R
Roßert G. Schaffrath
This is a good one and has been stymieing me for almost two months now.
I have been suffering from random crashes of Windows Explorer under
Windows XP Home SP2. When it does happen, it always occurs when I open
up a folder and the icons in the folder contents are refreshing though
there are times the icons and refresh and no crash occurs. If I open a
folder and the icons are not refreshing at all there is no crash.
Through I combination of Eventvwr and DrWtsn32 I have found the problem
to be occurring consistently in urlmon.dll in CoInternetQueryInfo. The
relevant information from Eventvwr and DrWtsn32 is below and is
consistent. I have scanned for viruses and trojans and have come up
clean. I have run "sfc /scannow" and no problems have been found. I am
suspecting some kind of registry issue or version mismatch but without
the source code to urlmon.dll, I cannot begin to figure out what is
causing CoInternetQueryInfo to die. From the CoInternetQueryInfo
documentation I would suspect it is a problem with either the "pvBuffer"
or "pcbBuffer" argument but that is just a guess on my part. Obviously
CoInternetQueryInfo is not happy with whatever Explorer.exe is providing it.
Any suggestions would be appreciated. I am planning on upgrading to SP3
at some point, hoping that would fix it, but have held off because I
have a Compaq PC with AMD processor and it did have the HP Intel image
issue that I have since patched.
These are the diagnostic dumps:
Faulting application explorer.exe, version 6.0.2900.3156, faulting
module urlmon.dll, version 7.0.6000.16762, fault address 0x00007376.
Fault bucket 1054110729.
eax=04374268 ebx=00129788 ecx=0436dc2c edx=000a200c esi=00000000
edi=0436dc44
eip=78137376 esp=0436d788 ebp=0436dbd8 iopl=0 nv up ei pl nz na
pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\urlmon.dll -
function: urlmon!CoInternetQueryInfo
7813735c 40 inc eax
7813735d 0433 add al,0x33
7813735f f63b idiv byte ptr [ebx]
78137361 c60f84 mov byte ptr [edi],0x84
78137364 1cca sbb al,0xca
78137366 0300 add eax,[eax]
78137368 8b8dc4fbffff mov ecx,[ebp-0x43c]
7813736e 8901 mov [ecx],eax
78137370 8b4328 mov eax,[ebx+0x28]
78137373 8b4004 mov eax,[eax+0x4]
FAULT ->78137376 8b08 mov ecx,[eax]
ds:0023:04374268=????????
78137378 50 push eax
78137379 ff5104 call dword ptr [ecx+0x4]
7813737c 89b5d4fbffff mov [ebp-0x42c],esi
78137382 8b4328 mov eax,[ebx+0x28]
78137385 8b4018 mov eax,[eax+0x18]
78137388 894328 mov [ebx+0x28],eax
7813738b ffb5c0fbffff push dword ptr [ebp-0x440]
78137391 ff1580171378 call dword ptr
[urlmon!Ordinal230+0x1780 (78131780)]
78137397 8b4dfc mov ecx,[ebp-0x4]
7813739a 8b85d4fbffff mov eax,[ebp-0x42c]
*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\ieframe.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\BROWSEUI.dll -
ChildEBP RetAddr Args to Child
0436dbd8 7813729a 00129788 0436dc44 0436dc2c
urlmon!CoInternetQueryInfo+0x5d0
0436dbfc 7813e428 00129750 0436dc44 0436dc2c
urlmon!CoInternetQueryInfo+0x4f4
0436dc88 7813e56a 00129750 0436df68 0436dca0
urlmon!RevokeBindStatusCallback+0x13a6
0436dca4 7813e52f 00129754 0436df68 0000000c
