MtK Posted April 12, 2007 Share Posted April 12, 2007 Hi,my Explorer.exe keeps on crashing.where can I find information about the cause? Link to comment Share on other sites More sharing options...
Richard0612 Posted April 13, 2007 Share Posted April 13, 2007 Unfortunately, we can't really offer any help unless you give some more information, specifically:Vista versionWhen does explorer crash, or is it random.How much RAM does your system haveAny other odd things that have happened Link to comment Share on other sites More sharing options...
fizban2 Posted April 13, 2007 Share Posted April 13, 2007 Along with the information that Richard asked for, if you can ger a memory dump of vista so that we can look at the error http://www.msfn.org/board/index.php?showtopic=90244here are the directons to setup a memory dump cluberti mentions several different options for checking a crash dump, if you can we want to get a dump of just explorer.exe and find out what it hanging it Link to comment Share on other sites More sharing options...
MtK Posted April 13, 2007 Author Share Posted April 13, 2007 Along with the information that Richard asked for, if you can ger a memory dump of vista so that we can look at the error http://www.msfn.org/board/index.php?showtopic=90244here are the directons to setup a memory dump cluberti mentions several different options for checking a crash dump, if you can we want to get a dump of just explorer.exe and find out what it hanging itGreat tool, it just take 2 long to finish...which data should I post?can I PM it to u, so no delicate data is published? Link to comment Share on other sites More sharing options...
MtK Posted May 1, 2007 Author Share Posted May 1, 2007 I used this tool several times with now luck of finding the cause.I tried after Restart/Sleep/Hibernate...I'm thinking the problem comes from the Indexer.I think the problem occurs whenever I open a folder that had changed its content.(no matter what content of file type) Link to comment Share on other sites More sharing options...
cluberti Posted May 1, 2007 Share Posted May 1, 2007 Once you've done what I document in getting a dump of explorer.exe, you should have .dmp files in the destination folder. Those can be opened in windbg (make sure you've configured your symbol path) and debugged. If you are not comfortable with that, you can post a link to the files here and we can do it for you. The tools themselves are not going to tell you what happened - you have to figure that out from the data the tool generates . Link to comment Share on other sites More sharing options...
MtK Posted May 1, 2007 Author Share Posted May 1, 2007 the problem is that in any time the Crash occurred...meaning, the Debugger never stopped.I have no problem posting the files here.I'll leave it running again & post back. Link to comment Share on other sites More sharing options...
cluberti Posted May 1, 2007 Share Posted May 1, 2007 the problem is that in any time the Crash occurred...meaning, the Debugger never stopped.I have no problem posting the files here.I'll leave it running again & post back.Very good. One note - if the debugger is attached to your explorer.exe and doesn't create any dumps, then explorer isn't really crashing. Just a thought... Link to comment Share on other sites More sharing options...
MtK Posted May 1, 2007 Author Share Posted May 1, 2007 (edited) that's what I'm saying,while the debugger is on, now crash can be seen...should this process ever end? Edited May 1, 2007 by MtK Link to comment Share on other sites More sharing options...
MtK Posted May 2, 2007 Author Share Posted May 2, 2007 finally caught the exception!!!a new file was added into a folder when Windows Explorer was closed.I opened the Windows Explorer, navigated into that folder & CRASH!!!I've PMed you the log results, although I'm not sure the debugger finished as expected since when I closed it Explorer really crashed... Link to comment Share on other sites More sharing options...
cluberti Posted May 2, 2007 Share Posted May 2, 2007 OK - I think I see what is happening, but I need for you to change the command used to start the debugger to this:cscript adplus.vbs -crash -fullonfirst -pn explorer.exe -o c:\adplusWe're only getting first-chance exceptions, so I need to capture those. I think we have a .dll that is missing registry information (the errors are all interface not registered, basically), but without a .dmp file I can't see which. Configure for fullonfirst as above, and we should get more data (at least some .dmp files). Link to comment Share on other sites More sharing options...
MtK Posted May 2, 2007 Author Share Posted May 2, 2007 OK - I think I see what is happening, but I need for you to change the command used to start the debugger to this:cscript adplus.vbs -crash -fullonfirst -pn explorer.exe -o c:\adplusWe're only getting first-chance exceptions, so I need to capture those. I think we have a .dll that is missing registry information (the errors are all interface not registered, basically), but without a .dmp file I can't see which. Configure for fullonfirst as above, and we should get more data (at least some .dmp files).the method of saving a file (i.e from the Internet) to a non-open folder & the browsing for the file does cause a crash...sorry, but the dumped ZIP is 100MB... Link to comment Share on other sites More sharing options...
cluberti Posted May 2, 2007 Share Posted May 2, 2007 the method of saving a file (i.e from the Internet) to a non-open folder & the browsing for the file does cause a crash...sorry, but the dumped ZIP is 100MB...I could tell from the previous logs you were doing something like that - I'm downloading it now. Link to comment Share on other sites More sharing options...
cluberti Posted May 3, 2007 Share Posted May 3, 2007 OK - here's the thread that's making the callback into a module that is no longer loaded:0:044> kn # ChildEBP RetAddr 00 08dff0d4 76060991 kernel32!RaiseException+0x5801 08dff0ec 76060969 rpcrt4!RpcpRaiseException+0x1e02 08dff0f8 760ef68f rpcrt4!RpcRaiseException+0x1603 08dff108 760f1d87 rpcrt4!NdrProxySendReceive+0xa304 08dff114 760f1f58 rpcrt4!NdrpProxySendReceive+0xc05 08dff5fc 760f1d64 rpcrt4!NdrClientCall2+0xbde06 08dff624 76073763 rpcrt4!ObjectStublessClient+0x6f07 08dff634 7713c2d1 rpcrt4!ObjectStubless+0xf08 08dff650 7713c283 ole32!RemoteReleaseRifRefHelper+0x8709 08dff67c 77141718 ole32!RemoteReleaseRifRef+0x750a 08dff700 77140aa2 ole32!CStdMarshal::DisconnectCliIPIDs+0x2da0b 08dff730 77140c10 ole32!CStdMarshal::Disconnect+0x1a60c 08dff74c 77140b7a ole32!CStdIdentity::~CStdIdentity+0x8c0d 08dff758 77140ccc ole32!CStdIdentity::`scalar deleting destructor'+0xd0e 08dff76c 763637ca ole32!CStdIdentity::CInternalUnk::Release+0x6d0f 08dff778 76510983 shell32!IUnknown_SafeReleaseAndNullPtr<CPropertyControlBase>+0x1710 08dff784 7645a80b shell32!CProgressDialogUI::EndDialog+0x2411 08dff7a8 763c67c8 shell32!CProgressDialogUI::_HandleTimerMessage+0xe012 08dff7c0 763ca53b shell32!CProgressDialogUI::_DialogProc+0x1fe13 08dff7dc 76e71a10 shell32!CProgressDialogUI::DialogProc+0x5114 08dff808 76e60e04 user32!InternalCallWinProc+0x2315 08dff884 76e60c7e user32!UserCallDlgProcCheckWow+0x13216 08dff8cc 76e6123b user32!DefDlgProcWorker+0xa817 08dff8e8 76e71a10 user32!DefDlgProcW+0x2218 08dff914 76e71ae8 user32!InternalCallWinProc+0x2319 08dff98c 76e72a47 user32!UserCallWinProcCheckWow+0x14b1a 08dff9f0 76e72a98 user32!DispatchMessageWorker+0x3221b 08dffa00 763c7e29 user32!DispatchMessageW+0xf1c 08dffa38 763c4282 shell32!CProgressDialog::_ThreadProc+0xb41d 08dffa40 7628b132 shell32!CProgressDialog::s_ThreadProc+0xd1e 08dffabc 76153833 shlwapi!WrapperThreadProc+0x10f1f 08dffac8 777ba9bd kernel32!BaseThreadInitThunk+0xe20 08dffb08 00000000 ntdll!_RtlUserThreadStart+0x23The error code can be seen when dumping registers for the stack at frame 12 - we're getting an ntstatus error message of 0x80010012, which means "The callee (server [not server application]) is not available and disappeared; all connections are invalid. The call did not execute.". So shell32 made a call to a function in a previously loaded .dll, but for whatever reason that module is no longer loaded, and all rpc connections between the shell and this process are null and void.From digging deeper, I can see that the actual RPC call was "_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED", which means someone wanted to extend the stack frame to store more information. There are 2 different products on the box that appear to have been involved here, but since they've unloaded I have to make an educated guess - it's very likely that one of these two modules is causing the crash:0:044> lmvm PhoneBrowserstart end module name07070000 07101000 PhoneBrowser C (export symbols) PhoneBrowser.dll Loaded symbol image file: PhoneBrowser.dll Image path: C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll Image name: PhoneBrowser.dll Timestamp: Wed Mar 28 04:57:04 2007 (460A2DE0) CheckSum: 00000000 ImageSize: 00091000 File version: 6.83.74.9 Product version: 3.0.0.0 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Nokia ProductName: Phone Browser InternalName: Phone Browser 3 OriginalFilename: PhoneBrowser.dll ProductVersion: 3.0 FileVersion: 6, 83, 74, 9 SpecialBuild: Release Unicode FileDescription: Phone Browser LegalCopyright: Copyright © 2006 Nokia. All rights reserved.0:044> lmvm atsc70start end module name0a200000 0a32c000 ATSC70 (export symbols) ATSC70.dll Loaded symbol image file: ATSC70.dll Image path: C:\Windows\System32\ATSC70.dll Image name: ATSC70.dll Timestamp: Mon Nov 20 13:10:55 2006 (4561EFAF) CheckSum: 00127ABC ImageSize: 0012C000 File version: 7.7.0.25 Product version: 7.7.0.25 File flags: 20 (Mask 3F) Special File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: AuthenTec, Inc. ProductName: AuthenTec Sensor Control DLL InternalName: AuthenTec AT DLL OriginalFilename: ATSC70.DLL ProductVersion: 7, 7, 0, 25 FileVersion: 7, 7, 0, 25 SpecialBuild: BETA Pre-release of 7.7.0.26 FileDescription: AuthenTec AT DLL LegalCopyright: Copyright © 1999 - 2006 AuthenTec, Inc. All rights reserved. Comments: BETA Pre-release of 7.7.0.26 Link to comment Share on other sites More sharing options...
MtK Posted May 3, 2007 Author Share Posted May 3, 2007 I'm starting by removing the Nokia PC-Suite.anything else I should do for now...? Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now