, or is there more to it than that?

FWIW I did run SFC /SCANNOW on PC#1 with the older explorer.exe, and it reported no problems. AFAIK I have never mucked with a custom theme on this computer--just running a standard Aero theme.

 

[windude99]

I've been experiencing explorer.exe crashes recently, errors look like this:

Log Name:      Application
Source:        Application Error
Date:          4/8/2012 9:32:57 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Quadcore
Description:
Faulting application name: Explorer.EXE, version: 6.1.7601.17514, time stamp: 0x4ce7a144
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0150010
Fault offset: 0x000000000006f892
Faulting process id: 0x5b0
Faulting application start time: 0x01cd13724364afe0
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: bb82b8e0-8187-11e1-a97d-0014d1386dc9
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-04-08T14:32:57.000000000Z" />
    <EventRecordID>23780</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quadcore</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Explorer.EXE</Data>
    <Data>6.1.7601.17514</Data>
    <Data>4ce7a144</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7601.17725</Data>
    <Data>4ec4aa8e</Data>
    <Data>c0150010</Data>
    <Data>000000000006f892</Data>
    <Data>5b0</Data>
    <Data>01cd13724364afe0</Data>
    <Data>C:\Windows\Explorer.EXE</Data>
    <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
    <Data>bb82b8e0-8187-11e1-a97d-0014d1386dc9</Data>
  </EventData>
</Event>

Today I looked at another W7HP x64 SP1 (like the first, has all latest updates) I have here, but its explorer.exe is at a different, newer, rev level, 6.1.7601.17567.

My questions:

1. How might this PC have an older rev level of explorer.exe?

2. Can I copy the newer explorer.exe from PC #2 to PC #1, or is there more to it than that?

FWIW I did run SFC /SCANNOW on PC#1 with the older explorer.exe, and it reported no problems. AFAIK I have never mucked with a custom theme on this computer--just running a standard Aero theme.

Have you tried system restoring to before this started?

 

[Ztruker]

Are you up to date with Windows Updates? My C:\Windows\explorer.exe is also at 6.1.7601.17567 level.

02/25/2011 02:19 AM 2,871,808 explorer.exe

 

[maxseven]

Have you tried system restoring to before this started?

I have not, because I can't put my finger on when the explorer crashes started--they've been so few & far between I've not heretofore concerned myself with them, although I must admit I have been fiddling with disabling shell extensions (shellexview64) for some months now trying to find a possible culprit in there somewhere.

Are you up to date with Windows Updates? My C:\Windows\explorer.exe is also at 6.1.7601.17567 level.

02/25/2011 02:19 AM 2,871,808 explorer.exe

Yes, both machines are fully updated, which makes me wonder how the first machine (with the older revision 17514) could pass sfc /scannow.

Guess I will try to change-out the 17514 version of explorer.exe, though I wonder too about other dependencies...

UPDATE: I did a search on Explorer.exe on my PC, and found in ReportArchive that the crashes have been going-on back to September 2011, but only a few a month. This (in my defense) is why I was never inspired to do a System Restore.

Next I search the web and then the MS Support website for "Explorer.exe 6.1.7601.17567" and learned that this file was included in a September 2011 update. The easy thing to do was to download that update and install it, and it did install and appears to have worked i.e. both the files in C:\Windows and C:\Windows\SysWOW64 are now at the proper revision level.

I remain troubled as to how this happened, but for now at least it appears the subject question has been answered (though I can't yet confirm the crashing has stopped) so I will mark this thread as Solved.

Many thanks to Windude99 and Ztruker for helping-out with this!

 

[Ztruker]

Very strange why it was a different level and why sfc didn't flag something, but in any case, I hope that resolves the problem.

 

[maxseven]

I can only think that SFC's local repository of "installed software and updates" doesn't know about the update and thus the explorer.exe version is OK by it, but if I'd have done the update and then mucked with explorer.exe later then I expect it would have been flagged.

Still trying to figure-out what PC#1 did not get the update, but PC#2 did--I'd thought I was pretty disciplined about doing these things together...

Thanks you guys for jogging my brain on this.

 

[jmjsquared]

Hey there, maxseven,​

Have you nailed down the reason(s) for various flavors of explorer.exe appearing in properly updated versions of Windows 7 ? So far, I am at a loss to explain why this is so. When I saw this...​

Next I search the web and then the MS Support website for "Explorer.exe 6.1.7601.17567" and learned that this file was included in a September 2011 update. The easy thing to do was to download that update and install it, and it did install and appears to have worked i.e. both the files in C:\Windows and C:\Windows\SysWOW64 are now at the proper revision level.​

... I got curious and poked around in the update Windows6.1-KB2515325-x64 which, based on my limited knowledge, appears to be targeted to at least four versions of explorer.exe. ​

​

This leads me to "guess" that the Update does not necessarily update explorer.exe itself; rather the update is intended to address other issues that can occur with any of the mentioned flavors. In fact, you and I have the same version of explorer.exe (6.1.7601.17567) on a total of six x64 machines and, I've just confirmed, the same version is running on an x86 version of Windows 7. BUT there appears to be an "update" to that; ie., 6.1.7601.21669. Therefore, I tend to think that the numerical "superiority" of a particular version does not necessarily indicate any (significant?) improvement and, of course, SFC will not flag a numerically "inferior" version/file unless it is not in accord with Windows' cached version. ​

Whatcha think?​

---JMJ

 

[maxseven]

Whatcha think?---JMJ

I think yours is as good a theory as any, but then my normal curiosity to learn The Reason For Things tends to get beaten-down by MS i.e. when I get a problem fixed I then quit while I'm ahead (taking as many notes as I've had time for).

As for 6.1.7601.21669, I notice there's a 20910 in there also and it beats me what these might be about--heck the update is from over a year ago.

I think I feel a headache coming on...