windows explorer crashes

[Rick]

Hi

I have repeatedly been experiencing crashes in Windows Explorer.They started
after trying IE 7. ( which is a bad experience in itself)The crashes occur
at various tasks, and in no particular directory, drive etc. I have included
the last two errors recorded below

I am running XP Home SP2 1 gig ram and 2.6 processor with plenty of hard
drive space.

Steps I have taken are:
uninstalled IE 7
run sfc
reinstalled IE 6
ran virus scanner and several spyware programs
flushed temp files, recycle bin etc

The error received is as follows
app name explorer.exe
app version 6.0.2900.2180
Modula ntdll.dll
modual version 5.1.2600.2180
offset 00010DE3

In checking the control panel, administrative tools events I discovered a
second error
it read as follows
Product: Windows Operating System
Event ID: 1001
Source: Application Error
Version: 5.2
Symbolic Name: DW_BUCKET_LOG
Message: Fault bucket %1.


Any help or suggestion greatly appreciated

Thanks
Rick

 

[Guest]

Try installing the update for windows explorer:
http://www.microsoft.com/technet/security/Bulletin/MS06-057.mspx

 

[Daave]

Hi

I have repeatedly been experiencing crashes in Windows Explorer.They
started after trying IE 7. ( which is a bad experience in itself)The
crashes occur at various tasks, and in no particular directory, drive
etc. I have included the last two errors recorded below

I am running XP Home SP2 1 gig ram and 2.6 processor with plenty of
hard drive space.

Steps I have taken are:
uninstalled IE 7
run sfc
reinstalled IE 6
ran virus scanner and several spyware programs
flushed temp files, recycle bin etc

The error received is as follows
app name explorer.exe
app version 6.0.2900.2180
Modula ntdll.dll
modual version 5.1.2600.2180
offset 00010DE3

In checking the control panel, administrative tools events I
discovered a second error
it read as follows
Product: Windows Operating System
Event ID: 1001
Source: Application Error
Version: 5.2
Symbolic Name: DW_BUCKET_LOG
Message: Fault bucket %1.

Why don't you look at

http://web.archive.org/web/20040523...a.com/messageview.cfm?catid=13&threadid=52978

*Lots* of information on faulting module ntdll.dll. One solution for
this problem is to uninstall the Q815021 update. Another is to disable
the thumbnail autocreation feature in Adobe Photoshop. Looks like a
tough nut to crack! Good luck.

 

[Gerry Cornell]

Rick

Can you please post a complete copy of this Error Report:

app name explorer.exe
app version 6.0.2900.2180
Modula ntdll.dll
modual version 5.1.2600.2180
offset 00010DE3

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using copy
and paste. Often the link will, however, say there is no further
information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event Viewer.
Now start your message (email) and do a paste into the body of the
message. This will paste the info from the Event Viewer Error Report.
Make sure this is the first paste after exiting from Event Viewer.



--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Daave]

Why don't you look at

http://web.archive.org/web/20040523...a.com/messageview.cfm?catid=13&threadid=52978

*Lots* of information on faulting module ntdll.dll. One solution for
this problem is to uninstall the Q815021 update. Another is to disable
the thumbnail autocreation feature in Adobe Photoshop. Looks like a
tough nut to crack! Good luck.

One more idea:

Repair (i.e., do an in-place reinstall of) Internet Explorer.

 

[Rick]

I have encluded the last three explorer crash events along with a Dr Watson
event that smetimes occurs right after the Explorer crash.

I also did a check and it doesn't appear I have the Q815021 update unless it
listed under a different name. I checked both in the add remove programs and
the control panel. I also do not have Adobe photoshop.

About the only progam I added is the Roxio 9, but the errors started a while
after that.

I hope this help as it is really annoying

Thanks in advance for all you time and help


Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 12/30/2006
Time: 10:26:35 PM
User: N/A
Computer: RICK-TOWER
Description:
Hanging application explorer.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 32 31 38 30 20 69 6e 20 2180 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00



Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/30/2006
Time: 10:26:04 PM
User: N/A
Computer: RICK-TOWER
Description:
Faulting application explorer.exe, version 6.0.2900.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00010de3.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 6e 74 64 6c 6c in ntdll
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 32 31 .2600.21
0048: 38 30 20 61 74 20 6f 66 80 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 31 30 64 65 33 0d 0a 10de3..


Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 12/30/2006
Time: 3:51:41 PM
User: N/A
Computer: RICK-TOWER
Description:
Hanging application explorer.exe, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 32 31 38 30 20 69 6e 20 2180 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00


I have on occation get this error from Dr Watson after the explorer crash
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 12/30/2006
Time: 2:11:50 PM
User: N/A
Computer: RICK-TOWER
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d

 

[Daave]

I have encluded the last three explorer crash events along with a Dr
Watson event that smetimes occurs right after the Explorer crash.

I also did a check and it doesn't appear I have the Q815021 update
unless it listed under a different name. I checked both in the add
remove programs and the control panel. I also do not have Adobe
photoshop.

More ideas:
(from http://discussions.virtualdr.com/archive/index.php/t-156381.html )

Change location of temp (or TIF) files
Remove WS_FTP
-----------------------------------------------------------------------

Might explorer.exe be a virus?

Which AV do you use? Latest definition files? There are also several
good online scans. Which anti-spyware apps (and latest definitions) do
you use?

Chkdsk and defrag might help.