urlmon!RevokeBindStatusCallback+0x14e8
0436dcdc 42f78fee 0436df68 0000000c 00000000
urlmon!RevokeBindStatusCallback+0x14ad
0436df24 42f78f45 0407f680 0436df68 00000001
ieframe!SoftwareUpdateMessageBox+0x215a
0436f3c4 42f78dbc 0436f570 00000001 0436f43c
ieframe!SoftwareUpdateMessageBox+0x20b1
0436f3e8 7c9fef31 0407f68c 0436f570 00000001
ieframe!SoftwareUpdateMessageBox+0x1f28
0436f410 7c9fedfa 0407f68c 0436f570 00000001 SHELL32!SHExtractIconsW+0x62d
0436f77c 7c9f633a 0407f68c 00000000 040875f8 SHELL32!SHExtractIconsW+0x4f6
0436f7a4 7c9f50db 02897f70 0407f68c 040875f8
SHELL32!Shell_GetImageLists+0xaa
0436fe20 7c9fb558 02897f74 040875f8 00000000 SHELL32!Ordinal646+0x224e
0436fe40 7c9fef8c 02897f70 02897f74 040875f8
SHELL32!SHCreateShellFolderView+0x24f6
0436fe68 7c9f2275 0016b428 03f5fdf8 04b08d98 SHELL32!SHExtractIconsW+0x688
0436fe84 75f81b9a 0016b428 75f81b18 75f80000 SHELL32!ILFindChild+0x54c
0436fee0 77f69548 03f390c8 03f35cf8 77f6952b BROWSEUI!Ordinal113+0x1b9a
0436fef8 7c927545 03f35cf8 7c97c3a0 028d1fc0 SHLWAPI!Ordinal120+0xbf
0436ff40 7c927583 77f6952b 03f35cf8 00000000
ntdll!RtlUpcaseUnicodeString+0x159
0436ff60 7c927645 00000000 03f35cf8 028d1fc0
ntdll!RtlUpcaseUnicodeString+0x197
0436ff74 7c92761c 7c927569 00000000 03f35cf8
ntdll!RtlUpcaseUnicodeString+0x259
0436ffb4 7c80b683 00000000 0365f87c 0365f87c
ntdll!RtlUpcaseUnicodeString+0x230
0436ffec 00000000 7c910760 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
*----> Raw Stack Dump <----*
000000000436d788 50 97 12 00 28 dc 36 04 - 0d 00 0c 80 c8 d7 36 04
P...(.6.......6.
000000000436d798 94 97 12 00 2c dc 36 04 - 34 dc 36 04 a8 10 09 00
.....,.6.4.6.....
000000000436d7a8 00 00 09 00 0d 00 0c 80 - a0 d7 36 04 01 00 00 00
...........6.....
000000000436d7b8 e4 d9 36 04 18 ee 90 7c - 38 07 91 7c ff ff ff ff
...6....|8..|....
000000000436d7c8 32 07 91 7c ab 06 91 7c - eb 06 91 7c 90 dc 36 04
2..|...|...|..6.
000000000436d7d8 a8 01 00 00 34 00 00 c0 - 78 dc 36 04 60 dc 36 04
.....4...x.6.`.6.
000000000436d7e8 66 3b c4 77 39 00 91 7c - e0 dc 36 04 0e 00 00 00
f;.w9..|..6.....
000000000436d7f8 ef 3b c4 77 c8 d8 36 04 - 51 05 91 7c 14 d8 36 04
..;.w..6.Q..|..6.
000000000436d808 00 00 00 00 c8 05 91 7c - 10 f2 07 04 e0 d8 36 04
........|......6.
000000000436d818 51 05 91 7c 2c d8 36 04 - 00 00 00 00 c8 05 91 7c
Q..|,.6........|
000000000436d828 10 f2 07 04 f8 d8 36 04 - 51 05 91 7c d8 0a 09 00
.......6.Q..|....
000000000436d838 6d 05 91 7c 30 d9 36 04 - 8c d9 36 04 34 00 00 c0
m..|0.6...6.4...
000000000436d848 d6 34 91 7c 18 d9 36 04 - 1e 00 00 00 00 00 00 00
..4.|..6.........
000000000436d858 18 f2 07 04 18 f2 07 04 - d6 34 91 7c 30 d9 36 04
..........4.|0.6.
000000000436d868 1e 00 00 00 98 d8 36 04 - 8f 4d 91 7c 18 f2 07 04
.......6..M.|....
000000000436d878 88 d8 36 04 00 00 00 00 - c8 05 91 7c a0 cb 16 00
...6........|....
000000000436d888 54 d9 36 04 51 05 91 7c - a8 10 09 00 6d 05 91 7c
T.6.Q..|....m..|
000000000436d898 18 00 00 00 40 00 00 00 - 34 00 00 c0 00 00 00 00
[email protected].......
000000000436d8a8 18 00 00 00 8c d9 36 04 - 1a 4f 91 7c 24 00 00 00
.......6..O.|$...
