Win 7 x64 explorer crashes

StuartLockey · Oct 11, 2010

Hi,

I have the problem with the windows explorer crashng all the time. I've done the ShellExView thing and still get crashes, I've run the SFC /scannow and all is ok except for one error with the AMD version os opservices.dll, but as I'm using an Intel processor and the intel version iof opservices.dll is ok I think I can ignore that.

I've set the registry catch and attached the dump here.

If anyone can give me a pointer as to the cause of these crashes on my machine I'd be eternally grateful.

zigzag3143 · Oct 11, 2010

StuartLockey said:
Hi,

I have the problem with the windows explorer crashng all the time. I've done the ShellExView thing and still get crashes, I've run the SFC /scannow and all is ok except for one error with the AMD version os opservices.dll, but as I'm using an Intel processor and the intel version iof opservices.dll is ok I think I can ignore that.

I've set the registry catch and attached the dump here.

If anyone can give me a pointer as to the cause of these crashes on my machine I'd be eternally grateful.

We are getting some strange responses when we try to analyze your crash. Where did you get your OS from? Was it a download or did you purchase it directly?

Ken

CarlTR6 · Oct 11, 2010

Stuart, follow the instructions in this tutorial so we can take a deeper look at your system.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

StuartLockey · Oct 11, 2010

It's a full legit version of windows 7. I have an MSDN subscription adn this is one of my subscription copies. Installed from DVD. I downloaded the registry mod from these forums to cause teh dump to occur when the explorer crashed. What else can I do to help?

StuartLockey · Oct 11, 2010

CarlTR6 said:
Stuart, follow the instructions in this tutorial so we can take a deeper look at your system.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

This url doesn't seem to work it just jumps direct to this URL http://www.sevenforums.com/ !

StuartLockey · Oct 11, 2010

as requested more data

StuartLockey · Oct 12, 2010

StuartLockey · Oct 13, 2010

Is this more complex than I thought or am I beyond help?

wish · Oct 13, 2010

StuartLockey said:
as requested more data

StuartLockey said:
bump

StuartLockey said:
Is this more complex than I thought or am I beyond help?

Yes , I think your dump file is unusual with the other. And it indicates heap corruptions which hard to diagnose.

If you have third party firewall, antivirus, internet security -> please uninstall and replace it with MSE.

Perform Clean boot to troubleshoot which software or drivers that cause explorer crashes.

Do windows update because I see your explorer.exe timestamp and version is older than ntdll.dll .
explorer.exe = Fri Oct 30 19:14:21 2009 / version 16450
ntdll.dll = Tue Mar 23 22:58:10 2010 / version 16559

Code:

   Loaded symbol image file: explorer.exe
    Image path: C:\Windows\explorer.exe
    Image name: explorer.exe
    Timestamp:        Fri Oct 30 19:14:21 2009 (4AEBAB8D)
    CheckSum:         002CA0E9
    ImageSize:        002BF000
    File version:     6.1.7600.16450
    Product version:  6.1.7600.16450
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0:023> lmvm ntdll
start             end                 module name
00000000`77970000 00000000`77b1b000   ntdll    T (pdb symbols)          c:\windows\symbols\ntdll.pdb\0F7FCF88442F4B0E9FB51DC4A754D9DE2\ntdll.pdb
    Loaded symbol image file: ntdll.dll
    Image path: C:\Windows\System32\ntdll.dll
    Image name: ntdll.dll
    Timestamp:        Tue Mar 23 22:58:10 2010 (4BA9B802)
    CheckSum:         001B7506
    ImageSize:        001AB000
    File version:     6.1.7600.16559
    Product version:  6.1.7600.16559
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I dont know if that related with your problem but I've checked my windows -> my explorer.exe version/timestamp is newer than ntdll.dll. (Or at least they should have the same year)
CMIIW

Windbg Log:

Code:

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(11d0.180c): Unknown exception - code c0000374 (first/second chance not available)
Unable to load image C:\Windows\System32\ntdll.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntdll.dll
ntdll!NtWaitForSingleObject+0xa:
00000000`779bfd9a c3              ret
0:023> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6\comctl32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for comctl32.dll
*** WARNING: Unable to verify timestamp for explorer.exe
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
ntdll!RtlReportCriticalFailure+62
00000000`77a36df2 eb00            jmp     ntdll!RtlReportCriticalFailure+0x64 (00000000`77a36df4)

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000077a36df2 (ntdll!RtlReportCriticalFailure+0x0000000000000062)
   ExceptionCode: c0000374
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000077aac3f0

DEFAULT_BUCKET_ID:  STATUS_HEAP_CORRUPTION

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000374 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - <Unable to get error code text>

EXCEPTION_PARAMETER1:  0000000077aac3f0

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 00000000779dc53d

FAULTING_THREAD:  ffffffffffffffff

PRIMARY_PROBLEM_CLASS:  STATUS_HEAP_CORRUPTION

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_HEAP_CORRUPTION

IP_ON_HEAP:  00000000c0000374
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

STACK_TEXT:  
00000000`779dc53d ntdll! ?? ::FNODOBFM::`string'+0x122e4
00000000`77872c7a kernel32!HeapFree+0xa
000007fe`fc0e0ad0 comctl32!DSA_Destroy+0x34
000007fe`feba6be1 shell32!DSA_DestroyCallback+0x4d
000007fe`fec80062 shell32!CDefEventSinkContainer::`scalar deleting destructor'+0xd6
000007fe`fec7ffd4 shell32!CDefEventSinkContainer::Release+0x20
000007fe`fec7ff4e shell32!CItemStore::s_ClearEntry+0x34
000007fe`fc0e0b84 comctl32!DSA_EnumCallback+0x48
000007fe`feba18dd shell32!DSA_EnumCallback+0x4d
000007fe`fec7e216 shell32!CItemStore::DeleteItem+0x87
000007fe`fec7e3c9 shell32!CDefCollection::_RemoveAllItems+0x1d5
000007fe`fec7e91e shell32!CDefCollection::_DestroyCollection+0x92
000007fe`fec7e5d5 shell32!CDefCollection::~CDefCollection+0xc5
000007fe`fec7e4e8 shell32!CDefCollection::`vector deleting destructor'+0x14
000007fe`feb4a53d shell32!CCDBurn::Release+0x25
000007fe`fec792a4 shell32!CDefView::_ReleaseCurrentCollection+0xd9
000007fe`fec7acf2 shell32!CDefView::_DestroyView+0x22d
000007fe`f30a0d72 EXPLORERFRAME!CShellViewProvider::Release+0x33
000007fe`f30a0d02 EXPLORERFRAME!CShellBrowser::_ClearNavigationState+0x49
000007fe`f30a0bb5 EXPLORERFRAME!CShellBrowser::_ReleaseNavigationState+0x17c
000007fe`f30a69e3 EXPLORERFRAME!CShellBrowser::_SwitchNavigationState+0xed
000007fe`f30a55ca EXPLORERFRAME!CShellBrowser::_ActivateNavigation+0xfd
000007fe`f30a5473 EXPLORERFRAME!CShellBrowser::_OnConnectionCreated+0x2b5
000007fe`f30a50ac EXPLORERFRAME!CShellBrowser::OnNavigationResult+0x98
000007fe`f30a4fb1 EXPLORERFRAME!CPendingNavigation::OnConnectionCreated+0x4d
000007fe`f30a27ed EXPLORERFRAME!CShellViewFactory::BeginCreateConnection+0x116
000007fe`f30a2dde EXPLORERFRAME!CShellBrowser::_CreateConnectionForItem+0x36d
000007fe`f30a2a3a EXPLORERFRAME!CShellBrowser::_CreateNewConnection+0xd9
000007fe`f30a2946 EXPLORERFRAME!CShellBrowser::_NavigateToPidl+0x167
000007fe`f30bee59 EXPLORERFRAME!CShellBrowser::_OnGoto+0xeb
000007fe`f30bed83 EXPLORERFRAME!CShellBrowser::WndProcBS+0xc5f
000007fe`f306bb39 EXPLORERFRAME!IEFrameWndProc+0xef