Did you try either System Restore or reinstalling IE? How about
replacing ntdll.dll with another version (assuming yours is corrupt).

It might even be a memory problem. Check to see it's seated properly.
Run MemTest.

Searching the Net, many others have also experienced the same problem,
but there doesn't seem to be a straightforward solution. If none of the
above helps, I would just back up your data (and make sure you have the
necessary drivers) and go ahead with a clean install.

 

[Gerry Cornell]

Rick

You might monitor use of the pagefile.
A small utility to monitor pagefile usage:
http://www.dougknox.com/xp/utils/xp_pagefilemon.htm

Make sure you start logging at the beginning of the session and check
readings after a crash.

Go to Start, Control Panel, Folder Options, View, Advanced Settings
and verify that the box before "Show hidden files and folders" is
checked and "Hide protected operating system files " is unchecked. You
may need to scroll down to see the second item. You should also make
certain that the
box before "Hide extensions for known file types" is not checked. Next
in Windows Explorer make sure View, Details is selected and then
select View, Choose Details and check before Name, Type, Total Size,
and Free Space.

Using Windows Explorer Go to Start, Control Panel, Folder Options,
View, Advanced Settings and verify that the box before "Show hidden
files and folders" is checked and "Hide protected operating system
files " is unchecked. You may need to scroll down to see the second
item. You should also make certain that the box before "Hide
extensions for known file types" is not checked. Next in Windows
Explorer make sure View, Details is selected and then select View,
Choose Details and check before Name, Type, Total Size, and Free
Space.

Search My Computer for "explorer.exe" without quotes ensuring you have
selected Advanced Options and clicked on the box before Search System
Folders, Search Hidden Files and Folders and Search Sub-Folders. What
are the file paths for each copy of explorer.exe found?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Rick]

Hi Gerry and Daave

I ran my virus scanner and several different spyware programs and cleaned
what ever was found ( nothing in virus)

What version do I need and were should I obtain it to replace my ntdll.dll
file?

I also have removed and reinstalled IE 6.

I found explorer.exe in 4 locations
c:\windows size 1008 kb
c:\windows\$ntservicepackuninstall 981 kb
c:\windows\prefetch 105kb
( named explorer.exe-082f3a9.pf)
c:\windows\servicepackfiles\i386 1008 kb

The ntdll.dll was found in
c:\windows \$ntservicepackuninstall$ 653kb
c:\windows\system32 692kb
c:\windows\servicepackfiles\i386 692kb
file version and dates respectifly are
5.1.2600.1106 date 6-15-2006
5.1.2000.2180 date 4-15-2003
5.1.2000.2180 date 8-3-2004

As to the page file monitor, what am I looking for?

Thanks
Rick

 

[Gerry Cornell]

Rick

The ntdll.dll is a core Window Component not to be messed with.

Use page file monitor to observe what is the peak usage. Start it to
run immediately after start-up and look at the log after Windows
Explorer has crashed. The log is Pagefilelog.txt. If you right click
on the file in Windows Explorer and select Send to, Desktop (Create
Shortcut). The same applies to XP_PageFileMon.exe.

I might have expected an Event ID: 1001 report to be posted by you.
Does this mean one is not there in Event Viewer?

Does your Windows XP CD include the SP2 update or did you download the
update or use one of the special SP2 CDs mass mailed to customers in
2004?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Daave]

Hi Gerry and Daave

I ran my virus scanner and several different spyware programs and
cleaned what ever was found ( nothing in virus)

You never told us which virus scanner you use! And if the virus
definitions are not up-to-date, then it won't be able to catch most of
the more recent viruses. I'm not sure that a virus is causing your
particular problem, but regardless, you should *always* make sure your
PC is clear of malware. And you haven't told us which spyware programs
you use either!

Some on-line scans:

http://housecall.trendmicro.com/

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

http://www.kaspersky.com/remoteviruschk.html

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

What version do I need and were should I obtain it to replace my
ntdll.dll file?

I'm not even sure you necessarily need to replace your ntdll.dll file.
But in the event that yours is corrupt, you may find a replacement (same
version: 5.1.2600.2180) at
http://www.dll-files.com/dllindex/dll-files.shtml?ntdll

Again, if this wild goose chase yields no useful results, you should do
a clean install.

But if you want to use page file monitor as a diagnostic first, I'd also
be curious to see if you're able to find anything suspicious.

 

[Rick]

I sorry I am using Bit Defender 9 as a virus scanner. As far as spyware
programs I tried, Spyware Doctor, Spywall,The Cleaner,Lavasoft and all
programs have the latest updates

My SP2 update was the CD I received from Microsoft

One thing I noticed is the crash occurs mainly after I right click while in
Windows Explorer

The first 1001 I found was back on December 29. They mainly seem to be 1000
or 1002. Here's is the one I found
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 12/29/2006
Time: 1:53:25 PM
User: N/A
Computer: RICK-TOWER
Description:
Fault bucket 128313618.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 31 32 38 33 31 33 36 31 12831361
0010: 38 0d 0a 8..

 

[Gerry Cornell]

Rick

Something I also need to do:
http://www.theeldergeek.com/slipstreamed_xpsp2_cd.htm

Please post again when you have created the new CD.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry Cornell]

Thanks Rick for reporting how your problem was resolved. This post
should place your latest message in the original thread.


--

Regards.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


Hi Sorry for the error. I forgot to place the subject in. This is a
continuation for the original post ending on December 30,2006