[Help] explorer is slow and crashing on shutdown.

[Fr33m4n]

My computer has been behaving oddly lately and I'm pretty sure it is caused by explorer.exe. What will happen is that the machine will seemingly hang but if I open task manager, kill exploere and restart it then the machine will continue to work fine. This usually occurs when I'm exiting a lot of applications, so my guess is that explorer has problems unloading dll's. Explorer will also almost allways hang on shutdown so when I click shutdown I get the trying to close unresponsive app screen with the blue bar going across teh screen and then it will prompt me to "end now". In addition to exploer acting up I have noticed that when I start and exit maxthon it will hang for a moment and then suddenly start working again. I also have the problem that mediaplayer classic will take forever to load any movie files and then after it has played for a while it'll start dropping frames though the audio will play just fine. I am pretty sure thse problems are related though I'm no expert which is why I'm asking if someone please has some advice for me. thx in advance.

Edited February 2, 2006 by Fr33m4n

[Zxian]

Read through the Rules at the top of this forum. There's a link to my guide there. Follow all the applicable steps and then see if that helps any.

[Fr33m4n]

thx Zxian, I have taken a look at your guide but I can't find anything that applies to me. I haven't done anything but webdesign lately and browsing for tutorials. That makes malware the most likely option but I am protected with ZA:SS and I have also scanned with Spybot S&D. Both come up clean. This problem has just been introduced gradually. It started with windows taking longer and longer to shut down and now it just hangs when I try to. I get no special error messages of any kind except for the vanilla "we are sorry for your inconvinience" one. If you are thinking fragmentation I have to dissapoint you on that one as well because I have diskeeper set to smart schedule. The main problem is that there are no error messages so I don't really know where to start searching.

[possy_99]

Have you checked your error logs?

..right click my comp -> manage -> event viewer

[Fr33m4n]

Now why didn't I think of that? I think that was really good advice because I found two error messages that kept reappearing regularly but I can't make much sense of them. Does this mean anything to anyone else?

Event Type: Warning

Event Source: Userenv

Event Category: None

Event ID: 1517

Date: 31.01.2006

Time: 23:47:33

User: NT AUTHORITY\SYSTEM

Computer: HOME

Description:

Windows saved user HOME\Denzel registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and

Event Type: Error

Event Source: Srv

Event Category: None

Event ID: 2011

Date: 29.01.2006

Time: 23:25:46

User: N/A

Computer: HOME

Description:

The server's configuration parameter "irpstacksize" is too small for the server to use a local device. Please increase the value of this parameter.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 00 00 00 00 01 00 50 00 ......P.

0008: 00 00 00 00 db 07 00 c0 ....Û..À

0010: 00 00 00 00 00 00 00 00 ........

0018: 00 00 00 00 00 00 00 00 ........

0020: 00 00 00 00 00 00 00 00 ........

If I try the links I get "no additional information available".

Edited February 3, 2006 by Fr33m4n

[LLXX]

Clear out everything in \windows\system32\dllcache and \windows\system32\prefetch, reboot to command prompt, extract explorer.exe from your XP CD and reboot. That might solve the problem.

Edited February 4, 2006 by LLXX

[cluberti]

The first error message means that you have a process that is holding open it's portion of the registry, and Windows cannot unload your user profile until this process releases it's grip on the registry. This is usually caused by Antivirus applications, and print drivers. You can install UPHClean from Microsoft to remedy this situation if it isn't being caused by A/V or drivers, as this service forcibly unloads the registry when a user logs off. This can cause a loss of data if the process that it forces closed has files open, however, so be aware of this - it's better to determine the cause of this if you can, because UPHClean does modify the way Windows works.

The second issue can be resolved by making the following registry change:

Key: HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters

Value: IRPStackSize

Type: REG_DWORD

Radix: Decimal

Data: 11

Close the registry editor and reboot for the changes to take effect. Note that if you are using the Norton/Symantec Internet Security suite, this should be set to 10, rather than 11 (the Internet Utilities suite has some issues when this is set to 11, the highest value, and Symantec recommends 10 instead for this value).

After making these changes, see if explorer.exe is still crashing on you - if so, we can debug it to determine what module or thread running in the explorer.exe process is crashing it.

[Mr Snrub]

Event Type: Error

Event Source: Srv

Event Category: None

Event ID: 2011

Date: 29.01.2006

Time: 23:25:46

User: N/A

Computer: HOME

Description:

The server's configuration parameter "irpstacksize" is too small for the server to use a local device. Please increase the value of this parameter.

Try here for information on the "IRPStackSize" registry value:

KB177078

Some 3rd party products are known to change this value and make it too low, it would be worth checking out what you have set.

[Fr33m4n]

thx, I fixed the irpstacksize, turns out I didn't even have that value in the registry at all. Now I don't get that error message anymore but explorer is still not behaving nicely, so it's probably the first error message that is the cause of this. For AV I use ZA:SS and I have a canon pixma mp800 printer. How do I determine if any of these are the culprit?

@LLXX: I'd like to try your suggestion but I am unsure what parameters to use in cmd once I have rebooted to safe mode with cmd. How do I unpcak something from cmd and where on the xpcd is it located?

[LLXX]

@LLXX: I'd like to try your suggestion but I am unsure what parameters to use in cmd once I have rebooted to safe mode with cmd. How do I unpcak something from cmd and where on the xpcd is it located?

Please read http://www.msfn.org/board/index.php?showtopic=66521

[Fr33m4n]

thx LLXX, I followed your advice in that other thread, I cleared my dllcache (didn't manage to clear the prefetch folder though) killed explorer and ran this code:

expand f:\I386\explorer.ex_ -r c:\windows\

Then I got a mesage saying that it expanded 187%.

Unfortunately I don't think it did much and now just recently I experienced a BSOD with this error code in it:

Stop: 0x0000008E (0xC0000005, 0x033FE218, 0xF3A15CA8, 0x00000000).

So I guess I'm back to square one. I also looked up "Usernv" in the MS KB and found a note saying that the entry was normal and that I shouldn't bother with it.

[LLXX]

You may have bad RAM... according to Microsoft's article. It is also possible that some other system files are corrupted as well.

Stop 8E is KERNEL_MODE_EXCEPTION_NOT_HANDLED and the exception is C0000005 which is Access Violation.

Run MemTest86 on the system to see if the RAM is bad.

Otherwise you may need to reinstall Windows.

[Fr33m4n]

All right, I couldn't get MemTest86 to run so I used GoldMemory v6.64 instead. It outputed this:

QUICK Test Mode									 Memory Size 1023 MB
															  Benchmark 2132 MB/s
						  Continuous Testing
Pass Count   2
Status		  Failed
Errors		  8

(new box)

0:18:49/0	 3919F45C  (then there was 32 dashes ---where one was replaced by an X, I'll just list the position of the X) X=29 15C34AA2  15C34AAA  00ED

0:34:46/0	 30D982A8  X=10  6F2CB725  6F6CB725  00F3
0:37:47/0	 391982A8  X=10  2301532E  2341532E  00F4
0:40:26/0	 369982A8  X=10  F90A49E4 F94A49E4  00F5
(and so forth)

(new box)

File Error . . .

I'm not entierly sure what all of this means but I think it's pretty clear that I have a memory error. Only thing is, is it a problem in the memory? or is it poor contact between the MB and RAM or is it the RAM channels on the MB that are broken? What should I do next?

[LLXX]

These are single-bit errors and each one except for the first is at the 10th bit, so it might be a connection problem. Remove and reinsert the RAM modules and test again. If the error repeatedly occurs in the same place, there is a problem with the RAM itself.

Try underclocking the RAM - e.g. instead of running DDR400 at 200MHz, use 166MHz instead. Slowing down might solve the problem, at the expense of slightly decreased performance. Otherwise you'll need to replace the RAM.

Edited February 8, 2006 by LLXX