Solved

Explorer.exe Application Error

Posted on 2007-12-06
14
1,051 Views
Last Modified: 2008-02-01
Hi Guys,

I have a problem with a newly arrived Dell Laptop.
I just configured it and added it to the domain.
Every time I log off the user or shut down, I am getting an error message:

Explorer.exe - Application error
The instruction at "0x000e3c88" referenced at "0x000e3c88".
The memory could not be written.

The error code changes every time the message appears.

In the Event Viewer I am getting an Application Error:

Faulting application, version 0.0.0.0. faulting module unknown. version 0.0.0.0. fault address 0x00000000.

With a new user profile I also recieve the message.

Do you have any clue how to fix the problem?

Thanks for your help.

0
Comment
Question by:msghaleb
  • 5
  • 4
  • 2
  • +3
14 Comments
 
LVL 32

Expert Comment

by:and235100
ID: 20418337
Try turning off DEP:
http://support.microsoft.com/kb/875352
By adding /AlwaysOff to your boot.ini file.
Does that make any difference?
0
 
LVL 6

Author Comment

by:msghaleb
ID: 20418475
Thanks for your help.

Unfortunately that didn't fix it .
0
 
LVL 32

Expert Comment

by:and235100
ID: 20418534
Run a full AV scan here:
http://housecall.trendmicro.com/

Then, download, install, update and run a full scan:
http://www.superantispyware.com/download.html

This should see if there is a malware issue or not.
0
 

Expert Comment

by:paul0pheter
ID: 20418582
I also experience that problem before, the only things I do is run "Disk Defragmenter",
Hope this solve your problem to.

Regards...
0
 
LVL 9

Expert Comment

by:dreamyguy
ID: 20418649
It could be a third party module HOOKING on to explorer causing explorer to crash. In order for us to find the culprit, we need to know the dll's that are getting loaded under explorer, disable the non microsoft ones and then check whether the issue re-occurs. here's what i want you to do:

Download checksym from https://filedb.experts-exchange.com/incoming/ee-stuff/5055-CheckSym.txt
save it to c:\
go to a command prompt and run the following command from c:\
checksym -p * -r -s > process.txt
i then want you to compress process.txt and upload it to ee-stuff.com so that i can see what dll's are getting loaded under explorer.
0
 
LVL 6

Author Comment

by:msghaleb
ID: 20419893
Hi guys,

regarding to:
------------------------------------------------------------------
Run a full AV scan here:
http://housecall.trendmicro.com/

Then, download, install, update and run a full scan:
http://www.superantispyware.com/download.html

This should see if there is a malware issue or not.
------------------------------------------------------------------

Officescan from trendmicro is installed, didn't find anything

regarding to:
-------------------------------------------------------------------
I also experience that problem before, the only things I do is run "Disk Defragmenter",
Hope this solve your problem to.

Regards...
-------------------------------------------------------------------

this didn't work either


to Dreamyguy:

I have just uploaded the process.txt file with th eQuestion ID

thank you all for your help
0
 
LVL 9

Expert Comment

by:dreamyguy
ID: 20420314
I don't see the file.
here's what i get:

No files found for Question ID 23005438

please upload it again.
0
Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

 
LVL 6

Author Comment

by:msghaleb
ID: 20420529
Ok,

noe it's uploaded.

thanks
0
 
LVL 9

Accepted Solution

by:
dreamyguy earned 500 total points
ID: 20420682
I found the following third party dll's being loaded under explorer.exe

Module[ 31] [C:\WINDOWS\SYSTEM32\WXVAULT.DLL]
  File Description:  wxvault Dynamic Link Library
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 286720
  File Date:         Di Jan 30 16:31:50 2007
  Module has NO symbols!

Module[ 34] [C:\WINDOWS\SYSTEM32\DETOURED.DLL]
  File Size (bytes): 4096
  File Date:         Di Jan 30 16:30:30 2007
    Module TimeDateStamp = 0x45bfaae4 - Tue Jan 30 21:30:28 2007
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x00005000
  Module Pointer to PDB = [c:\cmbuilds\DocMgr_05_06_00_003\svn\DocMgr\src\detours\bin\detoured.pdb]
    Module PDB Guid = {B9EB63AE-E91E-4D95-8F36-5CA1BE51E34A}
    Module PDB Age = 0x2

Module[ 45] [C:\PROGRAM FILES\GOOGLE\GOOGLE DESKTOP SEARCH\GOOGLEDESKTOPDESKBAR2.DLL]
  Company Name:      Google
  File Description:  Google Desktop
  Product Version:   (5.1:708.19688)
  File Version:      (5.1:708.19688)
  File Size (bytes): 168448
  File Date:         Mi Nov 21 22:08:56 2007
    Module TimeDateStamp = 0x46c937da - Mon Aug 20 08:42:34 2007
    Module Checksum      = 0x00035867
    Module SizeOfImage   = 0x0002d000
  Module Pointer to PDB = [C:\src\googleclient\total_recall_r51_blr\build\release\obj\ui\deskband\GoogleDesktopDeskbar2.pdb]
    Module PDB Guid = {870F4608-FBB8-4E11-934D-54A1F8116B1D}
    Module PDB Age = 0xc

