Explorer.exe crashes, faulting module: fundisc.dll. Help, I'm Lost.

[BadDayComing]

Hello.

I've been having issues with several computers now. All of them Windows 7 Professional 32 bits.

The error they're having is the same on each PC: explorer.exe fails and restarts after clicking Ok to the dialog.

Level: Error
Source: Application Error
Event ID: 1000
Faulting application: explorer.exe, version: 6.1.7601.175xx, time stamp: <changes>
faulting module: unknown, version: 0.0.0.0, time stamp: 0x00000000
exception code : 0xc0000005

I already:

• Ran viruschecks and spywarescans.
• Clean booted.
• sfc'd.
• Uninstalled all updates since the week previous to the first error.
• Created a fresh new profile for the user.
• Disabled all non-Microsoft shell extensions.
• Reinstalled Windows.

and non on them had made a difference.

The oldest issue is november 6th (there's not a single instance of the error before that date); since then, the issue is happening at least once a day but more like 5-10 times a day.

I ran Windbg and for almost all errors it points to "fundisc" module as the culprit, although i don't know what piece of software would be using it.

The only updates they had installed are security and critical updates via WSUS.

I'm starting to worry and i'm out of ideas.

Any more info upon request.

Any help will be appreciated.

 

[BadDayComing]

further info

This is one of the dumps:

Loading Dump File [C:\Users\<user>\Desktop\<other_user>\explorer.exe.680.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*;D:\WinDbg\Symbols\Win7AMD64;D:\WinDbg\Symbols\Win7x86;D:\WinDbg\Symbols\XPSP3
Executable search path is: D:\WinDbg\Image\XPSP3
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Tue Nov 20 09:43:21.000 2012 (UTC - 6:00)
System Uptime: not available
Process Uptime: 0 days 0:06:02.000
................................................................
...........................................................
Loading unloaded module list
........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2a8.884): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=0472f040 ecx=00000400 edx=00000000 esi=00000002 edi=00000000
eip=77c57094 esp=0472eff0 ebp=0472f08c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
77c57094 c3              ret
0:012> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\Windows\System32\ieframe.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ieframe.dll

FAULTING_IP: 
+0
0472f64c fc              cld

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0472f64c
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 0472f64c
Attempt to execute non-executable address 0472f64c

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  0472f64c

WRITE_ADDRESS:  0472f64c 

FOLLOWUP_IP: 
fundisc!CNotificationQueue::ThreadProc+31b
728963ee bfc0808a72      mov     edi,offset fundisc!WPP_GLOBAL_Control (728a80c0)

FAILED_INSTRUCTION_ADDRESS: 
+31b
0472f64c fc              cld

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  explorer.exe

LAST_CONTROL_TRANSFER:  from 76aa5d3f to 0472f64c

FAULTING_THREAD:  00000884

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT

BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT

IP_ON_STACK: 
+31b
0472f64c fc              cld

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0472f64c 76aa5d3f 00000008 03207428 fffffffe 0x472f64c
0472f7fc 76ad8f82 2246d5ac 03207428 00000000 ole32!COIDTable::ThreadCleanup+0xcb
0472f840 76ad8ec3 00000000 0472f890 76bd7724 ole32!FinishShutdown+0x9d
0472f860 76acbac3 00000000 728945f0 03207428 ole32!ApartmentUninitialize+0x96
0472f878 76ad88e8 0472f890 00000000 728a810c ole32!wCoUninitialize+0x153
0472f894 728963ee 00000000 00000000 0015c9d0 ole32!CoUninitialize+0x72
0472f8b0 77aded6c 0015c9d0 0472f8fc 77c7377b fundisc!CNotificationQueue::ThreadProc+0x31b
0472f8bc 77c7377b 0015c9d0 73c46ab8 00000000 kernel32!BaseThreadInitThunk+0xe
0472f8fc 77c7374e 72895224 0015c9d0 00000000 ntdll!__RtlUserThreadStart+0x70
0472f914 00000000 72895224 0015c9d0 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  .ecxr ; kb ; ~12s; .ecxr ; kb

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  fundisc!CNotificationQueue::ThreadProc+31b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fundisc

IMAGE_NAME:  fundisc.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bd9ff

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_fundisc.dll!CNotificationQueue::ThreadProc

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_IP_fundisc!CNotificationQueue::ThreadProc+31b

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_17567/4d6727a7/unknown/0_0_0_0/bbbbbbb4/c0000005/0472f64c.htm?Retriage=1

Followup: MachineOwner
---------

Here are some more dumps:
https://skydrive.live.com/redir?resid=904276C5319AF1CA!524
https://skydrive.live.com/redir?resid=904276C5319AF1CA!543
https://skydrive.live.com/redir?resid=904276C5319AF1CA!517

 

[Jacee]

PRIMARY_PROBLEM_CLASS: SOFTWARE_NX_FAULT

Did you read this? Explorer crashes frequently, seemingly when I open Outlook 2007 - Microsoft Community

also NX bit - Wikipedia, the free encyclopedia

 

[BadDayComing]

Oh, just found out what SOFTWARE_NX_FAULT stands for =[

I guess my issue is not directly related to Outlook since one of those users hardly opens it.

I did modify the registry and got some dumps which are the ones in the 2nd post.

I could disable DEP but i don't know if that would get me any more closer to know what the troubling application/extension is.

Is there a method to know who triggered DEP?

Thanks for your help =)

 

[Jacee]

Is there a method to know who triggered DEP?

I have no idea, but are you sure that you want to turn it off? :shock:
Change Data Execution Prevention settings

 

[BadDayComing]

Nope, i meant is there a way to know who called the .dll that faulted?

 

[BadDayComing]

This issue got fixed.

Just so i don't get to be one of those guys who fix their issues and don't bother to come back and let other people know the solution, here's the thread i made over at Technet: App crash: explorer.exe faulting module: fundisc