Explorer.exe has stopped working.

[JoKiJo]

Version 6.1 Build 7600 64-bit.

I get the frequent error message saying that explorer.exe has stopped working. I've done both options... check online for a solution, and also simply restart the program. It doesn't seem like actually stops working and hasn't yet caused any real problems but is annoying. Anyone else had this, or know of any fix?

 

[H2SO4]

1) Fire up Regedit.
2) Navigate to this key: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting"
3) Right-click in the empty white space, then "New", DWORD, call it ForceQueue and set the value to 1.
4) Reproduce your Explorer crash.
5) Check under C:\Users\<your_account>\AppData\Local\Microsoft\Windows\WER\ReportArchive - there should be a new entry (folder) in there for your latest Explorer crash.
6) Zip up the CAB file from that folder and upload it here.

Analysis of the memory dump (MDMP) in that cabinet file may help to understand your specific Explorer crash.

==========================================

EDIT: If you don't feel confident about doing direct registry edits, steps 1 through 3 above can be accomplished instead by running this command on an elevated (run as admin) CMD prompt:

reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v ForceQueue /t REG_DWORD /d 1

 

[JoKiJo]

Thanks.

 

[H2SO4]

Thanks.

One of us is doing something wrong. After the ForceQueue registry value is added, a crash should produce a CAB file (containing a memory dump) in the same location. Either my instructions are wrong (which is entirely possible) or you didn't add the value in the right place/type.

Can you double-check that "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" contains a REG_DWORD value called "ForceQueue", and that it's set to 1?

 

[JoKiJo]

I was wondering where the CAB file was. The only files I see are WER.

I assumed since the folder had cab in the folder name that was what you were referring to.

I doubled checked and I think I created a QWORD rather than DWORD (sorry). I've deleted the ForceQueue entry and redone it correctly. Waiting on explorer.exe to crash.. Earlier it was almost every time I right clicked on desktop or did any navigating around folders. Very typical that it won't crash when I need it to.

So I'm looking for a .cab, correct? File is pending explorer.exe crash.

Thanks again.

 

[H2SO4]

I was wondering where the CAB file was. The only files I see are WER.

I assumed since the folder had cab in the folder name that was what you were referring to.

Yes, it should be a folder with "_cab_" towards the end of its name. Odd thing is that the folder you uploaded doesn't have that, and more to the point it doesn't have the CAB file in it.

What's interesting to me is that you saw a folder with "_cab_" in the name, so either it was briefly there only to be changed/deleted by the system, or perhaps you accidentally attached the wrong folder?

I'm still trying to work out how the WER subsystem works. It's a bit like jumping through hoops just to get something (the memory dump) which allows one to start troubleshooting

So I'm looking for a .cab, correct? File is pending explorer.exe crash.

Thanks again.

Yep, the (M)DMP file inside the CABinet is what I'm ultimately after. Thanks for sticking with it!

====================================
EDIT: Ah, I think I understand, at least partially. It's shipping off the cab/dump to MS and then deleting it. (I just experimented a little over here.)

Can you please add another value to confuse WER a little and get it to leave the dump on your machine, at least temporarily. Give it a false servername to send the report to:

reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v CorporateWERServer /t REG_SZ /d "NotReally"

In other words, add a REG_SZ value called CorporateWERServer and set it to anything bogus. After that, the dump will be generated but the upload and subsequent deletion won't happen. You should find the "_cab_" folder in ReportQueue rather than ReportArchive - it's still "queued" to be sent.

Sorry about the incomplete info before.

 

[Uber Philf]

Got FF 3.5 Installed?

 

[JoKiJo]

Yes, am using most recent Firefox.

Strangely, I haven't had a crash since I rebooted earlier.
Odd, because when these crashes began a restart was the first thing I did.

And again, you were right, I did see the right folder, but uploaded the wrong one. But this file/folder was last modified on the 18th at 8:29, which is before I did the registry edit, and plus I did the regedit with QWORD rather than DWORD.. Not sure if that matters. Thanks for sticking with me, I know I'm not making helping me easy. I don't know how I've managed to screw up on both the 1st reg edit and the uploading the wrong thing. Here's the right folder, but not sure if it'll identify the problem, or even if there is a problem anymore. Everything has been running perfect for a while now.

 

[Uber Philf]

IF you get the chance, try un-install FF, and use IE or another browser for a bit, and see if it crashes again.

 

[H2SO4]

And again, you were right, I did see the right folder, but uploaded the wrong one. But this file/folder was last modified on the 18th at 8:29, which is before I did the registry edit, and plus I did the regedit with QWORD rather than DWORD.. Not sure if that matters.

Stuff moves around in those folders shortly after a crash. Hopefully the addition of the bogus "CorporateWERServer" value should serve to stabilise the contents so that a dump can be grabbed.

Thanks for sticking with me, I know I'm not making helping me easy. I don't know how I've managed to screw up on both the 1st reg edit and the uploading the wrong thing.

Oh, that's no problem at all. I have a perverse interest in crashes, especially those that seem to affect many people potentially

Here's the right folder, but not sure if it'll identify the problem, or even if there is a problem anymore. Everything has been running perfect for a while now.

That's a rundll32.exe thing. I don't think it's related to the Explorer crashes. Doesn't matter. If you've added that CorporateWERServer=bogus value, the next Explorer crash ought to produce a useful memory dump.

====================================

By the way, it's entirely possible that the recent KB974431 update has resolved an underlying heap mangling bug. I've seen quite a number of people reporting Explorer.exe crashes that turned out to be caused by heap corruption issues with no obvious involvement from 3rd-party code. That update contains Explorer.exe and several related binaries, and it would address more than just the stuff talked about in the article description.

 

[JoKiJo]

I did recently install a load of updates.. Hopefully that fixed it. Hope I did the rep thing correctly, you went above and beyond to help me. Thanks again!

 

[H2SO4]

I did recently install a load of updates.. Hopefully that fixed it. Hope I did the rep thing correctly, you went above and beyond to help me. Thanks again!

Thanks, and I hope those updates resolve the crash issue for you