Windows Explorer crashes and restarts

[Humanous]

Hello,
It's been some days now that windows explorer crashes and restarts at hourly intervals, at the 58th minute.
Here is the AppCrashView information:

Version=1
EventType=APPCRASH
EventTime=132000910842820058
ReportType=2
Consent=1
UploadTime=132000910843280084
ReportIdentifier=4674abd5-6214-11e9-9d7d-5404a6b2192d
IntegratorReportIdentifier=4674abd4-6214-11e9-9d7d-5404a6b2192d
Response.BucketId=499328208
Response.BucketTable=299052158
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=Explorer.EXE
Sig[1].Name=Application Version
Sig[1].Value=6.1.7601.23537
Sig[2].Name=Application Timestamp
Sig[2].Value=57c44efe
Sig[3].Name=Fault Module Name
Sig[3].Value=ntdll.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.1.7601.24408
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=5c92f30c
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=0000000000057280
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.768.3
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=3017
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=30173a4e2bd26f72a2bcca610c27e558
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=9ef2
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=9ef2cbb147a15d79f8de8d242ee84c60
UI[2]=C:\Windows\Explorer.EXE
UI[3]=Windows Explorer has stopped working
UI[4]=Windows can check online for a solution to the problem and try to restart the program.
UI[5]=Check online for a solution and restart the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Windows\Explorer.EXE
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\system32\kernel32.dll
LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\system32\ADVAPI32.dll
LoadedModule[5]=C:\Windows\system32\msvcrt.dll
LoadedModule[6]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[7]=C:\Windows\system32\RPCRT4.dll
LoadedModule[8]=C:\Windows\system32\GDI32.dll
LoadedModule[9]=C:\Windows\system32\USER32.dll
LoadedModule[10]=C:\Windows\system32\LPK.dll
LoadedModule[11]=C:\Windows\system32\USP10.dll
LoadedModule[12]=C:\Windows\system32\SHLWAPI.dll
LoadedModule[13]=C:\Windows\system32\SHELL32.dll
LoadedModule[14]=C:\Windows\system32\ole32.dll
LoadedModule[15]=C:\Windows\system32\OLEAUT32.dll
LoadedModule[16]=C:\Windows\system32\EXPLORERFRAME.dll
LoadedModule[17]=C:\Windows\system32\DUser.dll
LoadedModule[18]=C:\Windows\system32\DUI70.dll
LoadedModule[19]=C:\Windows\system32\IMM32.dll
LoadedModule[20]=C:\Windows\system32\MSCTF.dll
LoadedModule[21]=C:\Windows\system32\UxTheme.dll
LoadedModule[22]=C:\Windows\system32\POWRPROF.dll
LoadedModule[23]=C:\Windows\system32\SETUPAPI.dll
LoadedModule[24]=C:\Windows\system32\CFGMGR32.dll
LoadedModule[25]=C:\Windows\system32\DEVOBJ.dll
LoadedModule[26]=C:\Windows\system32\dwmapi.dll
LoadedModule[27]=C:\Windows\system32\slc.dll
LoadedModule[28]=C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24407_none_14556e048b95cddf\gdiplus.dll
LoadedModule[29]=C:\Windows\system32\Secur32.dll
LoadedModule[30]=C:\Windows\system32\SSPICLI.DLL
LoadedModule[31]=C:\Windows\system32\PROPSYS.dll
LoadedModule[32]=C:\Windows\system32\WINSTA.dll
LoadedModule[33]=C:\Windows\system32\CRYPTBASE.dll
LoadedModule[34]=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24380_none_e3731d0b30fb6b11\comctl32.dll
LoadedModule[35]=C:\Windows\system32\WindowsCodecs.dll
LoadedModule[36]=C:\Windows\system32\profapi.dll
LoadedModule[37]=C:\Windows\system32\apphelp.dll