FOLLOWUP_IP: 
shell32!CDefEventSinkContainer::`scalar deleting destructor'+d6
000007fe`fec80062 4883661000      and     qword ptr [rsi+10h],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  shell32!CDefEventSinkContainer::`scalar deleting destructor'+d6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: shell32

IMAGE_NAME:  shell32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4c4ef25d

STACK_COMMAND:  !heap ; dds 77aac458 ; kb

FAILURE_BUCKET_ID:  STATUS_HEAP_CORRUPTION_c0000374_shell32.dll!CDefEventSinkContainer::_scalar_deleting_destructor_

BUCKET_ID:  X64_APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_shell32!CDefEventSinkContainer::_scalar_deleting_destructor_+d6

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_1_7600_16450/4aebab8d/ntdll_dll/6_1_7600_16559/4ba9b802/c0000374/000c6df2.htm?Retriage=1

Followup: MachineOwner

StuartLockey · Oct 13, 2010

HI again

OK here is a griff dump from a clean booted machine. I have removed my PCTools firewall before I rebooted and re-ran this dump process.

What more can I provide for you.

btw I've checked 3 windows 7 X64 machines and they all have the same explorer.exe v6.1.7600.16450 dated 31/10/2009. I have run windows update as requested and nothing changed.

StuartLockey · Oct 13, 2010

StuartLockey said:
HI again

OK here is a griff dump from a clean booted machine..

Obviously this is the same machine what I mean was I booted a fresh and immediatly ran the griff program.

StuartLockey · Oct 13, 2010

Actually it hslps if I follow the links in the posts huh? here are the dumps from the clean booted machine e.g. with all services off etc.

wish · Oct 13, 2010

Unfortunately there is no dump files in both MoreDumps.zip and DumpfromcleanMachine.zip.
Have you try the Clean boot from my previous post?

StuartLockey · Oct 13, 2010

Hi Wish

Sorry I must be mis understanding you. I thought you were after the dumps created by the jcGriff program? If not then how do I create the dumps you're after?

Yes I did a clean boot as per the link before running the jcgriff program.

Appologies for the confusion, but I'm trying my best. Can you explain exactly which dumps you're after and how I can create them.

wish · Oct 13, 2010

Hi stuart
No problem about that.
Yes, you little bit misunderstand with the dump file.
Usually explorer.exe crash / stop working -> it's not always lead to BSOD and generated dump files.
In my experience, if explorer crash it could be run again / restart the explorer.exe from taskmanager.

Then you said that you downloaded the registry mod from this forums to cause the dump to occur when the explorer crashed. That's why your previous dump is unfamiliar for me.

Anyway how is your clean boot going? Is the explorer still crash in that mode?
If the problem gone, you can manually start/check one by one programs, services and startup to run again.
You'll be able to find out which services/program that causing problem.

StuartLockey · Oct 15, 2010

Hi again

OK running after a clean boot, only MS services running and the only startup apps running was the WHS client.

I also had running roboform and VS2010 which I was using.

I had a number for folders open but was actually in VS2010 and I got the 'explorer has ceashed popup. Restarted it and here is the dump. Hopefully it'll be more useful this time

wish · Oct 16, 2010

Hi,
Your dump point to = Explorer.exe application crash with exeption code c0000005 (Access violation).
And the debugger couldn't verify lots of your windows .dll, maybe it got corrupted.
So perform system file checker-> cmd (as administartor) -> sfc /scannow.

Then run Shellexeview to view of all shell extensions in use.
The non-Microsoft extensions are shown on a pink background (tips: sort by company), disable all of these by right mouseclick and choosing Disable.
If Explorer will function correctly thereafter, start enabling each extension subsequently, check Explorer operation each time until you find the troublemaker.

Also pay attention to rpcrt4.dll (Windows applications for network and Internet communication)
Use autoruns for windows to look explorer shell extensions and to find non microsoft program that load rpcrt4.dll

Logs

Code:

FAULTING_IP: 
ntdll!RtlFreeHeap+d0
00000000`77321c30 4c8b6308        mov     r12,qword ptr [rbx+8]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000077321c30 (ntdll!RtlFreeHeap+0x00000000000000d0)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000a22e0b77338
Attempt to read from address 00000a22e0b77338

BUGCHECK_STR:  HANG

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000a22e0b77338

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  0000000000000017

DERIVED_WAIT_CHAIN:  

Dl Eid Cid     WaitType
-- --- ------- --------------------------
   23  cf8.1b80 Handle                 

WAIT_CHAIN_COMMAND:  ~23s;k;;

BLOCKING_THREAD:  0000000000001b80

DEFAULT_BUCKET_ID:  APPLICATION_HANG_HungIn_ExceptionHandler

PRIMARY_PROBLEM_CLASS:  APPLICATION_HANG_HungIn_ExceptionHandler

LAST_CONTROL_TRANSFER:  from 000007fefd2e13a6 to 000000007732030a

STACK_TEXT:  
00000000`0a29d648 000007fe`fd2e13a6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!ZwWaitForMultipleObjects+0xa
00000000`0a29d650 00000000`770d3143 : 00000000`0a29d790 00000000`0a29d780 00000000`00000000 00000000`00000000 : KERNELBASE!WaitForMultipleObjectsEx+0xe8
00000000`0a29d750 00000000`77149025 : 00000000`03640000 00000000`0a29da20 00000000`00000000 00000000`0a29fc10 : kernel32!WaitForMultipleObjectsExImplementation+0xb3
00000000`0a29d7e0 00000000`771491a7 : 00000000`00000000 01000000`00000080 00000000`00001a0c 00000000`00000000 : kernel32!WerpReportFaultInternal+0x215
00000000`0a29d880 00000000`771491ff : 00000000`0a29da20 00000000`00000001 00000000`00000000 00000000`00000051 : kernel32!WerpReportFault+0x77
00000000`0a29d8b0 00000000`7714941c : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`0a29de70 : kernel32!BasepReportFault+0x1f
00000000`0a29d8e0 00000000`77364ebc : 00000000`0a29da20 00000000`00000006 000007fe`00000000 000007fe`00000001 : kernel32!UnhandledExceptionFilter+0x1fc
00000000`0a29d9c0 00000000`0a29da20 : 00000000`00000006 000007fe`00000000 000007fe`00000001 00000000`0a29db20 : ntdll! ?? ::FNODOBFM::`string'+0x2335
00000000`0a29d9c8 00000000`00000006 : 000007fe`00000000 000007fe`00000001 00000000`0a29db20 00000000`772e50c8 : 0xa29da20
00000000`0a29d9d0 000007fe`00000000 : 000007fe`00000001 00000000`0a29db20 00000000`772e50c8 00000000`0a29e660 : 0x6
00000000`0a29d9d8 000007fe`00000001 : 00000000`0a29db20 00000000`772e50c8 00000000`0a29e660 00000000`0a29e170 : 0x7fe`00000000
00000000`0a29d9e0 00000000`0a29db20 : 00000000`772e50c8 00000000`0a29e660 00000000`0a29e170 000007fe`ff060000 : 0x7fe`00000001
00000000`0a29d9e8 00000000`772e50c8 : 00000000`0a29e660 00000000`0a29e170 000007fe`ff060000 00000000`0a29e660 : 0xa29db20
00000000`0a29d9f0 00000000`0a29e660 : 00000000`0a29e170 000007fe`ff060000 00000000`0a29e660 00000000`00000000 : ntdll!_C_specific_handler+0x8c
00000000`0a29d9f8 00000000`0a29e170 : 000007fe`ff060000 00000000`0a29e660 00000000`00000000 00000000`0a29e170 : 0xa29e660
00000000`0a29da00 000007fe`ff060000 : 00000000`0a29e660 00000000`00000000 00000000`0a29e170 00000000`0a29e660 : 0xa29e170
00000000`0a29da08 00000000`0a29e660 : 00000000`00000000 00000000`0a29e170 00000000`0a29e660 00000000`0a29e170 : rpcrt4!COMMON_ResubmitListen <PERF> (rpcrt4+0x0)
00000000`0a29da10 00000000`00000000 : 00000000`0a29e170 00000000`0a29e660 00000000`0a29e170 00000000`772d0000 : 0xa29e660


