• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1092
  • Last Modified:

Explorer.exe Application Error

Hi Guys,

I have a problem with a newly arrived Dell Laptop.
I just configured it and added it to the domain.
Every time I log off the user or shut down, I am getting an error message:

Explorer.exe - Application error
The instruction at "0x000e3c88" referenced at "0x000e3c88".
The memory could not be written.

The error code changes every time the message appears.

In the Event Viewer I am getting an Application Error:

Faulting application, version 0.0.0.0. faulting module unknown. version 0.0.0.0. fault address 0x00000000.

With a new user profile I also recieve the message.

Do you have any clue how to fix the problem?

Thanks for your help.

0
msghaleb
Asked:
msghaleb
  • 5
  • 4
  • 2
  • +3
1 Solution
 
and235100Commented:
Try turning off DEP:
http://support.microsoft.com/kb/875352
By adding /AlwaysOff to your boot.ini file.
Does that make any difference?
0
 
msghalebAuthor Commented:
Thanks for your help.

Unfortunately that didn't fix it .
0
 
and235100Commented:
Run a full AV scan here:
http://housecall.trendmicro.com/

Then, download, install, update and run a full scan:
http://www.superantispyware.com/download.html

This should see if there is a malware issue or not.
0
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

 
paul0pheterCommented:
I also experience that problem before, the only things I do is run "Disk Defragmenter",
Hope this solve your problem to.

Regards...
0
 
dreamyguyCommented:
It could be a third party module HOOKING on to explorer causing explorer to crash. In order for us to find the culprit, we need to know the dll's that are getting loaded under explorer, disable the non microsoft ones and then check whether the issue re-occurs. here's what i want you to do:

Download checksym from https://filedb.experts-exchange.com/incoming/ee-stuff/5055-CheckSym.txt 
save it to c:\
go to a command prompt and run the following command from c:\
checksym -p * -r -s > process.txt
i then want you to compress process.txt and upload it to ee-stuff.com so that i can see what dll's are getting loaded under explorer.
0
 
msghalebAuthor Commented:
Hi guys,

regarding to:
------------------------------------------------------------------
Run a full AV scan here:
http://housecall.trendmicro.com/

Then, download, install, update and run a full scan:
http://www.superantispyware.com/download.html

This should see if there is a malware issue or not.
------------------------------------------------------------------

Officescan from trendmicro is installed, didn't find anything

regarding to:
-------------------------------------------------------------------
I also experience that problem before, the only things I do is run "Disk Defragmenter",
Hope this solve your problem to.

Regards...
-------------------------------------------------------------------

this didn't work either


to Dreamyguy:

I have just uploaded the process.txt file with th eQuestion ID

thank you all for your help
0
 
dreamyguyCommented:
I don't see the file.
here's what i get:

No files found for Question ID 23005438

please upload it again.
0
 
msghalebAuthor Commented:
Ok,

noe it's uploaded.

thanks
0
 
dreamyguyCommented:
I found the following third party dll's being loaded under explorer.exe

Module[ 31] [C:\WINDOWS\SYSTEM32\WXVAULT.DLL]
  File Description:  wxvault Dynamic Link Library
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 286720
  File Date:         Di Jan 30 16:31:50 2007
  Module has NO symbols!

Module[ 34] [C:\WINDOWS\SYSTEM32\DETOURED.DLL]
  File Size (bytes): 4096
  File Date:         Di Jan 30 16:30:30 2007
    Module TimeDateStamp = 0x45bfaae4 - Tue Jan 30 21:30:28 2007
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x00005000
  Module Pointer to PDB = [c:\cmbuilds\DocMgr_05_06_00_003\svn\DocMgr\src\detours\bin\detoured.pdb]
    Module PDB Guid = {B9EB63AE-E91E-4D95-8F36-5CA1BE51E34A}
    Module PDB Age = 0x2

Module[ 45] [C:\PROGRAM FILES\GOOGLE\GOOGLE DESKTOP SEARCH\GOOGLEDESKTOPDESKBAR2.DLL]
  Company Name:      Google
  File Description:  Google Desktop
  Product Version:   (5.1:708.19688)
  File Version:      (5.1:708.19688)
  File Size (bytes): 168448
  File Date:         Mi Nov 21 22:08:56 2007
    Module TimeDateStamp = 0x46c937da - Mon Aug 20 08:42:34 2007
    Module Checksum      = 0x00035867
    Module SizeOfImage   = 0x0002d000
  Module Pointer to PDB = [C:\src\googleclient\total_recall_r51_blr\build\release\obj\ui\deskband\GoogleDesktopDeskbar2.pdb]
    Module PDB Guid = {870F4608-FBB8-4E11-934D-54A1F8116B1D}
    Module PDB Age = 0xc

