Link to home
Start Free TrialLog in
Avatar of crashnet
crashnet

asked on

debugging explorer.exe frequent crash: attaching WinDBG to explorer.exe

for months now, several times a day, no matter what i am doing, explorer crashes. i've reinstalled windows, it is still happening. PLEASE HELP me solve this problem. i work on the computer and this is killing my productivity at work.

Faulting application explorer.exe, version 6.0.2900.2180, faulting module , version 0.0.0.0, fault address 0x00000000.
Faulting application explorer.exe, version 6.0.2900.2180, faulting module contmenu.dll, version 0.0.0.0, fault address 0x0008a6d9.
Faulting application explorer.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x01ada6d0.
Faulting application explorer.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x0263a6d0.
(faulting module unknown is the most common cause)

please guide me on setting up the debugger to post the results here. here is what i've done so far (every step taken on the computer to be debugged)

1) installed the full xp sp2 symbols package to f:\symbols
2) created an environment variable named _NT_SYMBOL_PATH pointing to f:\symbols
3) installed the latest version of windbg
4) attached windbg to explorer.exe and it seems that explorer crashes as soon i attach the debugger because it stops responding and when i quit windbg explorer restarts.

this is the output window result after i attach. am i doing this right?

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
The call to LoadLibrary(ext) failed, Win32 error 2
    "The system cannot find the file specified."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(uext) failed, Win32 error 2
    "The system cannot find the file specified."
Please check your debugger configuration and/or network access.
Symbol search path is: F:\Symbols
Executable search path is:
ModLoad: 01000000 010ff000   C:\WINDOWS\explorer.exe
0:000> .reload
Reloading current modules
.
ModLoad: 7c900000 7c9b0000   C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000   C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77f10000 77f57000   C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 7c9c0000 7d1d5000   C:\WINDOWS\system32\SHELL32.dll
ModLoad: 774e0000 7761d000   C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000   C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 75f80000 7607d000   C:\WINDOWS\system32\BROWSEUI.dll
ModLoad: 77760000 778cf000   C:\WINDOWS\system32\SHDOCVW.dll
ModLoad: 77a80000 77b14000   C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 77b20000 77b32000   C:\WINDOWS\system32\MSASN1.dll
ModLoad: 754d0000 75550000   C:\WINDOWS\system32\CRYPTUI.dll
ModLoad: 76c30000 76c5e000   C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 76c90000 76cb8000   C:\WINDOWS\system32\IMAGEHLP.dll
ModLoad: 5b860000 5b8b4000   C:\WINDOWS\system32\NETAPI32.dll
ModLoad: 771b0000 77256000   C:\WINDOWS\system32\WININET.dll
ModLoad: 76f60000 76f8c000   C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\VERSION.dll
ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\UxTheme.dll
ModLoad: 5cb70000 5cb96000   C:\WINDOWS\system32\ShimEng.dll
ModLoad: 6f880000 6fa4a000   C:\WINDOWS\AppPatch\AcGenral.DLL
ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.dll
ModLoad: 77be0000 77bf5000   C:\WINDOWS\system32\MSACM32.dll
ModLoad: 769c0000 76a73000   C:\WINDOWS\system32\USERENV.dll
ModLoad: 10000000 1000d000   C:\WINDOWS\system32\OCMAPIHK.DLL
ModLoad: 00380000 00385000   C:\WINDOWS\system32\wmfhotfix.dll
ModLoad: 773d0000 774d2000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000   C:\WINDOWS\system32\comctl32.dll
ModLoad: 5cd70000 5cd77000   C:\WINDOWS\system32\serwvdrv.dll
ModLoad: 5b0a0000 5b0a7000   C:\WINDOWS\system32\umdmxfrm.dll
ModLoad: 74720000 7476b000   C:\WINDOWS\system32\MSCTF.dll
ModLoad: 77b40000 77b62000   C:\WINDOWS\system32\appHelp.dll
ModLoad: 76fd0000 7704f000   C:\WINDOWS\system32\CLBCATQ.DLL
ModLoad: 77050000 77115000   C:\WINDOWS\system32\COMRes.dll
ModLoad: 77a20000 77a74000   C:\WINDOWS\System32\cscui.dll
ModLoad: 76600000 7661d000   C:\WINDOWS\System32\CSCDLL.dll
ModLoad: 5ba60000 5bad1000   C:\WINDOWS\system32\themeui.dll
ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
ModLoad: 76380000 76385000   C:\WINDOWS\system32\MSIMG32.dll
ModLoad: 20000000 202c5000   C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 71d40000 71d5c000   C:\WINDOWS\system32\actxprxy.dll
ModLoad: 5fc10000 5fc43000   C:\WINDOWS\system32\msutb.dll
ModLoad: 76980000 76988000   C:\WINDOWS\system32\LINKINFO.dll
ModLoad: 76990000 769b5000   C:\WINDOWS\system32\ntshrui.dll
ModLoad: 76b20000 76b31000   C:\WINDOWS\system32\ATL.DLL
ModLoad: 71bf0000 71c03000   C:\WINDOWS\system32\SAMLIB.dll
ModLoad: 011e0000 011fe000   C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll
ModLoad: 01220000 01227000   C:\Program Files\Logitech\iTouch\iTchHk.dll
ModLoad: 77920000 77a13000   C:\WINDOWS\system32\SETUPAPI.dll
ModLoad: 016f0000 019b6000   C:\WINDOWS\system32\msi.dll
ModLoad: 16000000 16028000   C:\Program Files\Trillian\events.dll
ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
ModLoad: 7c340000 7c396000   C:\Program Files\Trillian\MSVCR71.dll
ModLoad: 76360000 76370000   C:\WINDOWS\system32\WINSTA.dll
ModLoad: 74b30000 74b76000   C:\WINDOWS\system32\webcheck.dll
ModLoad: 71ad0000 71ad9000   C:\WINDOWS\system32\WSOCK32.dll
ModLoad: 71ab0000 71ac7000   C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71aa0000 71aa8000   C:\WINDOWS\system32\WS2HELP.dll
ModLoad: 76280000 762a1000   C:\WINDOWS\system32\stobject.dll
ModLoad: 74af0000 74afa000   C:\WINDOWS\system32\BatMeter.dll
ModLoad: 74ad0000 74ad8000   C:\WINDOWS\system32\POWRPROF.dll
ModLoad: 76f50000 76f58000   C:\WINDOWS\system32\WTSAPI32.dll
ModLoad: 5af80000 5afbd000   C:\WINDOWS\system32\upnpui.dll
ModLoad: 76de0000 76e03000   C:\WINDOWS\system32\upnp.dll
ModLoad: 4d4f0000 4d548000   C:\WINDOWS\system32\WINHTTP.dll
ModLoad: 74f00000 74f0c000   C:\WINDOWS\system32\SSDPAPI.dll
ModLoad: 76d60000 76d79000   C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 662b0000 66308000   C:\WINDOWS\system32\hnetcfg.dll
ModLoad: 00e40000 00e59000   C:\WINDOWS\system32\PGPlsp.dll
ModLoad: 71a50000 71a8f000   C:\WINDOWS\system32\mswsock.dll
ModLoad: 71a90000 71a98000   C:\WINDOWS\System32\wshtcpip.dll
ModLoad: 01ec0000 01edc000   F:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
ModLoad: 74980000 74ab0000   C:\WINDOWS\system32\msxml3.dll
ModLoad: 58d40000 58d47000   C:\WINDOWS\System32\wship6.dll
ModLoad: 76400000 765a6000   C:\WINDOWS\system32\NETSHELL.dll
ModLoad: 76e80000 76e8e000   C:\WINDOWS\system32\rtutils.dll
ModLoad: 76c00000 76c2e000   C:\WINDOWS\system32\credui.dll
ModLoad: 77260000 77300000   C:\WINDOWS\system32\urlmon.dll
ModLoad: 5f800000 5f815000   C:\PROGRA~1\WIFD1F~1\MpShHook.dll
ModLoad: 78130000 781cb000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll
ModLoad: 7c420000 7c4a7000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll
ModLoad: 0ffd0000 0fff8000   C:\WINDOWS\system32\rsaenh.dll
ModLoad: 68df0000 68e7d000   C:\WINDOWS\system32\fxsst.dll
ModLoad: 73000000 73026000   C:\WINDOWS\system32\WINSPOOL.DRV
ModLoad: 5a980000 5a9f2000   C:\WINDOWS\system32\FXSAPI.dll
ModLoad: 77690000 776b1000   C:\WINDOWS\system32\NTMARTA.DLL
ModLoad: 71b20000 71b32000   C:\WINDOWS\system32\MPR.dll
ModLoad: 75f60000 75f67000   C:\WINDOWS\System32\drprov.dll
ModLoad: 71c10000 71c1e000   C:\WINDOWS\System32\ntlanman.dll
ModLoad: 71cd0000 71ce7000   C:\WINDOWS\System32\NETUI0.dll
ModLoad: 71c90000 71cd0000   C:\WINDOWS\System32\NETUI1.dll
ModLoad: 71c80000 71c87000   C:\WINDOWS\System32\NETRAP.dll
ModLoad: 75f70000 75f79000   C:\WINDOWS\System32\davclnt.dll
(be8.9a8): Break instruction exception - code 80000003 (first chance)
eax=7ffda000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c901230 esp=0135ffcc ebp=0135fff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc              int     3
Avatar of H
H
Flag of United States of America image

You most likely have a hardware issue...

First things I would look at is...

Bad Memory system memory or Video memory..If you have diagnostics that came with your system run the memory checks...
Also could be bad sectors on your hard drive...Run a full system scan...
ASKER CERTIFIED SOLUTION
Avatar of davexnet
davexnet
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I agree I think bad memory is the culprit

try memtest to scan your memory

http://www.memtest86.com/
By any chance did you copy back files that were backed up prior to reloading your system?

If the hardware is fine after runniong tests try scanning the system foir viruses in safe mode or from a bootable CD

I would try uninstalling what ever program contmenu.dll is associated with - winzip?
Avatar of jkr
If that is a HW issue, not only the explorer would crash. Anyway, the breakpoint occurs in NETUI1.dll. What is the call stack when that happens? Also, what happens if you continue the session (this is only a 'first chance exception)?
Avatar of crashnet
crashnet

ASKER

C:\Program Files\PC Magazine Utilities\DiskPiePro\ContMenu.dll
so i've uninstalled diskpie pro 1.03

i will run memtest again (i did it a couple months ago). how do i test the video memory on an ATI radeon?

how do i see the call stack at the breakpoint?

i also get "The shell stopped unexpectedly and Explorer.exe was restarted." after the application error
The command is

K

See also http://www.codeproject.com/debug/windbg_part1.asp#_Toc64133680 ("Windows Debuggers: Part 1: A WinDbg Tutorial - Commands")
ran AV and Windows Defender in safe mode, no issues.
ran memtest thru 1 pass, no errors.
i will post the call stack at the breakpoint in a few minutes.

do i need to setup a client/server debugging situation in my case?
>>do i need to setup a client/server debugging situation in my case?

No, not necessary, running the debugger on the same machine is fine. Yet the call stack at this location might not necessarily be the one that finally causes the crash. Also try to continue execution to see what happens.
i did the call stack, then continue execution, which i guessed means using GO. then i fired up IE to post this and here is what i got:

0:019> K
ChildEBP RetAddr  
00c9ffc8 7c9507a8 ntdll!DbgBreakPoint
00c9fff4 00000000 ntdll!DbgUiRemoteBreakin+0x2d
0:019> g
ModLoad: 00c90000 00ca2000   C:\WINDOWS\system32\browselc.dll
ModLoad: 44000000 440f9000   C:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
ModLoad: 76820000 76835000   C:\WINDOWS\system32\hlink.dll
ModLoad: 42000000 42118000   C:\Program Files\Pluck Corporation\Pluck\PluckFW.dll
ModLoad: 7c120000 7c139000   C:\Program Files\Pluck Corporation\Pluck\ATL71.DLL
ModLoad: 7c3a0000 7c41b000   C:\Program Files\Pluck Corporation\Pluck\MSVCP71.dll
ModLoad: 7c140000 7c243000   C:\Program Files\Pluck Corporation\Pluck\MFC71.DLL
ModLoad: 67800000 679cb000   C:\Program Files\Pluck Corporation\Pluck\XTP9000Lib.dll
ModLoad: 44000000 440f9000   C:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
ModLoad: 76820000 76835000   C:\WINDOWS\system32\hlink.dll
ModLoad: 42000000 42118000   C:\Program Files\Pluck Corporation\Pluck\PluckFW.dll
ModLoad: 7c120000 7c139000   C:\Program Files\Pluck Corporation\Pluck\ATL71.DLL
ModLoad: 7c3a0000 7c41b000   C:\Program Files\Pluck Corporation\Pluck\MSVCP71.dll
ModLoad: 7c140000 7c243000   C:\Program Files\Pluck Corporation\Pluck\MFC71.DLL
ModLoad: 67800000 679cb000   C:\Program Files\Pluck Corporation\Pluck\XTP9000Lib.dll
ModLoad: 03370000 0349a000   c:\program files\google\googletoolbar2.dll
ModLoad: 03370000 0349a000   c:\program files\google\googletoolbar2.dll
ModLoad: 6c1b0000 6c1fd000   C:\WINDOWS\system32\DUSER.dll
ModLoad: 325c0000 325d2000   C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
ModLoad: 038b0000 03938000   C:\WINDOWS\system32\shdoclc.dll
ModLoad: 75e90000 75f40000   C:\WINDOWS\system32\SXS.DLL
Hm, what else happened then?
0:017> g
ModLoad: 16000000 16028000   C:\Program Files\Trillian\events.dll
ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
ModLoad: 7c340000 7c396000   C:\Program Files\Trillian\MSVCR71.dll
ModLoad: 01a10000 01a22000   C:\WINDOWS\system32\browselc.dll
ModLoad: 44000000 440f9000   C:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
ModLoad: 76820000 76835000   C:\WINDOWS\system32\hlink.dll
ModLoad: 42000000 42118000   C:\Program Files\Pluck Corporation\Pluck\PluckFW.dll
ModLoad: 7c120000 7c139000   C:\Program Files\Pluck Corporation\Pluck\ATL71.DLL
ModLoad: 7c3a0000 7c41b000   C:\Program Files\Pluck Corporation\Pluck\MSVCP71.dll
ModLoad: 7c140000 7c243000   C:\Program Files\Pluck Corporation\Pluck\MFC71.DLL
ModLoad: 67800000 679cb000   C:\Program Files\Pluck Corporation\Pluck\XTP9000Lib.dll
ModLoad: 02f70000 0309a000   c:\program files\google\googletoolbar2.dll
ModLoad: 02a70000 02a8c000   F:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
ModLoad: 6c1b0000 6c1fd000   C:\WINDOWS\system32\DUSER.dll
ModLoad: 325c0000 325d2000   C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
ModLoad: 03220000 032a8000   C:\WINDOWS\system32\shdoclc.dll
ModLoad: 5f800000 5f815000   C:\PROGRA~1\WIFD1F~1\MpShHook.dll
ModLoad: 78130000 781cb000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll
ModLoad: 7c420000 7c4a7000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll
(280.494): C++ EH exception - code e06d7363 (first chance)
ModLoad: 03590000 03597000   C:\Program Files\Logitech\iTouch\kbdhook.dll
(280.494): C++ EH exception - code e06d7363 (first chance)
ModLoad: 035a0000 035c0000   C:\WINDOWS\system32\pgpmn.dll
ModLoad: 035d0000 035fb000   C:\Program Files\WinRAR\rarext.dll
ModLoad: 03a00000 03a5c000   C:\WINDOWS\system32\ShellExtension.dll
ModLoad: 621a0000 621ae000   C:\Program Files\Grisoft\AVG Free\avgse.dll
ModLoad: 7c3a0000 7c41b000   C:\WINDOWS\system32\MSVCP71.dll
(280.494): C++ EH exception - code e06d7363 (first chance)
ModLoad: 44000000 440f9000   C:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
ModLoad: 76820000 76835000   C:\WINDOWS\system32\hlink.dll
ModLoad: 42000000 42118000   C:\Program Files\Pluck Corporation\Pluck\PluckFW.dll
ModLoad: 7c120000 7c139000   C:\Program Files\Pluck Corporation\Pluck\ATL71.DLL
ModLoad: 7c140000 7c243000   C:\Program Files\Pluck Corporation\Pluck\MFC71.DLL
ModLoad: 67800000 679cb000   C:\Program Files\Pluck Corporation\Pluck\XTP9000Lib.dll
ModLoad: 03ae0000 03c0a000   c:\program files\google\googletoolbar2.dll
ModLoad: 73d70000 73d83000   C:\WINDOWS\system32\shgina.dll
ModLoad: 75970000 75a67000   C:\WINDOWS\system32\MSGINA.dll
ModLoad: 74320000 7435d000   C:\WINDOWS\system32\ODBC32.dll
ModLoad: 03d50000 03d67000   C:\WINDOWS\system32\odbcint.dll
ModLoad: 096c0000 0973a000   C:\WINDOWS\system32\Audiodev.dll
ModLoad: 086d0000 08916000   C:\WINDOWS\system32\WMVCore.DLL
ModLoad: 070d0000 0710a000   C:\WINDOWS\system32\WMASF.DLL
ModLoad: 593f0000 59482000   C:\WINDOWS\system32\wiashext.dll
ModLoad: 4ec50000 4edf3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll
ModLoad: 73ba0000 73bb3000   C:\WINDOWS\system32\sti.dll
ModLoad: 74ae0000 74ae7000   C:\WINDOWS\system32\CFGMGR32.dll
ModLoad: 75cf0000 75d81000   C:\WINDOWS\system32\MLANG.dll
ModLoad: 040c0000 0410a000   C:\Program Files\Sony Ericsson\Mobile\File Manager\fmgrgui.dll
ModLoad: 7c080000 7c0f7000   C:\WINDOWS\system32\MSVCP70.dll
ModLoad: 7c000000 7c054000   C:\WINDOWS\system32\MSVCR70.dll
ModLoad: 04120000 04147000   C:\Program Files\Sony Ericsson\Mobile\File Manager\fmgrguil.dll
ModLoad: 73380000 733d7000   C:\WINDOWS\system32\zipfldr.dll
(280.e98): C++ EH exception - code e06d7363 (first chance)
no explorer crash so far.
no crashes for a couple hours. i stopped windbg and i will try to see if it crashes with no debugger attached. if it doesn't, then diskpiepro (contmenu.dll) was the cuplrit.

BUT i have one question still: is explorer.exe supposed to restart once i quit the debugger?
 
thanks
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
thank you jkr. i am going to keep my fingers crossed...
Try to rebuild missing files of windows...

Put the win xp cd in the drive and then:
STERT MENU ->
RUN ->
and write:
sfc -scannow
i agree with the point split but i accidentally gave davexnet the entire 500. thanks
can i do that?
i gave a C grade because davexnet's answer was a guess on his part. it turned out to be the clue i used to solve the crashing problem, but my question was how to attach windbg to explorer.exe

he is not a C level expert, i only thought this time his luck got him the points and a C. which grade should i give him?