LoadedModule[38]=C:\Windows\system32\CLBCatQ.DLL
LoadedModule[39]=C:\Users\Andreas\AppData\Local\Microsoft\OneDrive\19.033.0218.0011\amd64\FileSyncShell64.dll
LoadedModule[40]=C:\Windows\system32\ktmw32.dll
LoadedModule[41]=C:\Windows\system32\PSAPI.DLL
LoadedModule[42]=C:\Windows\system32\VERSION.dll
LoadedModule[43]=C:\Windows\system32\WININET.dll
LoadedModule[44]=C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
LoadedModule[45]=C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
LoadedModule[46]=C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
LoadedModule[47]=C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
LoadedModule[48]=C:\Windows\system32\normaliz.DLL
LoadedModule[49]=C:\Windows\system32\iertutil.dll
LoadedModule[50]=C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
LoadedModule[51]=C:\Windows\system32\USERENV.dll
LoadedModule[52]=C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL
LoadedModule[53]=C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll
LoadedModule[54]=C:\Windows\system32\CRYPTSP.dll
LoadedModule[55]=C:\Windows\system32\rsaenh.dll
LoadedModule[56]=C:\Windows\system32\RpcRtRemote.dll
LoadedModule[57]=C:\Windows\system32\actxprxy.dll
LoadedModule[58]=C:\Windows\system32\ntmarta.dll
LoadedModule[59]=C:\Windows\system32\WLDAP32.dll
LoadedModule[60]=C:\Windows\system32\thumbcache.dll
LoadedModule[61]=C:\Windows\system32\PhotoMetadataHandler.dll
LoadedModule[62]=C:\Windows\system32\IconCodecService.dll
LoadedModule[63]=C:\Windows\system32\SndVolSSO.DLL
LoadedModule[64]=C:\Windows\system32\HID.DLL
LoadedModule[65]=C:\Windows\System32\MMDevApi.dll
LoadedModule[66]=C:\Windows\system32\timedate.cpl
LoadedModule[67]=C:\Windows\system32\ATL.DLL
LoadedModule[68]=C:\Windows\System32\shdocvw.dll
LoadedModule[69]=C:\Windows\system32\LINKINFO.dll
LoadedModule[70]=C:\Windows\system32\msutb.dll
LoadedModule[71]=C:\Windows\System32\gameux.dll
LoadedModule[72]=C:\Windows\System32\XmlLite.dll
LoadedModule[73]=C:\Windows\system32\CRYPT32.dll
LoadedModule[74]=C:\Windows\system32\MSASN1.dll
LoadedModule[75]=C:\Windows\System32\wer.dll
LoadedModule[76]=C:\Windows\System32\Wpc.dll
LoadedModule[77]=C:\Windows\System32\wevtapi.dll
LoadedModule[78]=C:\Windows\System32\msxml6.dll
LoadedModule[79]=C:\Windows\System32\bcrypt.dll
LoadedModule[80]=C:\Windows\system32\samcli.dll
LoadedModule[81]=C:\Windows\system32\SAMLIB.dll
LoadedModule[82]=C:\Windows\system32\netutils.dll
LoadedModule[83]=C:\Windows\System32\shacct.dll
LoadedModule[84]=C:\Windows\system32\msiltcfg.dll
LoadedModule[85]=C:\Windows\system32\msi.dll
LoadedModule[86]=C:\Windows\system32\msls31.dll
LoadedModule[87]=C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
LoadedModule[88]=C:\Windows\system32\authui.dll
LoadedModule[89]=C:\Windows\system32\CRYPTUI.dll
LoadedModule[90]=C:\Windows\System32\UIAnimation.dll
LoadedModule[91]=C:\Windows\system32\stobject.dll
LoadedModule[92]=C:\Windows\system32\BatMeter.dll
LoadedModule[93]=C:\Windows\system32\WTSAPI32.dll
LoadedModule[94]=C:\Windows\system32\es.dll
LoadedModule[95]=C:\Windows\system32\prnfldr.dll
LoadedModule[96]=C:\Windows\system32\WINSPOOL.DRV
LoadedModule[97]=C:\Windows\system32\AUDIOSES.DLL
LoadedModule[98]=C:\Windows\system32\dxp.dll
LoadedModule[99]=C:\Windows\system32\urlmon.dll
LoadedModule[100]=C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
LoadedModule[101]=C:\Windows\system32\WINTRUST.dll
LoadedModule[102]=C:\Windows\system32\Syncreg.dll
LoadedModule[103]=C:\Windows\ehome\ehSSO.dll