Module[ 47] [C:\PROGRAM FILES\GOOGLE\GOOGLE DESKTOP SEARCH\GOOGLEDESKTOPRESOURCES_EN_GB.DLL]
  Company Name:      Google
  File Description:  Google Desktop
  Product Version:   (5.1:708.19688)
  File Version:      (5.1:708.19688)
  File Size (bytes): 506880
  File Date:         Mi Nov 21 22:08:55 2007
    Module TimeDateStamp = 0x46c93826 - Mon Aug 20 08:43:50 2007
    Module Checksum      = 0x00084307
    Module SizeOfImage   = 0x00080000
  Module Pointer to PDB = [C:\src\googleclient\total_recall_r51_blr\build\release\obj\resource\en_gb\GoogleDesktopResources_en_gb.pdb]
    Module PDB Guid = {0C6239A1-5C9D-4342-93A5-3B4F4689D226}
    Module PDB Age = 0x1


Module[ 96] [C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\ACTIVEX\PDFSHELL.DLL]
  Company Name:      Adobe Systems, Inc.
  File Description:  PDF Shell Extension
  Product Version:   (8.0:0.0)
  File Version:      (8.0:0.0)
  File Size (bytes): 372736
  File Date:         So Okt 22 23:28:04 2006
    Module TimeDateStamp = 0x453c6f04 - Mon Oct 23 09:28:04 2006
    Module Checksum      = 0x0005d45d
    Module SizeOfImage   = 0x0005b000
  Module Pointer to PDB = [g:\Acro_root_at\Acrobat\Viewer\Win\output\acrobat\PDFShell.pdb]
    Module PDB Guid = {B02BEA5B-7806-4684-B414-5B8010B193D2}
    Module PDB Age = 0x1

Module[ 98] [C:\PROGRAM FILES\DELL\QUICKSET\DADKEYB.DLL]
  File Size (bytes): 98304
  File Date:         Fr Jul 20 17:56:14 2007
  Module has NO symbols!

Module[100] [C:\WINDOWS\SYSTEM32\TOSBTSHELL.DLL]
  Company Name:      TOSHIBA
  File Description:  TosBtShell
  Product Version:   (1.2:8.0)
  File Version:      (1.2:8.0)
  File Size (bytes): 548864
  File Date:         Fr Sep 02 17:19:50 2005
  Module has NO symbols!

Module[102] [C:\PROGRAM FILES\WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR\BIN\CONTEXTMENUITEM.DLL]
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 143360
  File Date:         Di Jan 30 16:32:50 2007
  Module has NO symbols!

Module[103] [C:\PROGRAM FILES\WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR\BIN\VAULTSERVER.DLL]
  Company Name:      Wave Systems Corp
  File Description:  VaultServer Dynamic Link Library
  Product Version:   (5.6:0.3)
  File Version:      (5.6:0.3)
  File Size (bytes): 552960
  File Date:         Di Jan 30 16:32:06 2007
    Module TimeDateStamp = 0x45bfab43 - Tue Jan 30 21:32:03 2007
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x00088000
  Module Pointer to PDB = [c:\cmbuilds\DocMgr_05_06_00_003\svn\DocMgr\src\VaultServer\Release\VaultServer.pdb]
    Module PDB Guid = {47C5BB52-19CA-4F95-B8F4-9BE0174EAE92}
    Module PDB Age = 0x1


Module[107] [C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\ACTIVEX\ACROIEHELPER.DLL]
  Company Name:      Adobe Systems Incorporated
  File Description:  Adobe PDF Helper for Internet Explorer
  Product Version:   (8.0:0.456)
  File Version:      (8.0:0.456)
  File Size (bytes): 62080
  File Date:         So Okt 22 23:08:42 2006
    Module TimeDateStamp = 0x453c6a72 - Mon Oct 23 09:08:34 2006
    Module Checksum      = 0x00012b70
    Module SizeOfImage   = 0x00010000
  Module Pointer to PDB = [g:\Acro_root_at\Plugins\AcroIEHelper\win\32\Release\AcroIEHelper.pdb]
    Module PDB Guid = {92519C5D-06C7-4AAA-A0E2-790036F06C29}
    Module PDB Age = 0x1

Module[110] [C:\WINDOWS\SYSTEM32\IGFXPPH.DLL]
  Company Name:      Intel Corporation
  File Description:  igfxpph Module
  Product Version:   (6.14:10.4831)
  File Version:      (6.14:10.4831)
  File Size (bytes): 200704
  File Date:         Fr Mai 18 12:45:34 2007
  Module has NO symbols!

