aussieunderdog
asked on
When I try to open certain (but not all) folders containing artwork it either automatically closes all the associated sub-folders
Whenever I try to open certain (but not all) folders containing artwork I get a message "Windows Explorer has encountered a problem and needs to close etc" and it automatically closes all folders and programs, or sometimes it closes the program I had tried to open the file with (eg. Photoshop) or sometimes it just hangs and I have to press Ctrl +Alt+Del and close all associated folders etc.
realized007
check your system log and application log for errors and paste them here.
ASKER
Sorry - I'm only a beginner - how do I check my system log and application log?
What's happening is that your windows explorer is crashing..taking with it the open files/folders, then restarting on it's own.
Is it Windows XP sp2?
Can you send the dr. watson log file. with the corresponding Application and System Event log entry
- it should say something like : Application Error Event ID: 1000/1001
Dr. watson log file is at:
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
Is it Windows XP sp2?
Can you send the dr. watson log file. with the corresponding Application and System Event log entry
- it should say something like : Application Error Event ID: 1000/1001
Dr. watson log file is at:
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
When your computer crashes, for the most part it tries to log what happened inside your event logs.
TO access the logs right click on my computer, left click on Manage.
goto Event Viewer.
You will have at least these in there:
Application Log
Security
System
(and possibly you will have a lot more)
I want to know whats in Application Log, and System Log.
first you want to cuase the pc to crash, right after that go into the logs and look at that same time.
tell us the Event Id, the Source, and description.. you can double click on the event's to view the whole thing.
TO access the logs right click on my computer, left click on Manage.
goto Event Viewer.
You will have at least these in there:
Application Log
Security
System
(and possibly you will have a lot more)
I want to know whats in Application Log, and System Log.
first you want to cuase the pc to crash, right after that go into the logs and look at that same time.
tell us the Event Id, the Source, and description.. you can double click on the event's to view the whole thing.
ASKER
Thanks. Unfortunately I have a meeting now but I'll get back to you in about 30 minutes. Don't go away!
ASKER
OK. Under Event Viewer it brings up Application, Internet Explorer, Security and System logs.
Next to Application it says Application Error Records
Next to Internet Explorer it says Custom Log Error Records
Next to Security it says Security Audit Records, and
Next to System it says System Error Records.
If i double click on Application there are errors everywhere: Winlogon, Application Error, MsInstaller, and SideBySide (whatever they are?)
Hope that's what you were after?
Next to Application it says Application Error Records
Next to Internet Explorer it says Custom Log Error Records
Next to Security it says Security Audit Records, and
Next to System it says System Error Records.
If i double click on Application there are errors everywhere: Winlogon, Application Error, MsInstaller, and SideBySide (whatever they are?)
Hope that's what you were after?
ASKER
OK. Under Event Viewer it brings up Application, Internet Explorer, Security and System logs.
Next to Application it says Application Error Records
Next to Internet Explorer it says Custom Log Error Records
Next to Security it says Security Audit Records, and
Next to System it says System Error Records.
If i double click on Application there are errors everywhere: Winlogon, Application Error, MsInstaller, and SideBySide (whatever they are?)
Hope that's what you were after?
Next to Application it says Application Error Records
Next to Internet Explorer it says Custom Log Error Records
Next to Security it says Security Audit Records, and
Next to System it says System Error Records.
If i double click on Application there are errors everywhere: Winlogon, Application Error, MsInstaller, and SideBySide (whatever they are?)
Hope that's what you were after?
Lol .
ok right click on APplication Log, left click clear all events.. save it if you want..
do the same for system log.
once they are blank.
cause it to crash again by openin gthe pictures.
then go back in there and see what the errors are.
ok right click on APplication Log, left click clear all events.. save it if you want..
do the same for system log.
once they are blank.
cause it to crash again by openin gthe pictures.
then go back in there and see what the errors are.