LoadedModule[104]=C:\Windows\System32\netshell.dll
LoadedModule[105]=C:\Windows\System32\IPHLPAPI.DLL
LoadedModule[106]=C:\Windows\system32\NSI.dll
LoadedModule[107]=C:\Windows\System32\WINNSI.DLL
LoadedModule[108]=C:\Windows\System32\nlaapi.dll
LoadedModule[109]=C:\Windows\System32\AltTab.dll
LoadedModule[110]=C:\Windows\system32\wpdshserviceobj.dll
LoadedModule[111]=C:\Windows\system32\PortableDeviceTypes.dll
LoadedModule[112]=C:\Windows\system32\PortableDeviceApi.dll
LoadedModule[113]=C:\Windows\system32\ntshrui.dll
LoadedModule[114]=C:\Windows\system32\srvcli.dll
LoadedModule[115]=C:\Windows\system32\cscapi.dll
LoadedModule[116]=C:\Windows\system32\mssprxy.dll
LoadedModule[117]=C:\Windows\System32\pnidui.dll
LoadedModule[118]=C:\Windows\System32\QUtil.dll
LoadedModule[119]=C:\Windows\system32\WINHTTP.dll
LoadedModule[120]=C:\Windows\system32\webio.dll
LoadedModule[121]=C:\Windows\system32\dhcpcsvc6.DLL
LoadedModule[122]=C:\Windows\system32\WS2_32.dll
LoadedModule[123]=C:\Windows\system32\dhcpcsvc.DLL
LoadedModule[124]=C:\Windows\system32\credssp.dll
LoadedModule[125]=C:\Windows\System32\npmproxy.dll
LoadedModule[126]=C:\Windows\system32\Wlanapi.dll
LoadedModule[127]=C:\Windows\system32\wlanutil.dll
LoadedModule[128]=C:\Windows\system32\wwanapi.dll
LoadedModule[129]=C:\Windows\system32\wwapi.dll
LoadedModule[130]=C:\Windows\System32\QAgent.dll
LoadedModule[131]=C:\Windows\System32\srchadmin.dll
LoadedModule[132]=C:\Windows\system32\SXS.DLL
LoadedModule[133]=C:\Windows\System32\bthprops.cpl
LoadedModule[134]=C:\Windows\System32\ieframe.dll
LoadedModule[135]=C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
LoadedModule[136]=C:\Windows\System32\SyncCenter.dll
LoadedModule[137]=C:\Windows\System32\Actioncenter.dll
LoadedModule[138]=C:\Windows\system32\imapi2.dll
LoadedModule[139]=C:\Windows\System32\hgcpl.dll
LoadedModule[140]=C:\Windows\System32\provsvc.dll
LoadedModule[141]=C:\Windows\system32\wkscli.dll
LoadedModule[142]=C:\Windows\system32\fxsst.dll
LoadedModule[143]=C:\Windows\system32\FXSAPI.dll
LoadedModule[144]=C:\Windows\system32\FXSRESM.DLL
LoadedModule[145]=C:\Windows\System32\wscinterop.dll
LoadedModule[146]=C:\Windows\System32\WSCAPI.dll
LoadedModule[147]=C:\Windows\System32\wscui.cpl
LoadedModule[148]=C:\Windows\System32\werconcpl.dll
LoadedModule[149]=C:\Windows\System32\framedynos.dll
LoadedModule[150]=C:\Windows\System32\wercplsupport.dll
LoadedModule[151]=C:\Windows\System32\hcproviders.dll
LoadedModule[152]=C:\Program Files\Internet Explorer\ieproxy.dll
LoadedModule[153]=C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
LoadedModule[154]=C:\Windows\system32\MPR.dll
LoadedModule[155]=C:\Windows\system32\SearchFolder.dll
LoadedModule[156]=C:\Windows\System32\StructuredQuery.dll
LoadedModule[157]=C:\Windows\System32\NaturalLanguage6.dll
LoadedModule[158]=C:\Windows\System32\NLSData0009.dll
LoadedModule[159]=C:\Windows\System32\NLSLexicons0009.dll
LoadedModule[160]=C:\Windows\system32\OLEACC.dll
LoadedModule[161]=C:\Windows\system32\UIAutomationCore.dll
LoadedModule[162]=C:\Windows\system32\WINMM.dll
LoadedModule[163]=C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
LoadedModule[164]=C:\Windows\system32\MsftEdit.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
State[1].Key=DataRequest
State[1].Value=Bucket=499328208/nBucketTable=299052158/nResponse=1/n
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Windows Explorer
AppPath=C:\Windows\Explorer.EXE