Module[112] [C:\PROGRAM FILES\ROXIO\DRAG-TO-DISC\SHELLEX.DLL]
  Company Name:      Roxio
  File Description:  DirectCD Shell Extention DLL
  Product Version:   (9.0:0.53)
  File Version:      (9.0:0.53)
  File Size (bytes): 367352
  File Date:         Do Aug 17 10:00:00 2006
  Module has NO symbols!

Module[113] [C:\WINDOWS\SYSTEM32\DLAAPI_W.DLL]
  File Size (bytes): 56056
  File Date:         Fr Aug 18 14:17:36 2006
    Module TimeDateStamp = 0x44e61f97 - Fri Aug 18 22:14:15 2006
    Module Checksum      = 0x0000efb4
    Module SizeOfImage   = 0x0000c000
  Module Pointer to PDB = [D:\build\TFSREL90\CODE\TFS\RUN\DLAAPI_W.pdb]
    Module PDB Guid = {C898D110-BCF3-43B4-AC74-C80D36B553CD}
    Module PDB Age = 0x1

Module[114] [C:\WINDOWS\SYSTEM32\CDRTC.DLL]
  Company Name:      Sonic Solutions
  File Description:  Roxio CDR4VSD support DLL
  Product Version:   (9.0:1.6)
  File Version:      (9.0:1.6)
  File Size (bytes): 106496
  File Date:         So Jul 30 20:01:32 2006
    Module TimeDateStamp = 0x44cd647a - Mon Jul 31 04:01:30 2006
    Module Checksum      = 0x00000000
    Module SizeOfImage   = 0x0001f000
  Module Pointer to PDB = [d:\Build\Cdrlayer\Code\Source\lib\cdrtc\src\Release\cdrtc.pdb]
    Module PDB Guid = {D1ACD824-672F-4139-9E48-85C1F843BD80}
    Module PDB Age = 0x1

Module[115] [C:\PROGRAM FILES\ROXIO\DRAG-TO-DISC\SHELLRES.DLL]
  Company Name:      Roxio
  File Description:  DirectCD Shell Extention DLL
  Product Version:   (9.0:0.53)
  File Version:      (9.0:0.53)
  File Size (bytes): 154360
  File Date:         Do Aug 17 10:00:00 2006
    Module TimeDateStamp = 0x44e48a10 - Thu Aug 17 17:24:00 2006
    Module Checksum      = 0x00033920
    Module SizeOfImage   = 0x00025000
  Module Pointer to PDB = [d:\build\Dragtodiscrel90\Code\Source\core\applications\D2DShellEx\BIN\I386\ENU\ShellRES_ENU.pdb]
    Module PDB Guid = {CCE76F13-DF74-4E13-9974-D88876C6F324}
    Module PDB Age = 0x1

Module[116] [C:\WINDOWS\SYSTEM32\TOSBTEXT.DLL]
  Company Name:      TOSHIBA
  File Description:  TosBtExt
  Product Version:   (5.0:2213.0)
  File Version:      (5.0:2213.0)
  File Size (bytes): 1863680
  File Date:         Fr Okt 13 20:44:56 2006
  Module has NO symbols!

Now it could be any of the above that may be causing the issue.
The only way of finding out is to disable the above one by one as a test and reboot the machine to see whether the issue re-occurs.

Lets start by renaming TOSBTEXT.DLL and TOSBTSHELL.DLL to TOSBTEXT.DL_ and TOSBTSHELL.DL_ respectively and then reboot the machine to see if the issue exists and report back.
0
 
msghalebAuthor Commented:
hi,

I did this, i did't work unfortunately
0
 
dreamyguyCommented:
alright, rename those dll's back to the way they were originally and now let's rename DADKEYB.DLL and WXVAULT.DLL to DADKEYB.DL_ and WXVAULT.DL_ respectively and reboot to check if the issue re-occurs

If still no success then uninstall the WAVE SYSTEMS CORP\SERVICES MANAGER\DOCMGR application, reboot the machine and check whether the issue exists.
0
 
dreamyguyCommented:
i also want u to search the machine for *.dmp files.
if you do find any .dmp files then compress them to .zip and then upload them to www.ee-stuff.com

http://www.memecode.com/docs/minidump.php
0
 
orangutangCommented:
Also, download and open Dial-a-fix (http://djlizard.net/software/Dial-a-fix-v0.60.0.24.zip), check all checkboxes under "Registration center", and click "GO". Also, send us your HijackThis (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) log.
0
 
GaryScottCommented:
I just searched for igfxpph.dll on my PC. Found it in C:\windows\system32.
I unregistered it by using the following command.

regsvr32 /u c:\windows\system32\igfxpph.dll
It's working.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

  • 5
  • 4
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now