SYMBOL_STACK_INDEX:  10

SYMBOL_NAME:  rpcrt4!COMMON_ResubmitListen <PERF> (rpcrt4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: rpcrt4

IMAGE_NAME:  rpcrt4.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5be035

STACK_COMMAND:  ~23s ; kb

BUCKET_ID:  X64_HANG_rpcrt4!COMMON_ResubmitListen__PERF__(rpcrt4

FAILURE_BUCKET_ID:  APPLICATION_HANG_HungIn_ExceptionHandler_cfffffff_rpcrt4.dll!COMMON_ResubmitListen__PERF__

WATSON_STAGEONE_URL:  http://watson.microsoft.com/00051c30.htm?Retriage=1

Followup: MachineOwner
---------

0:023> lmtsmn
start             end                 module name
000007fe`f9630000 000007fe`f9659000   aclui    aclui.dll    Mon Jul 13 18:24:56 2009 (4A5BDE68)
000007fe`ece90000 000007fe`ecea2000   acppage  acppage.dll  Mon Jul 13 18:24:57 2009 (4A5BDE69)
000007fe`ef770000 000007fe`ef832000   Actioncenter Actioncenter.dll Mon Jul 13 18:25:00 2009 (4A5BDE6C)
000007fe`f26b0000 000007fe`f279e000   actxprxy actxprxy.dll Mon Jul 13 18:25:06 2009 (4A5BDE72)
000007fe`fd600000 000007fe`fd6db000   advapi32 advapi32.dll Mon Jul 13 18:24:59 2009 (4A5BDE6B)
000007fe`fac60000 000007fe`fac70000   AltTab   AltTab.dll   Mon Jul 13 18:25:19 2009 (4A5BDE7F)
000007fe`fd100000 000007fe`fd157000   apphelp  apphelp.dll  Mon Jul 13 18:26:04 2009 (4A5BDEAC)
000007fe`da080000 000007fe`da137000   appwiz   appwiz.cpl   Mon Jul 13 18:26:15 2009 (4A5BDEB7)
00000000`0a810000 00000000`0a8ed000   atiacm64 atiacm64.dll Tue Aug 03 18:18:11 2010 (4C58BFD3)
00000000`042c0000 00000000`042c3000   atiamenu atiamenu.dll Tue Aug 03 18:16:59 2010 (4C58BF8B)
000007fe`fb220000 000007fe`fb239000   atl      atl.dll      Mon Jul 13 18:25:04 2009 (4A5BDE70)
000007fe`faf50000 000007fe`faf9f000   AudioSes AudioSes.dll Mon Jul 13 18:25:09 2009 (4A5BDE75)
000007fe`fbd10000 000007fe`fbee8000   authui   authui.dll   Mon Jul 13 18:25:27 2009 (4A5BDE87)
000007fe`fbef0000 000007fe`fbef9000   avrt     avrt.dll     Mon Jul 13 18:25:42 2009 (4A5BDE96)
000007fe`fa860000 000007fe`fa91a000   batmeter batmeter.dll Mon Jul 13 18:25:07 2009 (4A5BDE73)
000007fe`fcc50000 000007fe`fcc72000   bcrypt   bcrypt.dll   Mon Jul 13 18:25:13 2009 (4A5BDE79)
000007fe`fc740000 000007fe`fc78c000   bcryptprimitives bcryptprimitives.dll Mon Jul 13 18:25:14 2009 (4A5BDE7A)
000007fe`f0ba0000 000007fe`f0c55000   bthprops bthprops.cpl Mon Jul 13 18:25:48 2009 (4A5BDE9C)
000007fe`faad0000 000007fe`faaf6000   cabview  cabview.dll  Fri Jan 08 23:10:55 2010 (4B482BFF)
000007fe`fd5c0000 000007fe`fd5f6000   cfgmgr32 cfgmgr32.dll Mon Jul 13 18:26:02 2009 (4A5BDEAA)
000007fe`fdc30000 000007fe`fdcc9000   clbcatq  clbcatq.dll  Mon Jul 13 18:26:18 2009 (4A5BDEBA)
000007fe`e6bf0000 000007fe`e7555000   clr      clr.dll      Thu Mar 18 05:39:07 2010 (4BA21EEB)
000007fe`fba00000 000007fe`fbbf4000   comctl32 comctl32.dll Fri Aug 20 23:12:27 2010 (4C6F6E4B)
000007fe`ed2e0000 000007fe`ed490000   comsvcs  comsvcs.dll  Mon Jul 13 18:29:37 2009 (4A5BDF81)
000007fe`fc700000 000007fe`fc709000   credssp  credssp.dll  Mon Jul 13 18:29:49 2009 (4A5BDF8D)
000007fe`fd350000 000007fe`fd4b6000   crypt32  crypt32.dll  Mon Jul 13 18:29:52 2009 (4A5BDF90)
000007fe`fd160000 000007fe`fd16f000   CRYPTBASE CRYPTBASE.dll Mon Jul 13 18:29:53 2009 (4A5BDF91)
000007fe`fcb00000 000007fe`fcb17000   cryptsp  cryptsp.dll  Mon Jul 13 18:29:58 2009 (4A5BDF96)
000007fe`fbc00000 000007fe`fbd09000   cryptui  cryptui.dll  Mon Jul 13 18:30:00 2009 (4A5BDF98)
000007fe`f8c00000 000007fe`f8c0f000   cscapi   cscapi.dll   Mon Jul 13 18:30:03 2009 (4A5BDF9B)
000007fe`f2b30000 000007fe`f2b3c000   cscdll   cscdll.dll   Mon Jul 13 18:30:04 2009 (4A5BDF9C)
000007fe`f0820000 000007fe`f085e000   cscobj   cscobj.dll   Mon Jul 13 18:30:06 2009 (4A5BDF9E)
000007fe`f29f0000 000007fe`f2a6e000   cscui    cscui.dll    Mon Jul 13 18:30:08 2009 (4A5BDFA0)
000007fe`faa80000 000007fe`faa87000   d3d8thk  d3d8thk.dll  Mon Jul 13 18:26:19 2009 (4A5BDEBB)
000007fe`d7f60000 000007fe`d815f000   d3d9     d3d9.dll     Mon Jul 13 18:26:20 2009 (4A5BDEBC)
000007fe`fd5a0000 000007fe`fd5ba000   devobj   devobj.dll   Mon Jul 13 18:26:57 2009 (4A5BDEE1)
000007fe`fc590000 000007fe`fc5a2000   devrtl   devrtl.dll   Mon Jul 13 18:26:58 2009 (4A5BDEE2)
000007fe`fa2e0000 000007fe`fa2f8000   dhcpcsvc dhcpcsvc.dll Mon Jul 13 18:26:30 2009 (4A5BDEC6)
000007fe`fa360000 000007fe`fa371000   dhcpcsvc6 dhcpcsvc6.DLL Mon Jul 13 18:26:31 2009 (4A5BDEC7)
000007fe`fc920000 000007fe`fc97b000   dnsapi   dnsapi.dll   Mon Jul 13 18:27:09 2009 (4A5BDEED)
000007fe`fb0a0000 000007fe`fb0ac000   dsrole   dsrole.dll   Mon Jul 13 18:27:57 2009 (4A5BDF1D)
000007fe`fb680000 000007fe`fb772000   dui70    dui70.dll    Mon Jul 13 18:28:05 2009 (4A5BDF25)
000007fe`fb630000 000007fe`fb673000   duser    duser.dll    Mon Jul 13 18:28:06 2009 (4A5BDF26)
000007fe`fc050000 000007fe`fc068000   dwmapi   dwmapi.dll   Mon Jul 13 18:28:07 2009 (4A5BDF27)
000007fe`fa7e0000 000007fe`fa854000   DXP      DXP.dll      Mon Jul 13 18:28:13 2009 (4A5BDF2D)
000007fe`fac70000 000007fe`fac7b000   ehSSO    ehSSO.dll    Mon Jul 13 18:27:16 2009 (4A5BDEF4)
000007fe`fadc0000 000007fe`fade7000   EhStorAPI EhStorAPI.dll Mon Jul 13 18:27:17 2009 (4A5BDEF5)
000007fe`f2ae0000 000007fe`f2b15000   EhStorShell EhStorShell.dll Mon Jul 13 18:27:22 2009 (4A5BDEFA)