000000000436d8b8 5c 00 8a 00 f0 d8 36 04 - 00 00 09 00 32 07 91 7c
\.....6.....2..|
I have been suffering from random crashes of Windows Explorer under
Windows XP Home SP2. When it does happen, it always occurs when I open
up a folder and the icons in the folder contents are refreshing though
there are times the icons and refresh and no crash occurs. If I open a
folder and the icons are not refreshing at all there is no crash.
Through I combination of Eventvwr and DrWtsn32 I have found the problem
to be occurring consistently in urlmon.dll in CoInternetQueryInfo. The
relevant information from Eventvwr and DrWtsn32 is below and is
consistent. I have scanned for viruses and trojans and have come up
clean. I have run "sfc /scannow" and no problems have been found. I am
suspecting some kind of registry issue or version mismatch but without
the source code to urlmon.dll, I cannot begin to figure out what is
causing CoInternetQueryInfo to die. From the CoInternetQueryInfo
documentation I would suspect it is a problem with either the "pvBuffer"
or "pcbBuffer" argument but that is just a guess on my part. Obviously
CoInternetQueryInfo is not happy with whatever Explorer.exe is providing it.
Any suggestions would be appreciated. I am planning on upgrading to SP3
at some point, hoping that would fix it, but have held off because I
have a Compaq PC with AMD processor and it did have the HP Intel image
issue that I have since patched.
These are the diagnostic dumps:
Faulting application explorer.exe, version 6.0.2900.3156, faulting
module urlmon.dll, version 7.0.6000.16762, fault address 0x00007376.
Fault bucket 1054110729.
eax=04374268 ebx=00129788 ecx=0436dc2c edx=000a200c esi=00000000
edi=0436dc44
eip=78137376 esp=0436d788 ebp=0436dbd8 iopl=0 nv up ei pl nz na
pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\urlmon.dll -
function: urlmon!CoInternetQueryInfo
7813735c 40 inc eax
7813735d 0433 add al,0x33
7813735f f63b idiv byte ptr [ebx]
78137361 c60f84 mov byte ptr [edi],0x84
78137364 1cca sbb al,0xca
78137366 0300 add eax,[eax]
78137368 8b8dc4fbffff mov ecx,[ebp-0x43c]
7813736e 8901 mov [ecx],eax
78137370 8b4328 mov eax,[ebx+0x28]
78137373 8b4004 mov eax,[eax+0x4]
FAULT ->78137376 8b08 mov ecx,[eax]
ds:0023:04374268=????????
78137378 50 push eax
78137379 ff5104 call dword ptr [ecx+0x4]
7813737c 89b5d4fbffff mov [ebp-0x42c],esi
78137382 8b4328 mov eax,[ebx+0x28]
78137385 8b4018 mov eax,[eax+0x18]
78137388 894328 mov [ebx+0x28],eax
7813738b ffb5c0fbffff push dword ptr [ebp-0x440]
78137391 ff1580171378 call dword ptr
[urlmon!Ordinal230+0x1780 (78131780)]
78137397 8b4dfc mov ecx,[ebp-0x4]
7813739a 8b85d4fbffff mov eax,[ebp-0x42c]
*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\ieframe.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\windows\system32\BROWSEUI.dll -
ChildEBP RetAddr Args to Child
0436dbd8 7813729a 00129788 0436dc44 0436dc2c
urlmon!CoInternetQueryInfo+0x5d0
0436dbfc 7813e428 00129750 0436dc44 0436dc2c
urlmon!CoInternetQueryInfo+0x4f4
0436dc88 7813e56a 00129750 0436df68 0436dca0
urlmon!RevokeBindStatusCallback+0x13a6
0436dca4 7813e52f 00129754 0436df68 0000000c
urlmon!RevokeBindStatusCallback+0x14e8
