0

Since upgrading to Windows 8.1, I've experienced frequent crashes of Windows Explorer. It will lock up for 10-30 seconds, then terminate and restart itself. It happens many times a day and I don't see a consistent trigger - sometimes it happens if I'm not even interacting with Explorer at all.

Shell extensions that I have installed:

  • Notepad++
  • TortoiseSVN
  • Dropbox
  • 7-Zip

I tried disabling all of the above extensions but the crashes kept happening.

I captured a minidump using procdump and tried analyzing it with WinDbg, but I am a .NET developer so I mostly don't really know what I'm looking at. :) The dump file is here: https://dl.dropboxusercontent.com/u/407740/explorer.exe_150122_113351.dmp

When I first load the dump file, I see this:

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(3cf0.1284): Stack overflow - code c00000fd (first/second chance not available)

I used .ecxr to switch to the crashed thread. That also output some information that I don't know what to do with.

I used kn to show the stack trace, and I got this:

 # Child-SP          RetAddr           Call Site
00 00000000`19ef4000 00007ffb`d917184a ntdll!RtlAllocateHeap+0xd2
01 00000000`19ef4110 00007ffb`d55b16cb combase!CoTaskMemAlloc+0x3a
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for shell32.dll - 
02 00000000`19ef4140 00007ffb`d7738d98 SHCore!SHStrDupW+0x4b
03 00000000`19ef4170 00007ffb`d90e1906 shell32!SHCreateItemFromIDList+0x2d8
04 00000000`19ef5410 00007ffb`d77f0b46 shlwapi!IShellFolder_GetDisplayNameOf+0x46
05 00000000`19ef5460 00007ffb`d7764733 shell32!SHRestricted+0x8f6
06 00000000`19ef6760 00007ffb`d7764b2a shell32!Shell_GetCachedImageIndexW+0x146d3
07 00000000`19ef6840 00007ffb`d7764a46 shell32!Shell_GetCachedImageIndexW+0x14aca
08 00000000`19ef6890 00007ffb`d776495c shell32!Shell_GetCachedImageIndexW+0x149e6
09 00000000`19ef6920 00007ffb`d776144d shell32!Shell_GetCachedImageIndexW+0x148fc
0a 00000000`19ef69f0 00007ffb`d7814b1e shell32!Shell_GetCachedImageIndexW+0x113ed
0b 00000000`19ef6b20 00007ffb`d77438ce shell32!SHChangeNotifyDeregister+0xb7e
0c 00000000`19ef8860 00007ffb`d7735f55 shell32!PathIsExeWorker+0x717e
0d 00000000`19ef9040 00007ffb`d77efe5b shell32!SHBindToObject+0x1705
0e 00000000`19ef95b0 00007ffb`d777853f shell32!Ordinal866+0x105b
0f 00000000`19ef9920 00007ffb`d7764c22 shell32!Ordinal880+0x1df
10 00000000`19ef9990 00007ffb`d780299c shell32!Shell_GetCachedImageIndexW+0x14bc2
11 00000000`19efaa80 00007ffb`d7735f55 shell32!Ordinal922+0x166c
12 00000000`19efb260 00007ffb`d77efe5b shell32!SHBindToObject+0x1705
13 00000000`19efb7d0 00007ffb`b7da1097 shell32!Ordinal866+0x105b
14 00000000`19efbb40 00007ffb`b7da035a SearchFolder!CScope::Load+0x377
15 00000000`19efbc80 00007ffb`b7d9ffb2 SearchFolder!CBinaryAutoList::Load+0x2ea
16 00000000`19efbef0 00007ffb`b7d46f4b SearchFolder!CAutoListCache::GetListDescriptionFromPropertyBag+0x4be
17 00000000`19efc050 00007ffb`d780065a SearchFolder!CDelegateFolderBase::BindToObject+0x3f2
18 00000000`19efc150 00007ffb`d77347c8 shell32!ILCloneFirst+0x4a2a
19 00000000`19efc230 00007ffb`d781792e shell32!ILCombine+0x468
1a 00000000`19efcba0 00007ffb`d77f56a8 shell32!Ordinal95+0x32e
1b 00000000`19efcf10 00007ffb`d7905cb6 shell32!SHBindToFolderIDListParentEx+0x338
1c 00000000`19efcff0 00007ffb`d78ca13b shell32!DriveType+0x386
1d 00000000`19efd2b0 00007ffb`d78bea34 shell32!Ordinal833+0x83b
1e 00000000`19efd310 00007ffb`d78beadc shell32!Ordinal825+0x20a4
1f 00000000`19efd370 00007ffb`d7a1d29f shell32!Ordinal825+0x214c
20 00000000`19efd3a0 00007ffb`d7a99f9e shell32!ReadCabinetState+0x205f
21 00000000`19efd3e0 00007ffb`d790eaa7 shell32!ILCreateFromPathW+0x58bbe
22 00000000`19efd490 00007ffb`d7a99fd3 shell32!SHBindToParent+0xa27
23 00000000`19efd750 00007ffb`d790eaa7 shell32!ILCreateFromPathW+0x58bf3
24 00000000`19efd490 00007ffb`d7a99fd3 shell32!SHBindToParent+0xa27
25 00000000`19efd750 00007ffb`d790eaa7 shell32!ILCreateFromPathW+0x58bf3
26 00000000`19efd490 00007ffb`d7a99fd3 shell32!SHBindToParent+0xa27
27 00000000`19efd750 00007ffb`d790eaa7 shell32!ILCreateFromPathW+0x58bf3
...
fe 00000000`19f14eb0 00007ffb`d7a99fd3 shell32!SHBindToParent+0xa27
ff 00000000`19f15170 00007ffb`d790eaa7 shell32!ILCreateFromPathW+0x58bf3