 

[wither 2]

Hi Humanous-

I suggest that you go to Accessories and find the Command Prompt. Right click on it and select "run as adminstrator."

at the prompt, type in- sfc /scannow

and let it run. If it finds and fixes any files, reboot and run it again.

 

[Humanous]

Hello.
I have already done so. No issues found.
Also worth noting that I tried with microsoft support twice.
First time they installed C++ redistributable 2017, still same issue.
Second time they disabled shell extensions besides microsoft's ones, still same issue.
If there's any more information I can provide on my issue, please let me know. Thank you.

 

[Humanous]

Using windbg.exe to analyze a crash dump, it has come up with the following:

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Timeline.OS.Boot.DeltaSec
Value: 9492

Key : Timeline.Process.Start.DeltaSec
Value: 5180


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

Timeline: !analyze.Start
Name: <blank>
Time: 2019-04-22T10:31:40.37Z
Diff: 1986037 mSec

Timeline: Dump.Current
Name: <blank>
Time: 2019-04-22T09:58:34.0Z
Diff: 0 mSec

Timeline: Process.Start
Name: <blank>
Time: 2019-04-22T08:32:14.0Z
Diff: 5180000 mSec

Timeline: OS.Boot
Name: <blank>
Time: 2019-04-22T07:20:22.0Z
Diff: 9492000 mSec


DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT: (.ecxr)
rax=0000000000000040 rbx=00000001d0909090 rcx=0000000261212120
rdx=fffffffecc850000 rsi=0000000007e40000 rdi=000000000c6c1330
rip=0000000077c07280 rsp=000000000c51f898 rbp=000000000c51f8f0
r8=0000000090909090 r9=0000000004848484 r10=0000000000000000
r11=00000001d0909090 r12=0000000140001018 r13=0000000140000000
r14=000000000c8500f0 r15=000000000c850000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200
ntdll!memcpy+0x2c0:
00000000`77c07280 4c8b4c0af8 mov r9,qword ptr [rdx+rcx-8] ds:00000001`2da62118=????????????????
Resetting default scope

FAULTING_IP:
ntdll!memcpy+2c0
00000000`77c07280 4c8b4c0af8 mov r9,qword ptr [rdx+rcx-8]

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000077c07280 (ntdll!memcpy+0x00000000000002c0)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000012da62118
Attempt to read from address 000000012da62118

PROCESS_NAME: explorer.exe

FOLLOWUP_IP:
ntdll!memcpy+2c0
00000000`77c07280 4c8b4c0af8 mov r9,qword ptr [rdx+rcx-8]