000007fe`fb020000 000007fe`fb087000   es       es.dll       Mon Jul 13 18:29:30 2009 (4A5BDF7A)
00000000`ff3f0000 00000000`ff6af000   explorer explorer.exe Fri Oct 30 20:14:21 2009 (4AEBAB8D)
000007fe`f2cc0000 000007fe`f2e8a000   EXPLORERFRAME EXPLORERFRAME.dll Mon Jul 13 18:29:38 2009 (4A5BDF82)
000007fe`fc3b0000 000007fe`fc46b000   FirewallAPI FirewallAPI.dll Mon Jul 13 18:27:25 2009 (4A5BDEFD)
000007fe`f3c10000 000007fe`f3c5c000   framedynos framedynos.dll Mon Jul 13 18:27:36 2009 (4A5BDF08)
000007fe`fab00000 000007fe`fab10000   fusion   fusion.dll   Thu Mar 18 05:27:41 2010 (4BA21C3D)
000007fe`edba0000 000007fe`edc3d000   FXSAPI   FXSAPI.dll   Mon Jul 13 18:27:57 2009 (4A5BDF1D)
00000000`74070000 00000000`74153000   FXSRESM  FXSRESM.dll  Mon Jul 13 18:28:06 2009 (4A5BDF26)
000007fe`edc40000 000007fe`edd17000   FXSST    FXSST.dll    Mon Jul 13 18:28:09 2009 (4A5BDF29)
000007fe`f2290000 000007fe`f2533000   gameux   gameux.dll   Mon Jul 13 18:27:25 2009 (4A5BDEFD)
000007fe`fe0c0000 000007fe`fe127000   gdi32    gdi32.dll    Mon Jul 13 18:27:29 2009 (4A5BDF01)
000007fe`fb780000 000007fe`fb995000   GdiPlus  GdiPlus.dll  Mon Jul 13 18:24:55 2009 (4A5BDE67)
000007fe`f9440000 000007fe`f944b000   hcproviders hcproviders.dll Mon Jul 13 18:27:38 2009 (4A5BDF0A)
000007fe`ee2a0000 000007fe`ee2f5000   hgcpl    hgcpl.dll    Mon Jul 13 18:27:49 2009 (4A5BDF15)
000007fe`fc070000 000007fe`fc07b000   hid      hid.dll      Mon Jul 13 18:27:53 2009 (4A5BDF19)
000007fe`f2ad0000 000007fe`f2ad8000   IconCodecService IconCodecService.dll Mon Jul 13 18:28:17 2009 (4A5BDF31)
000007fe`ef970000 000007fe`f0542000   ieframe  ieframe.dll  Tue Sep 07 22:24:11 2010 (4C871DFB)
000007fe`f0a20000 000007fe`f0a93000   ieproxy  ieproxy.dll  Tue Sep 07 22:24:13 2010 (4C871DFD)
000007fe`fdcd0000 000007fe`fdf28000   iertutil iertutil.dll Tue Sep 07 22:24:15 2010 (4C871DFF)
000007fe`ff040000 000007fe`ff057000   imagehlp imagehlp.dll Mon Jul 13 18:28:20 2009 (4A5BDF34)
000007fe`ee670000 000007fe`ee6f0000   imapi2   imapi2.dll   Mon Jul 13 18:28:27 2009 (4A5BDF3B)
000007fe`fdc00000 000007fe`fdc2e000   imm32    imm32.dll    Mon Jul 13 18:28:32 2009 (4A5BDF40)
000007fe`fa4e0000 000007fe`fa507000   IPHLPAPI IPHLPAPI.DLL Mon Jul 13 18:28:55 2009 (4A5BDF57)
00000000`770b0000 00000000`771cf000   kernel32 kernel32.dll Mon Jul 13 18:31:11 2009 (4A5BDFDF)
000007fe`fd2e0000 000007fe`fd34b000   KERNELBASE KERNELBASE.dll Mon Jul 13 18:31:12 2009 (4A5BDFE0)
00000000`74ff0000 00000000`74ff6000   ksuser   ksuser.dll   Mon Jul 13 18:31:21 2009 (4A5BDFE9)
000007fe`f2650000 000007fe`f265c000   linkinfo linkinfo.dll Mon Jul 13 18:28:43 2009 (4A5BDF4B)
000007fe`fd6e0000 000007fe`fd6ee000   lpk      lpk.dll      Mon Jul 13 18:29:03 2009 (4A5BDF5F)
000007fe`f4470000 000007fe`f44ba000   lzhfldr2 lzhfldr2.dll Mon Jul 13 18:30:35 2009 (4A5BDFBB)
000007fe`fae70000 000007fe`fae79000   midimap  midimap.dll  Mon Jul 13 18:30:38 2009 (4A5BDFBE)
000007fe`f9b60000 000007fe`f9b9b000   mlang    mlang.dll    Mon Jul 13 18:29:05 2009 (4A5BDF61)
000007fe`fc0d0000 000007fe`fc11b000   MMDevAPI MMDevAPI.dll Mon Jul 13 18:29:12 2009 (4A5BDF68)
000007fe`f9280000 000007fe`f9298000   mpr      mpr.dll      Mon Jul 13 18:29:24 2009 (4A5BDF74)
000007fe`faf00000 000007fe`faf0a000   msacm32  msacm32.drv  Mon Jul 13 18:29:52 2009 (4A5BDF90)
000007fe`faed0000 000007fe`faee8000   msacm32_7fefaed0000 msacm32.dll  Mon Jul 13 18:29:51 2009 (4A5BDF8F)
000007fe`fd2d0000 000007fe`fd2df000   msasn1   msasn1.dll   Sat Aug 29 00:40:40 2009 (4A98DB78)
000007fe`f8f60000 000007fe`f8fcf000   mscoree  mscoree.dll  Thu Nov 05 21:09:26 2009 (4AF3AF86)
000007fe`f8ce0000 000007fe`f8d70000   mscoreei mscoreei.dll Thu Mar 18 05:27:36 2010 (4BA21C38)
000007fe`ff270000 000007fe`ff379000   msctf    msctf.dll    Mon Jul 13 18:30:18 2009 (4A5BDFAA)
000007fe`f2580000 000007fe`f2646000   msftedit msftedit.dll Mon Jul 13 18:30:50 2009 (4A5BDFCA)
000007fe`f1ee0000 000007fe`f21f6000   msi      msi.dll      Mon Jul 13 18:31:09 2009 (4A5BDFDD)
000007fe`f2200000 000007fe`f2209000   msiltcfg msiltcfg.dll Mon Jul 13 18:31:17 2009 (4A5BDFE5)
000007fe`f2540000 000007fe`f257b000   msls31   msls31.dll   Mon Jul 13 18:31:24 2009 (4A5BDFEC)
000007fe`f0e90000 000007fe`f0ead000   mssprxy  mssprxy.dll  Mon Jul 13 18:30:18 2009 (4A5BDFAA)
000007fe`eceb0000 000007fe`ecf81000   MSVCR100_CLR0400 MSVCR100_CLR0400.dll Thu Mar 18 05:48:28 2010 (4BA2211C)
000007fe`fd770000 000007fe`fd80f000   msvcrt   msvcrt.dll   Mon Jul 13 18:30:38 2009 (4A5BDFBE)
000007fe`f8060000 000007fe`f8250000   msxml6   msxml6.dll   Mon Jul 13 18:30:48 2009 (4A5BDFC8)
000007fe`f95b0000 000007fe`f95dd000   mtxoci   mtxoci.dll   Mon Jul 13 18:30:54 2009 (4A5BDFCE)
000007fe`ed490000 000007fe`ed5d8000   NaturalLanguage6 NaturalLanguage6.dll Mon Jul 13 18:30:52 2009 (4A5BDFCC)
000007fe`fcc80000 000007fe`fccce000   ncrypt   ncrypt.dll   Mon Jul 13 18:31:00 2009 (4A5BDFD4)
000007fe`fab80000 000007fe`fab96000   netapi32 netapi32.dll Mon Jul 13 18:31:13 2009 (4A5BDFE1)
000007fe`f1a70000 000007fe`f1cfb000   netshell netshell.dll Mon Jul 13 18:30:58 2009 (4A5BDFD2)
000007fe`fa9e0000 000007fe`fa9ec000   netutils netutils.dll Mon Jul 13 18:31:00 2009 (4A5BDFD4)