If I use !analyze -v I get some other information but nothing that I know how to use.

I loaded the last frame by doing .frame ff and tried using dv to look at the variables, but this gave an error "Private symbols (symbols.pri) are required for locals". I'm not sure what to do from here. How can I get more information about what Explorer was trying to do when it crashed?

7
  • Your HDD reports its status as being healthy, correct?
    – Ramhound
    Jan 22, 2015 at 20:17
  • Just a possibility: do you have a mapped network drive that might sometimes be unavailable, particularly your Subversion repository? TortoiseSVN installs some Windows shell extensions, and I've had a system hang for some time (though not crash) when the repository is down. Jan 22, 2015 at 22:23
  • disable the sysfer.dll, it hooks into the search Jan 23, 2015 at 6:05
  • @Ramhound The HDD (SSD actually) is brand new - my Windows install is only about a month old. I ran chkdsk and it reports no issues. Jan 23, 2015 at 14:01
  • @DrMoishePippik The crashes do seem to happen more when I'm doing stuff with Tortoise, but even after disabling it I still had them. I have a few network drives, I'll try disconnecting them and see if that does anything. Jan 23, 2015 at 14:03

1 Answer 1

0

I dumped the stack and saw that the sysfer.dll (Symantec DLL) is involved when Explorer tries to do search operations with C:\Windows\System32\connectedsearch-appcmd.searchconnector-ms, which is the search which displays Bing results in Windows Search :