READ_ADDRESS: 000000012da62118

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000012da62118

WATSON_BKT_PROCSTAMP: 57c44efe

WATSON_BKT_PROCVER: 6.1.7601.23537

PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System

WATSON_BKT_MODULE: ntdll.dll

WATSON_BKT_MODSTAMP: 5c92f30c

WATSON_BKT_MODOFFSET: 57280

WATSON_BKT_MODVER: 6.1.7601.24408

MODULE_VER_PRODUCT: Microsoft® Windows® Operating System

BUILD_VERSION_STRING: 6.1.7601.24408 (win7sp1_ldr_escrow.190320-1700)

MODLIST_WITH_TSCHKSUM_HASH: 1d8954c0391fc7eb8dc393507a58bb0639e20226

MODLIST_SHA1_HASH: aa8679a3e3a151bceb3752d1bcdf366165e1d1e4

NTGLOBALFLAG: 2000100

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS: 48004

PRODUCT_TYPE: 1

SUITE_MASK: 784

DUMP_FLAGS: c07

DUMP_TYPE: 3

APPLICATION_VERIFIER_LOADED: 1

ANALYSIS_SESSION_HOST: ANDREAS-PC

ANALYSIS_SESSION_TIME: 04-22-2019 13:31:40.0037

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

THREAD_ATTRIBUTES:
OS_LOCALE: ENU

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_CONTEXT_MISMATCH_AVRF

DEFAULT_BUCKET_ID: INVALID_POINTER_READ_CONTEXT_MISMATCH_AVRF

PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT

PROBLEM_CLASSES:

ID: [0n313]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x8b4]
Frame: [0] : ntdll!memcpy

ID: [0n285]
Type: [INVALID_POINTER_READ]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x8b4]
Frame: [0] : ntdll!memcpy

ID: [0n98]
Type: [AVRF]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x12ac]
TID: [0x8b4]
Frame: [0] : ntdll!memcpy

ID: [0n139]
Type: [CONTEXT_MISMATCH]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x12ac]
TID: [0x8b4]
Frame: [0] : ntdll!memcpy

IP_ON_HEAP: 0000000007e5040e
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER: from 0000000007e5040e to 0000000077c07280

STACK_TEXT:
00000000`0c51f898 00000000`07e5040e : 00000000`00000004 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!memcpy+0x2c0
00000000`0c51f8a0 00000000`00000004 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00003000 : 0x7e5040e
00000000`0c51f8a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00003000 00000000`00000004 : 0x4


THREAD_SHA1_HASH_MOD_FUNC: d1677881ad1f80f3f287b0e4c03a63c61f06be8c

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d9565158782150bae04f09784d95ed80af21dcf1

THREAD_SHA1_HASH_MOD: 4d6a592812b1f521b481ecb6f54e3789559d0477

FAULT_INSTR_CODE: a4c8b4c

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ntdll!memcpy+2c0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 5c92f30c

STACK_COMMAND: ~10s ; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_READ_CONTEXT_MISMATCH_AVRF_c0000005_ntdll.dll!memcpy

BUCKET_ID: X64_APPLICATION_FAULT_INVALID_POINTER_READ_CONTEXT_MISMATCH_AVRF_ntdll!memcpy+2c0

FAILURE_EXCEPTION_CODE: c0000005

FAILURE_IMAGE_NAME: ntdll.dll

BUCKET_ID_IMAGE_STR: ntdll.dll

FAILURE_MODULE_NAME: ntdll

BUCKET_ID_MODULE_STR: ntdll

FAILURE_FUNCTION_NAME: memcpy

BUCKET_ID_FUNCTION_STR: memcpy

BUCKET_ID_OFFSET: 2c0

BUCKET_ID_MODTIMEDATESTAMP: 5c92f30c

BUCKET_ID_MODCHECKSUM: 1a0ba9

BUCKET_ID_MODVER_STR: 6.1.7601.24408

BUCKET_ID_PREFIX_STR: X64_APPLICATION_FAULT_INVALID_POINTER_READ_CONTEXT_MISMATCH_AVRF_

FAILURE_PROBLEM_CLASS: APPLICATION_FAULT

FAILURE_SYMBOL_NAME: ntdll.dll!memcpy

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer.exe/6.1.7601.23537/57c44efe/ntdll.dll/6.1.7601.24408/5c92f30c/c0000005/00057280.htm?Retriage=1