000007fe`f1d40000 000007fe`f1edc000   NetworkExplorer NetworkExplorer.dll Mon Jul 13 18:31:01 2009 (4A5BDFD5)
000007fe`fb3e0000 000007fe`fb3f5000   nlaapi   nlaapi.dll   Mon Jul 13 18:30:49 2009 (4A5BDFC9)
000007fe`ec4d0000 000007fe`ecacf000   NLSData0009 NLSData0009.dll Mon Jul 13 18:31:02 2009 (4A5BDFD6)
00000000`6ff40000 00000000`701c3000   NLSLexicons0009 NLSLexicons0009.dll Mon Jul 13 18:31:42 2009 (4A5BDFFE)
00000000`77490000 00000000`77493000   normaliz normaliz.dll Mon Jul 13 18:32:18 2009 (4A5BE022)
000007fe`f54f0000 000007fe`f54fc000   npmproxy npmproxy.dll Mon Jul 13 18:32:19 2009 (4A5BE023)
00000000`64b80000 00000000`64ba6000   NppShell_01 NppShell_01.dll Wed Oct 14 16:20:37 2009 (4AD65CC5)
000007fe`fd810000 000007fe`fd818000   nsi      nsi.dll      Mon Jul 13 18:32:25 2009 (4A5BE029)
00000000`772d0000 00000000`7747b000   ntdll    ntdll.dll    Tue Mar 23 23:58:10 2010 (4BA9B802)
000007fe`f5ba0000 000007fe`f5bc7000   ntdsapi  ntdsapi.dll  Mon Jul 13 18:32:30 2009 (4A5BE02E)
000007fe`fb5c0000 000007fe`fb5ed000   ntmarta  ntmarta.dll  Mon Jul 13 18:32:45 2009 (4A5BE03D)
000007fe`f2970000 000007fe`f29f0000   ntshrui  ntshrui.dll  Mon Jul 13 18:32:47 2009 (4A5BE03F)
000007fe`ff380000 000007fe`ff582000   ole32    ole32.dll    Mon Jun 28 22:30:11 2010 (4C2984E3)
000007fe`f0b40000 000007fe`f0b94000   oleacc   oleacc.dll   Mon Jul 13 18:32:11 2009 (4A5BE01B)
000007fe`ff190000 000007fe`ff267000   oleaut32 oleaut32.dll Wed Apr 07 00:31:53 2010 (4BBC34E9)
000007fe`f15b0000 000007fe`f15ba000   osbaseln osbaseln.dll Mon Jul 13 18:32:04 2009 (4A5BE014)
000007fe`faa10000 000007fe`faa20000   PhotoBase PhotoBase.dll Mon Jul 13 18:32:38 2009 (4A5BE036)
000007fe`d9d80000 000007fe`d9f2a000   PhotoViewer PhotoViewer.dll Mon Jul 13 18:32:40 2009 (4A5BE038)
000007fe`f0c60000 000007fe`f0e1d000   pnidui   pnidui.dll   Mon Jul 13 18:32:53 2009 (4A5BE045)
000007fe`fa680000 000007fe`fa73d000   PortableDeviceApi PortableDeviceApi.dll Mon Jul 13 18:33:11 2009 (4A5BE057)
000007fe`fa740000 000007fe`fa779000   PortableDeviceTypes PortableDeviceTypes.dll Mon Jul 13 18:33:16 2009 (4A5BE05C)
000007fe`fc120000 000007fe`fc14c000   powrprof powrprof.dll Mon Jul 13 18:33:22 2009 (4A5BE062)
000007fe`d6920000 000007fe`d6a24000   printui  printui.dll  Mon Jul 13 18:33:28 2009 (4A5BE068)
000007fe`faca0000 000007fe`fad09000   prnfldr  prnfldr.dll  Mon Jul 13 18:33:30 2009 (4A5BE06A)
000007fe`ec2d0000 000007fe`ec302000   prnntfy  prnntfy.dll  Mon Jul 13 18:33:31 2009 (4A5BE06B)
000007fe`fd230000 000007fe`fd23f000   profapi  profapi.dll  Mon Jul 13 18:32:15 2009 (4A5BE01F)
000007fe`fbf00000 000007fe`fc02c000   propsys  propsys.dll  Mon Jul 13 18:32:18 2009 (4A5BE022)
000007fe`ee6f0000 000007fe`ee721000   provsvc  provsvc.dll  Mon Jul 13 18:32:20 2009 (4A5BE024)
00000000`774a0000 00000000`774a7000   psapi    psapi.dll    Mon Jul 13 16:26:21 2009 (4A5BC29D)
000007fe`ec290000 000007fe`ec2c3000   puiapi   puiapi.dll   Mon Jul 13 18:32:30 2009 (4A5BE02E)
000007fe`da420000 000007fe`da48e000   puiobj   puiobj.dll   Mon Jul 13 18:32:31 2009 (4A5BE02F)
000007fe`f0550000 000007fe`f0595000   QAGENT   QAGENT.DLL   Mon Jul 13 18:32:21 2009 (4A5BE025)
000007fe`f0a00000 000007fe`f0a1f000   QUTIL    QUTIL.DLL    Mon Jul 13 18:32:35 2009 (4A5BE033)
000007fe`ebbb0000 000007fe`ebbe3000   RarExt   RarExt.dll   Sun Mar 14 23:28:21 2010 (4B9DD385)
000007fe`da370000 000007fe`da40e000   riched20 riched20.dll Mon Jul 13 18:33:17 2009 (4A5BE05D)
000007fe`fa9f0000 000007fe`fa9f7000   riched32 riched32.dll Mon Jul 13 18:33:18 2009 (4A5BE05E)
000007fe`ff060000 000007fe`ff18e000   rpcrt4   rpcrt4.dll   Mon Jul 13 18:32:37 2009 (4A5BE035)
000007fe`fd210000 000007fe`fd224000   RpcRtRemote RpcRtRemote.dll Mon Jul 13 18:32:38 2009 (4A5BE036)
000007fe`fc800000 000007fe`fc847000   rsaenh   rsaenh.dll   Mon Jul 13 18:32:41 2009 (4A5BE039)
000007fe`fa920000 000007fe`fa934000   samcli   samcli.dll   Mon Jul 13 18:32:31 2009 (4A5BE02F)
000007fe`fc080000 000007fe`fc09d000   samlib   samlib.dll   Mon Jul 13 18:32:32 2009 (4A5BE030)
000007fe`f9530000 000007fe`f954a000   sbdrop   sbdrop.dll   Mon Jul 13 18:32:34 2009 (4A5BE032)
000007fe`ebad0000 000007fe`ebba5000   SearchFolder SearchFolder.dll Mon Jul 13 18:33:17 2009 (4A5BE05D)
000007fe`fe0a0000 000007fe`fe0bf000   sechost  sechost.dll  Mon Jul 13 18:33:18 2009 (4A5BE05E)
000007fe`fcf00000 000007fe`fcf0b000   secur32  secur32.dll  Mon Jul 13 18:33:26 2009 (4A5BE066)
000007fe`fd8a0000 000007fe`fda77000   setupapi setupapi.dll Mon Jul 13 18:33:06 2009 (4A5BE052)
00000000`73250000 00000000`73253000   sfc      sfc.dll      Mon Jul 13 18:33:11 2009 (4A5BE057)
000007fe`f8d70000 000007fe`f8d80000   sfc_os   sfc_os.dll   Mon Jul 13 18:33:12 2009 (4A5BE058)
000007fe`f2660000 000007fe`f2693000   shdocvw  shdocvw.dll  Mon Jul 13 18:33:07 2009 (4A5BE053)
000007fe`fe130000 000007fe`feeb6000   shell32  shell32.dll  Tue Jul 27 07:51:09 2010 (4C4EF25D)
00000000`22000000 00000000`2203d000   shellExt shellExt.dll Thu Aug 12 05:10:46 2010 (4C63E4C6)
000007fe`fd6f0000 000007fe`fd761000   shlwapi  shlwapi.dll  Mon Jul 13 18:33:13 2009 (4A5BE059)
000007fe`fb090000 000007fe`fb09b000   slc      slc.dll      Mon Jul 13 18:33:23 2009 (4A5BE063)