0436dcdc 42f78fee 0436df68 0000000c 00000000
urlmon!RevokeBindStatusCallback+0x14ad
0436df24 42f78f45 0407f680 0436df68 00000001
ieframe!SoftwareUpdateMessageBox+0x215a
0436f3c4 42f78dbc 0436f570 00000001 0436f43c
ieframe!SoftwareUpdateMessageBox+0x20b1
0436f3e8 7c9fef31 0407f68c 0436f570 00000001
ieframe!SoftwareUpdateMessageBox+0x1f28
0436f410 7c9fedfa 0407f68c 0436f570 00000001 SHELL32!SHExtractIconsW+0x62d
0436f77c 7c9f633a 0407f68c 00000000 040875f8 SHELL32!SHExtractIconsW+0x4f6
0436f7a4 7c9f50db 02897f70 0407f68c 040875f8
SHELL32!Shell_GetImageLists+0xaa
0436fe20 7c9fb558 02897f74 040875f8 00000000 SHELL32!Ordinal646+0x224e
0436fe40 7c9fef8c 02897f70 02897f74 040875f8
SHELL32!SHCreateShellFolderView+0x24f6
0436fe68 7c9f2275 0016b428 03f5fdf8 04b08d98 SHELL32!SHExtractIconsW+0x688
0436fe84 75f81b9a 0016b428 75f81b18 75f80000 SHELL32!ILFindChild+0x54c
0436fee0 77f69548 03f390c8 03f35cf8 77f6952b BROWSEUI!Ordinal113+0x1b9a
0436fef8 7c927545 03f35cf8 7c97c3a0 028d1fc0 SHLWAPI!Ordinal120+0xbf
0436ff40 7c927583 77f6952b 03f35cf8 00000000
ntdll!RtlUpcaseUnicodeString+0x159
0436ff60 7c927645 00000000 03f35cf8 028d1fc0
ntdll!RtlUpcaseUnicodeString+0x197
0436ff74 7c92761c 7c927569 00000000 03f35cf8
ntdll!RtlUpcaseUnicodeString+0x259
0436ffb4 7c80b683 00000000 0365f87c 0365f87c
ntdll!RtlUpcaseUnicodeString+0x230
0436ffec 00000000 7c910760 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
*----> Raw Stack Dump <----*
000000000436d788 50 97 12 00 28 dc 36 04 - 0d 00 0c 80 c8 d7 36 04
P...(.6.......6.
000000000436d798 94 97 12 00 2c dc 36 04 - 34 dc 36 04 a8 10 09 00
.....,.6.4.6.....
000000000436d7a8 00 00 09 00 0d 00 0c 80 - a0 d7 36 04 01 00 00 00
...........6.....
000000000436d7b8 e4 d9 36 04 18 ee 90 7c - 38 07 91 7c ff ff ff ff
...6....|8..|....
000000000436d7c8 32 07 91 7c ab 06 91 7c - eb 06 91 7c 90 dc 36 04
2..|...|...|..6.
000000000436d7d8 a8 01 00 00 34 00 00 c0 - 78 dc 36 04 60 dc 36 04
.....4...x.6.`.6.
000000000436d7e8 66 3b c4 77 39 00 91 7c - e0 dc 36 04 0e 00 00 00
f;.w9..|..6.....
000000000436d7f8 ef 3b c4 77 c8 d8 36 04 - 51 05 91 7c 14 d8 36 04
..;.w..6.Q..|..6.
000000000436d808 00 00 00 00 c8 05 91 7c - 10 f2 07 04 e0 d8 36 04
........|......6.
000000000436d818 51 05 91 7c 2c d8 36 04 - 00 00 00 00 c8 05 91 7c
Q..|,.6........|
000000000436d828 10 f2 07 04 f8 d8 36 04 - 51 05 91 7c d8 0a 09 00
.......6.Q..|....
000000000436d838 6d 05 91 7c 30 d9 36 04 - 8c d9 36 04 34 00 00 c0
m..|0.6...6.4...
000000000436d848 d6 34 91 7c 18 d9 36 04 - 1e 00 00 00 00 00 00 00
..4.|..6.........
000000000436d858 18 f2 07 04 18 f2 07 04 - d6 34 91 7c 30 d9 36 04
..........4.|0.6.
000000000436d868 1e 00 00 00 98 d8 36 04 - 8f 4d 91 7c 18 f2 07 04
.......6..M.|....
000000000436d878 88 d8 36 04 00 00 00 00 - c8 05 91 7c a0 cb 16 00
...6........|....
000000000436d888 54 d9 36 04 51 05 91 7c - a8 10 09 00 6d 05 91 7c
T.6.Q..|....m..|
000000000436d898 18 00 00 00 40 00 00 00 - 34 00 00 c0 00 00 00 00
[email protected].......
000000000436d8a8 18 00 00 00 8c d9 36 04 - 1a 4f 91 7c 24 00 00 00
.......6..O.|$...
000000000436d8b8 5c 00 8a 00 f0 d8 36 04 - 00 00 09 00 32 07 91 7c
\.....6.....2..|