TARGET_TIME: 2019-04-22T09:58:34.000Z

OSBUILD: 7601

OSSERVICEPACK: 24408

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) SingleUserTS Personal

USER_LCID: 0

OSBUILD_TIMESTAMP: 2019-03-21 04:13:34

BUILDDATESTAMP_STR: 190320-1700

BUILDLAB_STR: win7sp1_ldr_escrow

BUILDOSVER_STR: 6.1.7601.24408

ANALYSIS_SESSION_ELAPSED_TIME: 26a7

ANALYSIS_SOURCE: UM

FAILURE_ID_HASH_STRING: um:invalid_pointer_read_context_mismatch_avrf_c0000005_ntdll.dll!memcpy

FAILURE_ID_HASH: {8c02fa87-44b0-d854-04f8-a681f8bebc28}

Followup: MachineOwner
---------

 

[wither 2]

Run eventvwr

Open Applications in Windows Logs.

Is there a red error identified? If so, double click on it. What is shown as the offending program?

 

[Humanous]

There is an error, yes. Every hour on the 58th minute. What's interesting is that something has changed from yesterday's errors to today, posting them below:

Today:
Faulting application name: Explorer.EXE, version: 6.1.7601.23537, time stamp: 0x57c44efe
Faulting module name: verifier.dll, version: 6.1.7600.16385, time stamp: 0x4a5be081
Exception code: 0x80000003
Fault offset: 0x000000000000ae03
Faulting process id: 0x9d8
Faulting application start time: 0x01d4f9e9701d54ac
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\system32\verifier.dll
Report Id: 91b8fbf7-65e0-11e9-aea4-5404a6b2192d


Yesterday:
Faulting application name: Explorer.EXE, version: 6.1.7601.23537, time stamp: 0x57c44efe
Faulting module name: ntdll.dll, version: 6.1.7601.24408, time stamp: 0x5c92f30c
Exception code: 0xc0000005
Fault offset: 0x0000000000057280
Faulting process id: 0xa6c
Faulting application start time: 0x01d4f9d3a2dea7c0
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6f5dde4d-65c7-11e9-a84f-5404a6b2192d

 

[wither 2]

You've been to Microsoft twice so it's hard for me to image that I can help.

Boot into Safe Mode without networking. Does the problem occur?

 

[Humanous]

You've been to Microsoft twice so it's hard for me to image that I can help.

Boot into Safe Mode without networking. Does the problem occur?

The problem did not occur in safe mode (checked before and after the 58th minute when it always happens).
I guess that means that it's a third-party application that causes the issue. If only I could find out which one!

 

[wither 2]

Boot the system. Run msconfig.exe. In the Services tab, check the box to "hide all Microsoft........." Then check "disable all." Apply the changes. In the Startup tab, check disable all. Apply the change. Reboot. Does it do it?

 

[RoWin7]

A corrupted task scheduler?

 

[Humanous]

Thank you for the replies guys. Long story short I got so fed up with the issue that I formatted Windows and now it's fine!

 

[RoWin7]

I've done one of my own machines recently for the same reason, fed-up-ness. But most of the folks here know a lot more here than the Help Desk at MS.

 

[XweAponX]

A corrupted task scheduler?

That's what I was thinking, cos if it is happening on a "Schedule", then it has to be a process that got activated somehow through task Scheduler. I've had stuff get added from weird programs, that did stuff like that. raxco Perfect Disk added a "reboot in the middle of the night and perform a boot-time defrag" task to my system. I could not figure out WHAT was causing my system to reboot at 1:00AM.

There may be a task that is deliberately killing Explorer.exe on an hourly basis on OP's machine. , so they'll have to go through all of the scheduled tasks to find it.

 

[RoWin7]

See post #11 above. Problem resolved in the time-honored fashion.