0x0000000019ef98c8 : 0x00007ffbd7778a80 : shell32!CSearchConnectorFolder::v_InternalQueryInterface+0x30
0x0000000019ef98d8 : 0x00007ffbd7949030 :  !du "ParentFolder"
0x0000000019ef98f8 : 0x00007ffbd77f0fb0 : shell32!CShellItem::BindToHandler
0x0000000019ef9918 : 0x00007ffbd777853f : shell32!CSearchConnectorFolder::Initialize+0xcf
0x0000000019ef9938 : 0x00007ffbd7739590 : shell32!CShellItem::GetAttributes
0x0000000019ef9948 : 0x00007ffbd7732330 : shell32!CFSFolder::Release
0x0000000019ef9978 : 0x00007ffbd7778460 : shell32!CSearchConnectorFolder::InitializeEx
0x0000000019ef9980 : 0x0000000019ef9a90 :  !du "earchconnector-ms"
0x0000000019ef9988 : 0x00007ffbd7764c22 : shell32!CFSFolder::_InitFolder+0xe1b
0x0000000019ef9990 : 0x00007ffbd75972c0 : ole32!CBindCtx::RegisterObjectParam
0x0000000019ef9a38 : 0x0057005c003a0043 :  !du "C:\Windows\System32\connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a40 : 0x006f0064006e0069 :  !du "indows\System32\connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a48 : 0x0053005c00730077 :  !du "ws\System32\connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a50 : 0x0065007400730079 :  !du "ystem32\connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a58 : 0x005c00320033006d :  !du "m32\connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a60 : 0x006e006e006f0063 :  !du "connectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a68 : 0x0065007400630065 :  !du "ectedsearch-appcmd.searchconnector-ms"
0x0000000019ef9a70 : 0x0061006500730064 :  !du "dsearch-appcmd.searchconnector-ms"
0x0000000019ef9a78 : 0x002d006800630072 :  !du "rch-appcmd.searchconnector-ms"
0x0000000019ef9a80 : 0x0063007000700061 :  !du "appcmd.searchconnector-ms"
0x0000000019ef9a88 : 0x0073002e0064006d :  !du "md.searchconnector-ms"
0x0000000019ef9a90 : 0x0063007200610065 :  !du "earchconnector-ms"
0x0000000019ef9a98 : 0x006e006f00630068 :  !du "hconnector-ms"
0x0000000019ef9aa0 : 0x007400630065006e :  !du "nector-ms"
0x0000000019ef9aa8 : 0x006d002d0072006f :  !du "or-ms"
*** WARNING: Unable to verify timestamp for sysfer.dll
*** ERROR: Module load completed but symbols could not be loaded for sysfer.dll
0x0000000019ef9e78 : 0x00007ffbd9bebb95 : ntdll!RtlpLowFragHeapAllocFromContext+0x355
0x0000000019ef9ed0 : 0x00007ffbd7952a90 :  dt shell32!CFileExtension
0x0000000019ef9ef0 : 0x00007ffbd7957960 : shell32!CLSID_LibraryFolder
0x0000000019ef9f28 : 0x00007ffbd917c922 : combase!CComActivator::DoCreateInstance+0x162
0x0000000019ef9f38 : 0x00007ffbd7731f9e : shell32!CAggregatedUnknown::AddRef+0x1e
0x0000000019ef9f48 : 0x00007ffbd9beb6f7 : ntdll!RtlAllocateHeap+0xd7
0x0000000019ef9f68 : 0x00007ffbd6de24b1 : KERNELBASE!QISearch+0x91
0x0000000019ef9f70 : 0x00007ffbd7732ae0 : shell32!CCommonPlaceFolder::AddRef
0x0000000019ef9f98 : 0x00007ffbd7800e65 : shell32!CAggregatedUnknown::CUnkInner::QueryInterface+0x2cb
0x0000000019ef9fa0 : 0x00007ffbd79556b8 : shell32!GUID_000214e6_0000_0000_c000_000000000046
0x0000000019ef9fa8 : 0x00007ffbd7922480 : shell32!CLibraryFolder::v_InternalQueryInterface
0x0000000019ef9fc0 : 0x00007ffbd79556b8 : shell32!GUID_000214e6_0000_0000_c000_000000000046
0x0000000019ef9fc8 : 0x00007ffbd7778ab4 : shell32!CSearchConnectorFolder::v_InternalQueryInterface+0x64
0x0000000019ef9fd8 : 0x00007ffbd7732110 : shell32!CAggregatedUnknown::CUnkInner::QueryInterface
0x0000000019ef9ff8 : 0x00007ffbd773208d : shell32!CAggregatedUnknown::Release+0x2d
0x0000000019efa000 : 0x00007ffbd79556b8 : shell32!GUID_000214e6_0000_0000_c000_000000000046
0x0000000019efa028 : 0x00007ffbd773208d : shell32!CAggregatedUnknown::Release+0x2d
0x0000000019efa038 : 0x00007ffbd7732110 : shell32!CAggregatedUnknown::CUnkInner::QueryInterface
0x0000000019efa058 : 0x00007ffbd79220bc : shell32!CSearchConnectorFolder::s_CreateInstance+0x14c
0x0000000019efa060 : 0x00007ffbd7777cb0 : shell32!CCommonPlaceFolder::Release
0x0000000019efa0b8 : 0x00007ffbd794f120 : 0x00007ffbd794fa40 : 0x00007ffbd79ecf00 : shell32!ECFQueryInterface
0x0000000019efa0c8 : 0x00007ffbd7733ebe : shell32!_SHCoCreateInstance+0x21b
0x0000000019efa0d0 : 0x00007ffbd7778390 : shell32!CSearchConnectorFolder_CreateInstance
0x0000000019efa0d8 : 0x00007ffbd72c2771 : msvcrt!fputwc_nolock+0x1e0
0x0000000019efa150 : 0x00630065006e006e :  !du "nnectedsearch-appcmd.searchconnector-ms"
0x0000000019efa158 : 0x0073006400650074 :  !du "tedsearch-appcmd.searchconnector-ms"
0x0000000019efa160 : 0x0063007200610065 :  !du "earch-appcmd.searchconnector-ms"
0x0000000019efa168 : 0x00700061002d0068 :  !du "h-appcmd.searchconnector-ms"
0x0000000019efa170 : 0x0064006d00630070 :  !du "pcmd.searchconnector-ms"

Maybe the symantec DLL tries to scan the search results for bad results and this may cause issues.

3
  • Thanks for your answer. I have asked our IT to make an exception for me. I will post back with results once I get the change pushed through. Jan 28, 2015 at 22:10
  • does removing Symantec fixes it or not? Feb 6, 2015 at 19:51
  • We tried a couple things but were unable to prevent SEP from loading sysfer.dll into Explorer. I was also having some other issues with Windows 8.1, so in the end I went back to 7. Sorry I was unable to confirm whether this was the fix. Feb 9, 2015 at 1:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .