Jump to content

Explorer.exe crash, Almost Solved, PLEASE HELP!


extremepilot

Recommended Posts

I used the INCREDIBLE sticky on how to generate a dmp, and it generated two, unfortunately each one is about 200mb so I wont upload, but here are the bits that I THINK SHOULD help solve the problem:

FIRST .DMP:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Boris\Desktop\PID-2168__EXPLORER.EXE__1st_chance_Process_Shut_Down__full_0ec4_2009-06-04_20-02-31-198_0878.dmp]

User Mini Dump File with Full Memory: Only application data is available

Comment: '1st_chance_Process_Shut_Down_exception_in_EXPLORER.EXE_running_on_IRENE-PC'

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

Windows Vista Version 6000 MP (2 procs) Free x86 compatible

Product: WinNt, suite: SingleUserTS Personal

Machine Name:

Debug session time: Thu Jun 4 20:02:31.000 2009 (GMT-4)

System Uptime: 0 days 0:41:12.684

Process Uptime: 0 days 0:22:40.000

................................................................

................................................................

....................................................

Loading unloaded module list

..........................................................

eax=000000c0 ebx=00000002 ecx=049ffd88 edx=00000000 esi=00000000 edi=00000000

eip=77860f34 esp=049ffca4 ebp=049ffd40 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

ntdll!KiFastSystemCallRet:

77860f34 c3 ret

SECOND .DMP:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Boris\Desktop\PID-2168__EXPLORER.EXE__2nd_chance_UnknownException__full_0ec4_2009-06-04_20-01-58-134_0878.dmp]

User Mini Dump File with Full Memory: Only application data is available

Comment: '2nd_chance_UnknownException_exception_in_EXPLORER.EXE_running_on_IRENE-PC'

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

Windows Vista Version 6000 MP (2 procs) Free x86 compatible

Product: WinNt, suite: SingleUserTS Personal

Machine Name:

Debug session time: Thu Jun 4 20:01:59.000 2009 (GMT-4)

System Uptime: 0 days 0:41:04.066

Process Uptime: 0 days 0:22:08.000

................................................................

................................................................

....................................................

Loading unloaded module list

..........................................................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(878.2fc): Unknown exception - code c06d007e (first/second chance not available)

eax=0947e6b8 ebx=00000000 ecx=00000001 edx=00000000 esi=098292bc edi=00000000

eip=7640b09e esp=0947e6b8 ebp=0947e708 iopl=0 nv up ei pl nz ac pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216

*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -

kernel32!RaiseException+0x58:

7640b09e c9 leave

PLEASE HELP !! Thanks in advance!

Link to comment
Share on other sites


if this helps, event viewer says the app is explorer.exe, and the faulting module is kernel32.dll

That means nothing - kernel32 is only pointed to because it was in the top of the stack. If you look closely, you'll see it is there because the RaiseException function used to let you know a process is crashing is in kernel32.dll. You HAVE to at least see the stack and look at memory to be able to tell what's happening. I've posted in the other post more information.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...