000007fe`fb5f0000 000007fe`fb62b000   SndVolSSO SndVolSSO.DLL Mon Jul 13 18:33:49 2009 (4A5BE07D)
000007fe`f0630000 000007fe`f0688000   srchadmin srchadmin.dll Mon Jul 13 18:33:47 2009 (4A5BE07B)
000007fe`fcd80000 000007fe`fcda3000   srvcli   srvcli.dll   Mon Jul 13 18:34:06 2009 (4A5BE08E)
000007fe`fd0d0000 000007fe`fd0f5000   sspicli  sspicli.dll  Mon Jul 13 18:34:13 2009 (4A5BE095)
000007fe`fad10000 000007fe`fad52000   stobject stobject.dll Mon Jul 13 18:33:32 2009 (4A5BE06C)
000007fe`eba50000 000007fe`ebacb000   StructuredQuery StructuredQuery.dll Wed May 05 00:27:40 2010 (4BE11DEC)
000007fe`fd170000 000007fe`fd202000   sxs      sxs.dll      Mon Jul 13 18:33:35 2009 (4A5BE06F)
000007fe`ee730000 000007fe`ee95b000   SyncCenter SyncCenter.dll Mon Jul 13 18:33:40 2009 (4A5BE074)
000007fe`d9f30000 000007fe`d9f4b000   synceng  synceng.dll  Mon Jul 13 18:33:41 2009 (4A5BE075)
000007fe`fac80000 000007fe`fac96000   Syncreg  Syncreg.dll  Mon Jul 13 18:33:45 2009 (4A5BE079)
000007fe`d9f50000 000007fe`d9f85000   syncui   syncui.dll   Mon Jul 13 18:33:46 2009 (4A5BE07A)
000007fe`f15c0000 000007fe`f15df000   thumbcache thumbcache.dll Mon Jul 13 18:33:34 2009 (4A5BE06E)
000007fe`f2880000 000007fe`f2903000   timedate timedate.cpl Mon Jul 13 18:33:36 2009 (4A5BE070)
000007fe`f2210000 000007fe`f228f000   tiptsf   tiptsf.dll   Mon Jul 13 18:33:42 2009 (4A5BE076)
000007fe`f10e0000 000007fe`f131c000   tquery   tquery.dll   Mon Jul 13 18:33:50 2009 (4A5BE07E)
000007fe`f1970000 000007fe`f199e000   twext    twext.dll    Mon Jul 13 18:34:38 2009 (4A5BE0AE)
000007fe`f19f0000 000007fe`f1a11000   UIAnimation UIAnimation.dll Mon Jul 13 18:33:38 2009 (4A5BE072)
000007fe`edae0000 000007fe`edb9a000   UIAutomationCore UIAutomationCore.dll Mon Jul 13 18:33:39 2009 (4A5BE073)
000007fe`feec0000 000007fe`ff038000   urlmon   urlmon.dll   Tue Sep 07 22:29:28 2010 (4C871F38)
00000000`771d0000 00000000`772ca000   user32   user32.dll   Mon Jul 13 18:34:00 2009 (4A5BE088)
000007fe`fc570000 000007fe`fc58e000   userenv  userenv.dll  Mon Jul 13 18:34:03 2009 (4A5BE08B)
000007fe`fdfd0000 000007fe`fe09a000   usp10    usp10.dll    Mon Jul 13 18:34:04 2009 (4A5BE08C)
000007fe`fb9a0000 000007fe`fb9f6000   uxtheme  uxtheme.dll  Mon Jul 13 18:34:11 2009 (4A5BE093)
000007fe`fc3a0000 000007fe`fc3ac000   version  version.dll  Mon Jul 13 18:33:54 2009 (4A5BE082)
000007fe`d7d00000 000007fe`d7ed5000   VSFileHandler_64 VSFileHandler_64.dll Thu Mar 18 07:25:54 2010 (4BA237F2)
000007fe`fafa0000 000007fe`fafdb000   wdmaud   wdmaud.drv   Mon Jul 13 18:33:55 2009 (4A5BE083)
000007fe`f41e0000 000007fe`f425c000   wer      wer.dll      Mon Jul 13 18:33:53 2009 (4A5BE081)
000007fe`ed950000 000007fe`eda8c000   werconcpl werconcpl.dll Mon Jul 13 18:33:54 2009 (4A5BE082)
000007fe`f9450000 000007fe`f9469000   wercplsupport wercplsupport.dll Mon Jul 13 18:33:55 2009 (4A5BE083)
000007fe`fcd10000 000007fe`fcd7d000   wevtapi  wevtapi.dll  Mon Jul 13 18:33:59 2009 (4A5BE087)
00000000`74f20000 00000000`74f64000   WHSDeskBands WHSDeskBands.dll Wed Oct 07 12:45:29 2009 (4ACCEFD9)
000007fe`fb0b0000 000007fe`fb1da000   WindowsCodecs WindowsCodecs.dll Mon Jul 13 18:34:29 2009 (4A5BE0A5)
000007fe`fda80000 000007fe`fdbaa000   wininet  wininet.dll  Tue Sep 07 22:30:21 2010 (4C871F6D)
000007fe`fb1e0000 000007fe`fb21b000   winmm    winmm.dll    Mon Jul 13 18:34:40 2009 (4A5BE0B0)
000007fe`fa4d0000 000007fe`fa4db000   winnsi   winnsi.dll   Mon Jul 13 18:34:41 2009 (4A5BE0B1)
000007fe`f3470000 000007fe`f34e0000   winspool winspool.drv Mon Jul 13 18:34:55 2009 (4A5BE0BF)
000007fe`fc640000 000007fe`fc67d000   winsta   winsta.dll   Mon Jul 13 18:34:59 2009 (4A5BE0C3)
000007fe`fd4c0000 000007fe`fd4fa000   wintrust wintrust.dll Mon Dec 28 23:54:50 2009 (4B39B5CA)
000007fe`fa9c0000 000007fe`fa9d5000   wkscli   wkscli.dll   Mon Jul 13 18:35:05 2009 (4A5BE0C9)
000007fe`f0700000 000007fe`f0720000   wlanapi  wlanapi.dll  Mon Jul 13 18:35:08 2009 (4A5BE0CC)
000007fe`fa530000 000007fe`fa537000   wlanutil wlanutil.dll Mon Jul 13 18:35:22 2009 (4A5BE0DA)
000007fe`fdbb0000 000007fe`fdc00000   Wldap32  Wldap32.dll  Mon Jul 13 18:35:25 2009 (4A5BE0DD)
000007fe`faa00000 000007fe`faa0d000   WMPNSSUI WMPNSSUI.dll Mon Jul 13 18:36:20 2009 (4A5BE114)
000007fe`f1320000 000007fe`f1340000   wpdshserviceobj wpdshserviceobj.dll Mon Jul 13 18:36:56 2009 (4A5BE138)
000007fe`ff590000 000007fe`ff5dd000   ws2_32   ws2_32.dll   Mon Jul 13 18:34:13 2009 (4A5BE095)
000007fe`f4710000 000007fe`f4722000   wscapi   wscapi.dll   Mon Jul 13 18:34:18 2009 (4A5BE09A)
000007fe`f9470000 000007fe`f9498000   wscinterop wscinterop.dll Mon Jul 13 18:34:19 2009 (4A5BE09B)
000007fe`f13c0000 000007fe`f14df000   wscui    wscui.cpl    Mon Jul 13 18:34:24 2009 (4A5BE0A0)
000007fe`faf30000 000007fe`faf41000   wtsapi32 wtsapi32.dll Mon Jul 13 18:34:20 2009 (4A5BE09C)
000007fe`f06a0000 000007fe`f06fe000   WWanAPI  WWanAPI.dll  Mon Jul 13 18:34:32 2009 (4A5BE0A8)
000007fe`f0690000 000007fe`f069d000   wwapi    wwapi.dll    Mon Jul 13 18:34:41 2009 (4A5BE0B1)
000007fe`fb580000 000007fe`fb5b5000   xmllite  xmllite.dll  Mon Jul 13 18:34:16 2009 (4A5BE098)
000007fe`f4410000 000007fe`f446d000   zipfldr  zipfldr.dll  Mon Jul 13 18:34:16 2009 (4A5BE098)