ASKER
Under Application it says
Type: Error. (date, time). Source: Application Error. Category: None. Event: 1000. User: N/A. Computer: USER-2F02
Everything else looks OK (in the Internet, Security, System folders)
Type: Error. (date, time). Source: Application Error. Category: None. Event: 1000. User: N/A. Computer: USER-2F02
Everything else looks OK (in the Internet, Security, System folders)
whats the SOURCE
also copy/paste the description
also copy/paste the description
nm i see the source.. paste the description
ASKER
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
ASKER
I am running Windows XP Professional Version 2002 (2004) [Includes Service Pack 2] -
and (in case it's relevant)
Microsoft Office Student and Teacher Edition 2003
and (in case it's relevant)
Microsoft Office Student and Teacher Edition 2003
And its only when you open folders with pictures ??
check event logs again see if there is anything new (check system and appliction log)
check event logs again see if there is anything new (check system and appliction log)
ASKER
Yes, only folders containing pictures (photos or artwork done in Photoshop for example).
Checked the event logs again and the description is:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
Checked the event logs again and the description is:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
Lets try this ->
(disable thumbnail creation then delete cached thumbnails)..
TUrn it off:
1) Open My Computer
2) Click on Tools
3) Click on Folder Options
4) Click on the View Tab
5) Place a check in the option "Do not cache thumbnails"
6) Click Ok
7) Close My Computer
now remove thumbnails:
1) Click on Start
2) Click on Search
3) Click on All Files and Folders
4) Type the following in the section called "all or part of the file name"
thumbs.db
5) In the Look in box, make sure Local Hard Drives is chosen
6) Click Search
7) A long list of thumbs.db files should appear, click on Edit, Select All
8) Click on File, and choose Delete
9) Close the Search Results window
then try again to view the folder.. see if it crashes
(disable thumbnail creation then delete cached thumbnails)..
TUrn it off:
1) Open My Computer
2) Click on Tools
3) Click on Folder Options
4) Click on the View Tab
5) Place a check in the option "Do not cache thumbnails"
6) Click Ok
7) Close My Computer
now remove thumbnails:
1) Click on Start
2) Click on Search
3) Click on All Files and Folders
4) Type the following in the section called "all or part of the file name"
thumbs.db
5) In the Look in box, make sure Local Hard Drives is chosen
6) Click Search
7) A long list of thumbs.db files should appear, click on Edit, Select All
8) Click on File, and choose Delete
9) Close the Search Results window
then try again to view the folder.. see if it crashes
ASKER
You're onto something there!
It almost worked....it opened the folder.....then froze (then I had to Ctr Alt Del etc like before)
I checked the Description in Event: 2 errors as follows:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
Hanging application mmc.exe, version 5.2.3790.4136, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
It almost worked....it opened the folder.....then froze (then I had to Ctr Alt Del etc like before)
I checked the Description in Event: 2 errors as follows:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00037423.
Hanging application mmc.exe, version 5.2.3790.4136, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
you might have a few things going on...
can you reboot and try again before we continue? just to try?
can you reboot and try again before we continue? just to try?
ASKER
This time it let me in for a few seconds then a message appeared:
Data Execution Prevention - Microsoft Windows
To help protect your computer, Windows has closed this program.
Then I checked the Event and Description and a whole bunch of errors came up (same ones as before)
REALLY sorry but I have to go - wife is going to kill me for being so late. I'll have to start again tomorrow. Thanks for all your help so far (it may not be solved but I'm sooo impressed with your knowledge anyway!)
Data Execution Prevention - Microsoft Windows
To help protect your computer, Windows has closed this program.
Then I checked the Event and Description and a whole bunch of errors came up (same ones as before)
REALLY sorry but I have to go - wife is going to kill me for being so late. I'll have to start again tomorrow. Thanks for all your help so far (it may not be solved but I'm sooo impressed with your knowledge anyway!)
If you have time.. run a scan online.. (then we can worry about disabling DEP later).
http://housecall.trendmicro.com
do a free online virus/adware scan.
will take time.. just start it then come back later.
i will be around tomorrow.
talk to you then
http://housecall.trendmicro.com
do a free online virus/adware scan.
will take time.. just start it then come back later.
i will be around tomorrow.
talk to you then
Hey,
Please do upload the drwatson log whenever you can, this is essentially an issue with explorer.exe crashing with Data Execution prevention (DEP).
If you have McAfee anti virus installed, please update it..it is known problem with McAfee installed.
Dr. watson log file is at:
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
Please do upload the drwatson log whenever you can, this is essentially an issue with explorer.exe crashing with Data Execution prevention (DEP).
If you have McAfee anti virus installed, please update it..it is known problem with McAfee installed.
Dr. watson log file is at:
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
ASKER
The Dr watson file is about 6Mb so too big to upload on this page, but here's the first section:
Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: USER-2F02340E67
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 6 Model 15 Stepping 13
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: user
*----> Task List <----*
0 System Process
4 System
460 smss.exe
512 csrss.exe
536 winlogon.exe
580 services.exe
592 lsass.exe
756 svchost.exe
1040 svchost.exe
1080 svchost.exe
1148 svchost.exe
1204 svchost.exe
1356 spoolsv.exe
1500 MaxBackServiceInt.exe
1540 SyncServices.exe
1556 nvsvc32.exe
1584 HPZipm12.exe
1784 alg.exe
820 RTHDCPL.EXE
880 RUNDLL32.EXE
888 Onetouch.exe
912 maxmenumgr.exe
920 qttask.exe
952 HPWuSchd2.exe
1156 MMonitor.exe
1244 wscntfy.exe
1120 svchost.exe
1216 DvzIncMsgr.exe
1400 Hotsync.exe
1472 hpqtra08.exe
2088 hpqimzone.exe
2492 WINWORD.EXE
2824 wpabaln.exe
3216 hpqSTE08.exe
2072 explorer.exe
3304 drwtsn32.exe
*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\explorer.exe
(00000000012f0000 - 0000000001302000: C:\WINDOWS\system32\browse
(0000000001790000 - 00000000017ea000: C:\WINDOWS\system32\nvapi.
(00000000017f0000 - 0000000001863000: C:\WINDOWS\system32\nvshel
(0000000002a00000 - 0000000002a1c000: C:\Program Files\Common Files\Adobe\Shell\PSICON.D
(0000000010000000 - 0000000010836000: C:\WINDOWS\system32\nvcpl.
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2r
(00000000325c0000 - 00000000325d2000: C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
(000000004ec50000 - 000000004edf3000: C:\WINDOWS\WinSxS\x86_Micr
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxThem
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\system32\themeu
(000000005cb00000 - 000000005cb6e000: C:\WINDOWS\system32\shimgv
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEn
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenr
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HEL
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK3
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dl
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanm
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\system32\actxpr
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm3
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPO
(0000000073b30000 - 0000000073b44000: C:\WINDOWS\system32\mscms.
(00000000746c0000 - 00000000746e7000: C:\WINDOWS\system32\msls31
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\system32\POWRPR
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\system32\BatMet
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\system32\webche
(0000000074c80000 - 0000000074cac000: C:\WINDOWS\system32\OLEACC
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTU
(0000000075cf0000 - 0000000075d81000: C:\WINDOWS\system32\MLANG.
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DL
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davcln
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSE
(0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP6
(0000000076280000 - 00000000762a1000: C:\WINDOWS\system32\stobje
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA
(0000000076380000 - 0000000076385000: C:\WINDOWS\system32\MSIMG3
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHE
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKIN
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshru
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USEREN
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRU
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEH
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpa
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutil
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\WTSAPI
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP3
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCAT
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININE
(0000000077260000 - 0000000077300000: C:\WINDOWS\system32\urlmon
(00000000773d0000 - 00000000774d2000: C:\WINDOWS\WinSxS\x86_Micr
(00000000774e0000 - 000000007761c000: C:\WINDOWS\system32\ole32.
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMART
(0000000077760000 - 00000000778ce000: C:\WINDOWS\system32\SHDOCV
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPA
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT3
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHel
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midima
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM3
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSIO
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAP
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur3
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL3
(000000007d1e0000 - 000000007d492000: C:\WINDOWS\system32\msi.dl
(000000007dc30000 - 000000007df1e000: C:\WINDOWS\system32\mshtml
*----> State Dump for Thread Id 0xd8c <----*
eax=000e99e4 ebx=00000003 ecx=7777bf30 edx=7c90eb94 esi=000c6438 edi=00000000
eip=7c90eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL3
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\explorer.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel
ChildEBP RetAddr Args to Child
0007ff08 7ca32c57 00000000 0007ff5c 01016e95 ntdll!KiFastSystemCallRet
0007ff14 01016e95 000c6438 7ffd6000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 0002062e explorer+0x16e95
0007ffc0 7c816d4f 00074418 0006e890 7ffd6000 explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForIn
Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: USER-2F02340E67
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 6 Model 15 Stepping 13
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: user
*----> Task List <----*
0 System Process
4 System
460 smss.exe
512 csrss.exe
536 winlogon.exe
580 services.exe
592 lsass.exe
756 svchost.exe
1040 svchost.exe
1080 svchost.exe
1148 svchost.exe
1204 svchost.exe
1356 spoolsv.exe
1500 MaxBackServiceInt.exe
1540 SyncServices.exe
1556 nvsvc32.exe
1584 HPZipm12.exe
1784 alg.exe
820 RTHDCPL.EXE
880 RUNDLL32.EXE
888 Onetouch.exe
912 maxmenumgr.exe
920 qttask.exe
952 HPWuSchd2.exe
1156 MMonitor.exe
1244 wscntfy.exe
1120 svchost.exe
1216 DvzIncMsgr.exe
1400 Hotsync.exe
1472 hpqtra08.exe
2088 hpqimzone.exe
2492 WINWORD.EXE
2824 wpabaln.exe
3216 hpqSTE08.exe
2072 explorer.exe
3304 drwtsn32.exe
*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\explorer.exe
(00000000012f0000 - 0000000001302000: C:\WINDOWS\system32\browse
(0000000001790000 - 00000000017ea000: C:\WINDOWS\system32\nvapi.
(00000000017f0000 - 0000000001863000: C:\WINDOWS\system32\nvshel
(0000000002a00000 - 0000000002a1c000: C:\Program Files\Common Files\Adobe\Shell\PSICON.D
(0000000010000000 - 0000000010836000: C:\WINDOWS\system32\nvcpl.
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2r
(00000000325c0000 - 00000000325d2000: C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
(000000004ec50000 - 000000004edf3000: C:\WINDOWS\WinSxS\x86_Micr
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxThem
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\system32\themeu
(000000005cb00000 - 000000005cb6e000: C:\WINDOWS\system32\shimgv
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEn
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenr
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HEL
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK3
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dl
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanm
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\system32\actxpr
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm3
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPO
(0000000073b30000 - 0000000073b44000: C:\WINDOWS\system32\mscms.
(00000000746c0000 - 00000000746e7000: C:\WINDOWS\system32\msls31
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\system32\POWRPR
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\system32\BatMet
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\system32\webche
(0000000074c80000 - 0000000074cac000: C:\WINDOWS\system32\OLEACC
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTU
(0000000075cf0000 - 0000000075d81000: C:\WINDOWS\system32\MLANG.
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DL
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davcln
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSE
(0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP6
(0000000076280000 - 00000000762a1000: C:\WINDOWS\system32\stobje
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA
(0000000076380000 - 0000000076385000: C:\WINDOWS\system32\MSIMG3
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHE
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKIN
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshru
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USEREN
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRU
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEH
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpa
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutil
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\WTSAPI
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP3
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCAT
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININE
(0000000077260000 - 0000000077300000: C:\WINDOWS\system32\urlmon
(00000000773d0000 - 00000000774d2000: C:\WINDOWS\WinSxS\x86_Micr
(00000000774e0000 - 000000007761c000: C:\WINDOWS\system32\ole32.
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMART
(0000000077760000 - 00000000778ce000: C:\WINDOWS\system32\SHDOCV
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPA
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT3
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHel
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midima
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM3
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSIO
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAP
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur3
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL3
(000000007d1e0000 - 000000007d492000: C:\WINDOWS\system32\msi.dl
(000000007dc30000 - 000000007df1e000: C:\WINDOWS\system32\mshtml
*----> State Dump for Thread Id 0xd8c <----*
eax=000e99e4 ebx=00000003 ecx=7777bf30 edx=7c90eb94 esi=000c6438 edi=00000000
eip=7c90eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL3
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\explorer.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel
ChildEBP RetAddr Args to Child
0007ff08 7ca32c57 00000000 0007ff5c 01016e95 ntdll!KiFastSystemCallRet
0007ff14 01016e95 000c6438 7ffd6000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 0002062e explorer+0x16e95
0007ffc0 7c816d4f 00074418 0006e890 7ffd6000 explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForIn
ASKER
Maybe this is part of the problem (or, more likely, I am not looking in the right place) but there is no Application Data folder: in the All Users folder I only have Desktop, Favorites, Shared Documents & Start Menu (and none of them contain Application Data)
I can't attach the Dr Watson file because I can't find the Application Data/Microsoft folder that contains it. By cut and pasting your link into Run, the following came up (excerpt only):
Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: USER-2F02340E67
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 6 Model 15 Stepping 13
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: user
*----> Task List <----*
0 System Process
4 System
460 smss.exe
512 csrss.exe
536 winlogon.exe
580 services.exe
592 lsass.exe
756 svchost.exe
1040 svchost.exe
1080 svchost.exe
1148 svchost.exe
1204 svchost.exe
1356 spoolsv.exe
1500 MaxBackServiceInt.exe
1540 SyncServices.exe
1556 nvsvc32.exe
1584 HPZipm12.exe
1784 alg.exe
820 RTHDCPL.EXE
880 RUNDLL32.EXE
888 Onetouch.exe
912 maxmenumgr.exe
920 qttask.exe
952 HPWuSchd2.exe
1156 MMonitor.exe
1244 wscntfy.exe
1120 svchost.exe
1216 DvzIncMsgr.exe
1400 Hotsync.exe
1472 hpqtra08.exe
2088 hpqimzone.exe
2492 WINWORD.EXE
2824 wpabaln.exe
3216 hpqSTE08.exe
2072 explorer.exe
3304 drwtsn32.exe
*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\explorer.exe
(00000000012f0000 - 0000000001302000: C:\WINDOWS\system32\browse
(0000000001790000 - 00000000017ea000: C:\WINDOWS\system32\nvapi.
(00000000017f0000 - 0000000001863000: C:\WINDOWS\system32\nvshel
(0000000002a00000 - 0000000002a1c000: C:\Program Files\Common Files\Adobe\Shell\PSICON.D
(0000000010000000 - 0000000010836000: C:\WINDOWS\system32\nvcpl.
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2r
(00000000325c0000 - 00000000325d2000: C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
(000000004ec50000 - 000000004edf3000: C:\WINDOWS\WinSxS\x86_Micr
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxThem
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\system32\themeu
(000000005cb00000 - 000000005cb6e000: C:\WINDOWS\system32\shimgv
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEn
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenr
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HEL
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK3
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dl
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanm
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\system32\actxpr
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm3
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPO
(0000000073b30000 - 0000000073b44000: C:\WINDOWS\system32\mscms.
(00000000746c0000 - 00000000746e7000: C:\WINDOWS\system32\msls31
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\system32\POWRPR
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\system32\BatMet
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\system32\webche
(0000000074c80000 - 0000000074cac000: C:\WINDOWS\system32\OLEACC
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTU
(0000000075cf0000 - 0000000075d81000: C:\WINDOWS\system32\MLANG.
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DL
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davcln
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSE
(0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP6
(0000000076280000 - 00000000762a1000: C:\WINDOWS\system32\stobje
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA
(0000000076380000 - 0000000076385000: C:\WINDOWS\system32\MSIMG3
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHE
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKIN
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshru
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USEREN
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRU
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEH
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpa
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutil
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\WTSAPI
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP3
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCAT
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININE
(0000000077260000 - 0000000077300000: C:\WINDOWS\system32\urlmon
(00000000773d0000 - 00000000774d2000: C:\WINDOWS\WinSxS\x86_Micr
(00000000774e0000 - 000000007761c000: C:\WINDOWS\system32\ole32.
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMART
(0000000077760000 - 00000000778ce000: C:\WINDOWS\system32\SHDOCV
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPA
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT3
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHel
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midima
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM3
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSIO
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAP
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur3
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL3
(000000007d1e0000 - 000000007d492000: C:\WINDOWS\system32\msi.dl
(000000007dc30000 - 000000007df1e000: C:\WINDOWS\system32\mshtml
*----> State Dump for Thread Id 0xd8c <----*
eax=000e99e4 ebx=00000003 ecx=7777bf30 edx=7c90eb94 esi=000c6438 edi=00000000
eip=7c90eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL3
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\explorer.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel
ChildEBP RetAddr Args to Child
0007ff08 7ca32c57 00000000 0007ff5c 01016e95 ntdll!KiFastSystemCallRet
0007ff14 01016e95 000c6438 7ffd6000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 0002062e explorer+0x16e95
0007ffc0 7c816d4f 00074418 0006e890 7ffd6000 explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForIn
I can't attach the Dr Watson file because I can't find the Application Data/Microsoft folder that contains it. By cut and pasting your link into Run, the following came up (excerpt only):
Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: USER-2F02340E67
User Name: Administrator
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 6 Model 15 Stepping 13
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: user
*----> Task List <----*
0 System Process
4 System
460 smss.exe
512 csrss.exe
536 winlogon.exe
580 services.exe
592 lsass.exe
756 svchost.exe
1040 svchost.exe
1080 svchost.exe
1148 svchost.exe
1204 svchost.exe
1356 spoolsv.exe
1500 MaxBackServiceInt.exe
1540 SyncServices.exe
1556 nvsvc32.exe
1584 HPZipm12.exe
1784 alg.exe
820 RTHDCPL.EXE
880 RUNDLL32.EXE
888 Onetouch.exe
912 maxmenumgr.exe
920 qttask.exe
952 HPWuSchd2.exe
1156 MMonitor.exe
1244 wscntfy.exe
1120 svchost.exe
1216 DvzIncMsgr.exe
1400 Hotsync.exe
1472 hpqtra08.exe
2088 hpqimzone.exe
2492 WINWORD.EXE
2824 wpabaln.exe
3216 hpqSTE08.exe
2072 explorer.exe
3304 drwtsn32.exe
*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\explorer.exe
(00000000012f0000 - 0000000001302000: C:\WINDOWS\system32\browse
(0000000001790000 - 00000000017ea000: C:\WINDOWS\system32\nvapi.
(00000000017f0000 - 0000000001863000: C:\WINDOWS\system32\nvshel
(0000000002a00000 - 0000000002a1c000: C:\Program Files\Common Files\Adobe\Shell\PSICON.D
(0000000010000000 - 0000000010836000: C:\WINDOWS\system32\nvcpl.
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2r
(00000000325c0000 - 00000000325d2000: C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
(000000004ec50000 - 000000004edf3000: C:\WINDOWS\WinSxS\x86_Micr
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxThem
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\system32\themeu
(000000005cb00000 - 000000005cb6e000: C:\WINDOWS\system32\shimgv
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEn
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenr
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HEL
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK3
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dl
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanm
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\system32\actxpr
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm3
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPO
(0000000073b30000 - 0000000073b44000: C:\WINDOWS\system32\mscms.
(00000000746c0000 - 00000000746e7000: C:\WINDOWS\system32\msls31
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\system32\POWRPR
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\system32\BatMet
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\system32\webche
(0000000074c80000 - 0000000074cac000: C:\WINDOWS\system32\OLEACC
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTU
(0000000075cf0000 - 0000000075d81000: C:\WINDOWS\system32\MLANG.
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DL
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davcln
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSE
(0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP6
(0000000076280000 - 00000000762a1000: C:\WINDOWS\system32\stobje
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA
(0000000076380000 - 0000000076385000: C:\WINDOWS\system32\MSIMG3
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHE
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKIN
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshru
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USEREN
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRU
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEH
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpa
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutil
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\WTSAPI
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP3
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCAT
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININE
(0000000077260000 - 0000000077300000: C:\WINDOWS\system32\urlmon
(00000000773d0000 - 00000000774d2000: C:\WINDOWS\WinSxS\x86_Micr
(00000000774e0000 - 000000007761c000: C:\WINDOWS\system32\ole32.
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMART
(0000000077760000 - 00000000778ce000: C:\WINDOWS\system32\SHDOCV
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPA
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT3
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHel
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midima
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM3
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSIO
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAP
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur3
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL3
(000000007d1e0000 - 000000007d492000: C:\WINDOWS\system32\msi.dl
(000000007dc30000 - 000000007df1e000: C:\WINDOWS\system32\mshtml
*----> State Dump for Thread Id 0xd8c <----*
eax=000e99e4 ebx=00000003 ecx=7777bf30 edx=7c90eb94 esi=000c6438 edi=00000000
eip=7c90eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL3
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\explorer.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel
ChildEBP RetAddr Args to Child
0007ff08 7ca32c57 00000000 0007ff5c 01016e95 ntdll!KiFastSystemCallRet
0007ff14 01016e95 000c6438 7ffd6000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 0002062e explorer+0x16e95
0007ffc0 7c816d4f 00074418 0006e890 7ffd6000 explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForIn
ASKER
OK...I've scanned my Pc (using the http://housecall.trendmicro.com ) . There was some grayware that failed to be removed, otherwise all good.
So, apparently it's a crash between DEP and Windows Explorer exe?
So, apparently it's a crash between DEP and Windows Explorer exe?
Hey,
That's right, the problem is explorer.exe crashing with a Data execution prevention exception, that's called DEP.
What you see on the desktop, taskbar, desktop wallpaper and icons..thall all is explorer.exe interface
Essantially, something is loading inside explorer.exe which is offensive enough for the operating system to flag it down as an exception and close it down forcibly, thereby crashing the parent process which is explorer.exe.
I guess i should've intimated you in advance, the latest entries in dr wtsn32 log are at the bottom, not at the top
The entry u've posted is dated 10th June,
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
If you can upload the drwtn32 dump, that'll be great.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
Otherwise, please post the recent most entry in drwtsn32 log, moving up from the bottom
That's right, the problem is explorer.exe crashing with a Data execution prevention exception, that's called DEP.
What you see on the desktop, taskbar, desktop wallpaper and icons..thall all is explorer.exe interface
Essantially, something is loading inside explorer.exe which is offensive enough for the operating system to flag it down as an exception and close it down forcibly, thereby crashing the parent process which is explorer.exe.
I guess i should've intimated you in advance, the latest entries in dr wtsn32 log are at the bottom, not at the top
The entry u've posted is dated 10th June,
Application exception occurred:
App: C:\WINDOWS\explorer.exe (pid=2072)
When: 6/10/2008 @ 15:00:10.812
Exception number: c0000005 (access violation)
If you can upload the drwtn32 dump, that'll be great.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
Otherwise, please post the recent most entry in drwtsn32 log, moving up from the bottom
ASKER
Hey
I've attached the dump file and the latest entries for the log.
Can't wait to find out how to fix it!
drwtsn32.log
dr-watson-dump-file.txt
I've attached the dump file and the latest entries for the log.
Can't wait to find out how to fix it!
drwtsn32.log
dr-watson-dump-file.txt
Thanks for uploading,
Shall get back to you with the review.
Shall get back to you with the review.
ASKER
Any luck yet?
Look forward to hearing from you soon.
Look forward to hearing from you soon.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey
You are a genius! Thank you so much. My life has just improved.
In case you were wondering what was causing the problem, it was the Photoshop Icon Handlers (there are 2 of them and they are either both disabled or both enabled)
[ Photoshop Icon Handler Yes Thumbnail 6.0 Adobe Photoshop Adobe Systems, Incorporated No No No No No C:\Program Files\Common Files\Adobe\Shell\PSICON.D
If I don't hear back from you I presume that there is nothing more I have to do - I have left the Photoshop Icon Handlers disabled.
Thank you again and keep up the great work!
You are a genius! Thank you so much. My life has just improved.
In case you were wondering what was causing the problem, it was the Photoshop Icon Handlers (there are 2 of them and they are either both disabled or both enabled)
[ Photoshop Icon Handler Yes Thumbnail 6.0 Adobe Photoshop Adobe Systems, Incorporated No No No No No C:\Program Files\Common Files\Adobe\Shell\PSICON.D
If I don't hear back from you I presume that there is nothing more I have to do - I have left the Photoshop Icon Handlers disabled.
Thank you again and keep up the great work!
Hey ,
Thanks for the compliment.
Well, we've pretty much figured out the problem..and it seems we're not alone.
Found some articles with numerous people reporting the same problem
http://www.pcreview.co.uk/forums/thread-123090.php
http://www.annoyances.org/exec/forum/winxp/t1061425126
Not much resolution though, other than renaming the PSICON.DLL file to something like PSICON.OLD
And keeping it disabled as well inside explorer.
You can try emailing adobe and tell them this is a problem with PSICON.DLL, let's see where it goes from there.
Thanks for the compliment.
Well, we've pretty much figured out the problem..and it seems we're not alone.
Found some articles with numerous people reporting the same problem
http://www.pcreview.co.uk/forums/thread-123090.php
http://www.annoyances.org/exec/forum/winxp/t1061425126
Not much resolution though, other than renaming the PSICON.DLL file to something like PSICON.OLD
And keeping it disabled as well inside explorer.
You can try emailing adobe and tell them this is a problem with PSICON.DLL, let's see where it goes from there.
Hi, I am having the same issue with a networked folder with Tif images inside. all the same errors and symptoms and i have tried al the suggestions above but still no joy. I dont have Photoshop installed.
Any help apreciated.
Tom
Any help apreciated.
Tom