Module[ 47] [C:\PROGRAM FILES\GOOGLE\GOOGLE DESKTOP SEARCH\GOOGLEDESKTOPRESOURCES_EN_GB.DLL]
  Company Name:      Google
  File Description:  Google Desktop
  Product Version:   (5.1:708.19688)
  File Version:      (5.1:708.19688)
  File Size (bytes): 506880
  File Date:         Mi Nov 21 22:08:55 2007
    Module TimeDateStamp = 0x46c93826 - Mon Aug 20 08:43:50 2007
    Module Checksum      = 0x00084307
    Module SizeOfImage   = 0x00080000
  Module Pointer to PDB = [C:\src\googleclient\total_recall_r51_blr\build\release\obj\resource\en_gb\GoogleDesktopResources_en_gb.pdb]
    Module PDB Guid = {0C6239A1-5C9D-4342-93A5-3B4F4689D226}
    Module PDB Age = 0x1


Module[ 96] [C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\ACTIVEX\PDFSHELL.DLL]
  Company Name:      Adobe Systems, Inc.
  File Description:  PDF Shell Extension
  Product Version:   (8.0:0.0)
  File Version:      (8.0:0.0)
  File Size (bytes): 372736
  File Date:         So Okt 22 23:28:04 2006
    Module TimeDateStamp = 0x453c6f04 - Mon Oct 23 09:28:04 2006
    Module Checksum      = 0x0005d45d
    Module SizeOfImage   = 0x0005b000
  Module Pointer to PDB = [g:\Acro_root_at\Acrobat\Viewer\Win\output\acrobat\PDFShell.pdb]
    Module PDB Guid = {B02BEA5B-7806-4684-B414-5B8010B193D2}
    Module PDB Age = 0x1

Module[ 98] [C:\PROGRAM FILES\DELL\QUICKSET\DADKEYB.DLL]
  File Size (bytes): 98304
  File Date:         Fr Jul 20 17:56:14 2007
  Module has NO symbols!

Module[100] [C:\WINDOWS\SYSTEM32\TOSBTSHELL.DLL]
  Company Name:      TOSHIBA
  File Description:  TosBtShell
  Product Version:   (1.2:8.0)
  File Version:      (1.2:8.0)
  File Size (bytes): 548864
  File Date:         Fr Sep 02 17:19:50 2005
  Module has NO symbols!

Module[102] [C:\PROGRAM FILES\WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR\BIN\CONTEXTMENUITEM.DLL]
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 143360
  File Date:         Di Jan 30 16:32:50 2007
  Module has NO symbols!

Module[103] [C:\PROGRAM FILES\WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR\BIN\VAULTSERVER.DLL]
  Company Name:      Wave Systems Corp
  File Description:  VaultServer Dynamic Link Library
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 552960
  File Date:         Di Jan 30 16:32:06 2007
    Module TimeDateStamp = 0x45bfab43 - Tue Jan 30 21:32:03 2007
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x00088000
  Module Pointer to PDB = [c:\cmbuilds\DocMgr_05_06_00_003\svn\DocMgr\src\VaultServer\Release\VaultServer.pdb]
    Module PDB Guid = {47C5BB52-19CA-4F95-B8F4-9BE0174EAE92}
    Module PDB Age = 0x1


Module[107] [C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\ACTIVEX\ACROIEHELPER.DLL]
  Company Name:      Adobe Systems Incorporated
  File Description:  Adobe PDF Helper for Internet Explorer
  Product Version:   (8.0:0.456)
  File Version:      (8.0:0.456)
  File Size (bytes): 62080
  File Date:         So Okt 22 23:08:42 2006
    Module TimeDateStamp = 0x453c6a72 - Mon Oct 23 09:08:34 2006
    Module Checksum      = 0x00012b70
    Module SizeOfImage   = 0x00010000
  Module Pointer to PDB = [g:\Acro_root_at\Plugins\AcroIEHelper\win\32\Release\AcroIEHelper.pdb]
    Module PDB Guid = {92519C5D-06C7-4AAA-A0E2-790036F06C29}
    Module PDB Age = 0x1

Module[110] [C:\WINDOWS\SYSTEM32\IGFXPPH.DLL]
  Company Name:      Intel Corporation
  File Description:  igfxpph Module
  Product Version:   (6.14:10.4831)
  File Version:      (6.14:10.4831)
  File Size (bytes): 200704
  File Date:         Fr Mai 18 12:45:34 2007
  Module has NO symbols!

Module[112] [C:\PROGRAM FILES\ROXIO\DRAG-TO-DISC\SHELLEX.DLL]
  Company Name:      Roxio
  File Description:  DirectCD Shell Extention DLL
  Product Version:   (9.0:0.53)
  File Version:      (9.0:0.53)
  File Size (bytes): 367352
  File Date:         Do Aug 17 10:00:00 2006
  Module has NO symbols!

Module[113] [C:\WINDOWS\SYSTEM32\DLAAPI_W.DLL]
  File Size (bytes): 56056
  File Date:         Fr Aug 18 14:17:36 2006
    Module TimeDateStamp = 0x44e61f97 - Fri Aug 18 22:14:15 2006
    Module Checksum      = 0x0000efb4
    Module SizeOfImage   = 0x0000c000
  Module Pointer to PDB = [D:\build\TFSREL90\CODE\TFS\RUN\DLAAPI_W.pdb]
    Module PDB Guid = {C898D110-BCF3-43B4-AC74-C80D36B553CD}
    Module PDB Age = 0x1

Module[114] [C:\WINDOWS\SYSTEM32\CDRTC.DLL]
  Company Name:      Sonic Solutions
  File Description:  Roxio CDR4VSD support DLL
  Product Version:   (9.0:1.6)
  File Version:      (9.0:1.6)
  File Size (bytes): 106496
  File Date:         So Jul 30 20:01:32 2006
    Module TimeDateStamp = 0x44cd647a - Mon Jul 31 04:01:30 2006
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x0001f000
  Module Pointer to PDB = [d:\Build\Cdrlayer\Code\Source\lib\cdrtc\src\Release\cdrtc.pdb]
    Module PDB Guid = {D1ACD824-672F-4139-9E48-85C1F843BD80}
    Module PDB Age = 0x1

Module[115] [C:\PROGRAM FILES\ROXIO\DRAG-TO-DISC\SHELLRES.DLL]
  Company Name:      Roxio
  File Description:  DirectCD Shell Extention DLL
  Product Version:   (9.0:0.53)
  File Version:      (9.0:0.53)
  File Size (bytes): 154360
  File Date:         Do Aug 17 10:00:00 2006
    Module TimeDateStamp = 0x44e48a10 - Thu Aug 17 17:24:00 2006
    Module Checksum      = 0x00033920
    Module SizeOfImage   = 0x00025000
  Module Pointer to PDB = [d:\build\Dragtodiscrel90\Code\Source\core\applications\D2DShellEx\BIN\I386\ENU\ShellRES_ENU.pdb]
    Module PDB Guid = {CCE76F13-DF74-4E13-9974-D88876C6F324}
    Module PDB Age = 0x1

Module[116] [C:\WINDOWS\SYSTEM32\TOSBTEXT.DLL]
  Company Name:      TOSHIBA
  File Description:  TosBtExt
  Product Version:   (5.0:2213.0)
  File Version:      (5.0:2213.0)
  File Size (bytes): 1863680
  File Date:         Fr Okt 13 20:44:56 2006
  Module has NO symbols!

Now it could be any of the above that may be causing the issue.
The only way of finding out is to disable the above one by one as a test and reboot the machine to see whether the issue re-occurs.

Lets start by renaming TOSBTEXT.DLL and TOSBTSHELL.DLL to TOSBTEXT.DL_ and TOSBTSHELL.DL_ respectively and then reboot the machine to see if the issue exists and report back.
0
 
LVL 6

Author Comment

by:msghaleb
ID: 20420901
hi,

I did this, i did't work unfortunately
0
 
LVL 9

Expert Comment

by:dreamyguy
ID: 20421241
alright, rename those dll's back to the way they were originally and now let's rename DADKEYB.DLL and WXVAULT.DLL to DADKEYB.DL_ and WXVAULT.DL_ respectively and reboot to check if the issue re-occurs

If still no success then uninstall the WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR application, reboot the machine and check whether the issue exists.
0
 
LVL 9

Expert Comment

by:dreamyguy
ID: 20421260
i also want u to search the machine for *.dmp files.
if you do find any .dmp files then compress them to .zip and then upload them to www.ee-stuff.com

http://www.memecode.com/docs/minidump.php
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20423653
Also, download and open Dial-a-fix (http://djlizard.net/software/Dial-a-fix-v0.60.0.24.zip), check all checkboxes under "Registration center", and click "GO". Also, send us your HijackThis (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) log.
0
 
LVL 1

Expert Comment

by:GaryScott
ID: 22764524
I just searched for igfxpph.dll on my PC. Found it in C:\windows\system32.
I unregistered it by using the following command.

regsvr32 /u c:\windows\system32\igfxpph.dll
It's working.

0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of: 192.168.0.1, 192.168.1.1, 192.168.11.1, …
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now