Unloaded modules:
000007fe`ecad0000 000007fe`ecaf4000   shacct.dll
    Timestamp: Mon Jul 13 18:33:06 2009 (4A5BE052)
    Checksum:  00027187
000007fe`d66a0000 000007fe`d6911000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`ec330000 000007fe`ec3b1000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`fadd0000 000007fe`fadeb000   MAPI32.dll
    Timestamp: Mon Jul 13 18:28:50 2009 (4A5BDF52)
    Checksum:  0001F409
000007fe`d7130000 000007fe`d71f2000   mssvp.dll
    Timestamp: Mon Jul 13 18:30:20 2009 (4A5BDFAC)
    Checksum:  000C5913
000007fe`d9ff0000 000007fe`da071000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`ec330000 000007fe`ec3b1000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`d9ff0000 000007fe`da071000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`ec330000 000007fe`ec3b1000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`fc0a0000 000007fe`fc0c7000   EhStorAPI.dll
    Timestamp: Mon Jul 13 18:27:17 2009 (4A5BDEF5)
    Checksum:  00031645
000007fe`f8dc0000 000007fe`f8df3000   FunDisc.dll
    Timestamp: Mon Jul 13 18:27:45 2009 (4A5BDF11)
    Checksum:  0003D060
000007fe`ee230000 000007fe`ee247000   fdproxy.dll
    Timestamp: Mon Jul 13 18:27:39 2009 (4A5BDF0B)
    Checksum:  00015CA1
000007fe`d6b30000 000007fe`d6da1000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`f9510000 000007fe`f9526000   sendmail.dll
    Timestamp: Mon Jul 13 18:33:29 2009 (4A5BE069)
    Checksum:  00017B54
000007fe`ec310000 000007fe`ec337000   mydocs.dll
    Timestamp: Mon Jul 13 18:30:45 2009 (4A5BDFC5)
    Checksum:  0002ED5E
000007fe`ec3b0000 000007fe`ec431000   DeviceCenter.dll
    Timestamp: Mon Jul 13 18:26:48 2009 (4A5BDED8)
    Checksum:  0007D5B7
000007fe`f4370000 000007fe`f4384000   cryptext.dll
    Timestamp: Mon Jul 13 18:29:56 2009 (4A5BDF94)
    Checksum:  00019C35
000007fe`fccd0000 000007fe`fccff000   AUTHZ.dll
    Timestamp: Mon Jul 13 18:25:28 2009 (4A5BDE88)
    Checksum:  0003B5DB
000007fe`f4270000 000007fe`f4282000   rshx32.dll
    Timestamp: Mon Jul 13 18:32:45 2009 (4A5BE03D)
    Checksum:  0001838A
000007fe`ec330000 000007fe`ec341000   docprop.dll
    Timestamp: Mon Jul 13 18:27:17 2009 (4A5BDEF5)
    Checksum:  0001530E
000007fe`da150000 000007fe`da1d2000   z.fmt   
    Timestamp: Sun Mar 14 23:27:33 2010 (4B9DD355)
    Checksum:  0001AB0F
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`ec340000 000007fe`ec367000   gz.fmt  
    Timestamp: Sun Mar 14 23:27:30 2010 (4B9DD352)
    Checksum:  00016970
000007fe`d7c70000 000007fe`d7cf2000   z.fmt   
    Timestamp: Sun Mar 14 23:27:33 2010 (4B9DD355)
    Checksum:  0001AB0F
000007fe`f4270000 000007fe`f428a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`ec310000 000007fe`ec337000   gz.fmt  
    Timestamp: Sun Mar 14 23:27:30 2010 (4B9DD352)
    Checksum:  00016970
000007fe`f4270000 000007fe`f4286000   sendmail.dll
    Timestamp: Mon Jul 13 18:33:29 2009 (4A5BE069)
    Checksum:  00017B54
000007fe`ec340000 000007fe`ec367000   mydocs.dll
    Timestamp: Mon Jul 13 18:30:45 2009 (4A5BDFC5)
    Checksum:  0002ED5E
000007fe`d6420000 000007fe`d6691000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`da150000 000007fe`da1d2000   z.fmt   
    Timestamp: Sun Mar 14 23:27:33 2010 (4B9DD355)
    Checksum:  0001AB0F
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`ec340000 000007fe`ec367000   gz.fmt  
    Timestamp: Sun Mar 14 23:27:30 2010 (4B9DD352)
    Checksum:  00016970
000007fe`f4270000 000007fe`f4284000   cryptext.dll
    Timestamp: Mon Jul 13 18:29:56 2009 (4A5BDF94)
    Checksum:  00019C35
000007fe`fccd0000 000007fe`fccff000   AUTHZ.dll
    Timestamp: Mon Jul 13 18:25:28 2009 (4A5BDE88)
    Checksum:  0003B5DB
000007fe`f4370000 000007fe`f4382000   rshx32.dll
    Timestamp: Mon Jul 13 18:32:45 2009 (4A5BE03D)
    Checksum:  0001838A
000007fe`ec350000 000007fe`ec361000   docprop.dll
    Timestamp: Mon Jul 13 18:27:17 2009 (4A5BDEF5)
    Checksum:  0001530E
000007fe`f4270000 000007fe`f428a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f4370000 000007fe`f4386000   sendmail.dll
    Timestamp: Mon Jul 13 18:33:29 2009 (4A5BE069)
    Checksum:  00017B54
000007fe`ec310000 000007fe`ec337000   mydocs.dll
    Timestamp: Mon Jul 13 18:30:45 2009 (4A5BDFC5)
    Checksum:  0002ED5E
000007fe`d66a0000 000007fe`d6911000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`f4270000 000007fe`f428a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f4370000 000007fe`f4384000   cryptext.dll
    Timestamp: Mon Jul 13 18:29:56 2009 (4A5BDF94)
    Checksum:  00019C35
000007fe`fccd0000 000007fe`fccff000   AUTHZ.dll
    Timestamp: Mon Jul 13 18:25:28 2009 (4A5BDE88)
    Checksum:  0003B5DB
000007fe`ec350000 000007fe`ec362000   rshx32.dll
    Timestamp: Mon Jul 13 18:32:45 2009 (4A5BE03D)
    Checksum:  0001838A
000007fe`f4270000 000007fe`f4281000   docprop.dll
    Timestamp: Mon Jul 13 18:27:17 2009 (4A5BDEF5)
    Checksum:  0001530E
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f4270000 000007fe`f428a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f4270000 000007fe`f4286000   sendmail.dll
    Timestamp: Mon Jul 13 18:33:29 2009 (4A5BE069)
    Checksum:  00017B54
000007fe`ec340000 000007fe`ec367000   mydocs.dll
    Timestamp: Mon Jul 13 18:30:45 2009 (4A5BDFC5)
    Checksum:  0002ED5E
000007fe`d6420000 000007fe`d6691000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`faa20000 000007fe`faa3a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`d66a0000 000007fe`d6911000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`f4370000 000007fe`f4386000   sendmail.dll
    Timestamp: Mon Jul 13 18:33:29 2009 (4A5BE069)
    Checksum:  00017B54
000007fe`da1b0000 000007fe`da1d7000   mydocs.dll
    Timestamp: Mon Jul 13 18:30:45 2009 (4A5BDFC5)
    Checksum:  0002ED5E
000007fe`d6b30000 000007fe`d6da1000   wpdshext.dll
    Timestamp: Mon Jul 13 18:36:55 2009 (4A5BE137)
    Checksum:  00270D95
000007fe`f4370000 000007fe`f438a000   tar.fmt 
    Timestamp: Sun Mar 14 23:27:27 2010 (4B9DD34F)
    Checksum:  00014E7C
000007fe`f8dc0000 000007fe`f8df3000   FunDisc.dll
    Timestamp: Mon Jul 13 18:27:45 2009 (4A5BDF11)
    Checksum:  0003D060
000007fe`ee230000 000007fe`ee247000   fdproxy.dll
    Timestamp: Mon Jul 13 18:27:39 2009 (4A5BDF0B)
    Checksum:  00015CA1
000007fe`f9510000 000007fe`f9524000   cryptext.dll
    Timestamp: Mon Jul 13 18:29:56 2009 (4A5BDF94)
    Checksum:  00019C35
000007fe`fccd0000 000007fe`fccff000   AUTHZ.dll
    Timestamp: Mon Jul 13 18:25:28 2009 (4A5BDE88)
    Checksum:  0003B5DB
000007fe`f4270000 000007fe`f4282000   rshx32.dll
    Timestamp: Mon Jul 13 18:32:45 2009 (4A5BE03D)
    Checksum:  0001838A
000007fe`ec350000 000007fe`ec361000   docprop.dll
    Timestamp: Mon Jul 13 18:27:17 2009 (4A5BDEF5)
    Checksum:  0001530E
0:023> lmvm rpcrt4
start             end                 module name
000007fe`ff060000 000007fe`ff18e000   rpcrt4   T (pdb symbols)          c:\windows\symbols\rpcrt4.pdb\484A214596114DE7AA63AF63A748044D2\rpcrt4.pdb
    Loaded symbol image file: rpcrt4.dll
    Image path: C:\Windows\System32\rpcrt4.dll
    Image name: rpcrt4.dll
    Timestamp:        Mon Jul 13 18:32:37 2009 (4A5BE035)
    CheckSum:         001302FA
    ImageSize:        0012E000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

StuartLockey · Nov 29, 2010

I'm still haveing the same problems, I#m attaching what I hope is the cleanest dump file I have. All I have riunning is the Catalyst control center, and roboform. Crash happened shortly after startup so the only other program I had run was Internet Explorer.

This is driving me mad. Is there anything else I can produce for you to help me with this?

wish · Nov 29, 2010

Also the same, Remote Procedure Call Runtime (rpcrt4.dll) was blamed.
Use autoruns for windows to look explorer shell extensions and to find non microsoft program that load rpcrt4.dll

Follow this instruction to collect all data:
Blue Screen of Death (BSOD) Posting Instructions

Code:

start             end                 module name
000007fe`fe490000 000007fe`fe5be000   rpcrt4     (pdb symbols)          c:\windows\symbols\rpcrt4.pdb\484A214596114DE7AA63AF63A748044D2\rpcrt4.pdb
    Loaded symbol image file: rpcrt4.dll
    Mapped memory image file: C:\Windows\Symbols\rpcrt4.dll\4A5BE03512e000\rpcrt4.dll
    Image path: C:\Windows\System32\rpcrt4.dll
    Image name: rpcrt4.dll

Win 7 x64 explorer crashes

New member

My Computer

New member

My Computer

Antique Senior Member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer