0

Explorer.exe crashes every time I do this:

  1. Click Start
  2. Click Run
  3. Type C:\ and hit Enter

The problem just started today, and I need help tracking down the cause.

Symptoms

It only happens when I target a root directory in step #3, e.g. C:\, D:\, etc. If I type something like C:\Windows instead, it opens the folder just fine. From there, I can navigate up to the root directory and it doesn't crash. But if I open Start | Computer then click on one of the drives (navigating in "top-down"), it crashes.

Troubleshooting

So far, I've traced the problem to PROPSYS.DLL, and included the WinDBG output of a crash dump below. Here's a snippet:

FAULTING_IP: 
propsys!CByteHashTable::_CalculateHashKey+2e
000007fe`f75119bf 410fb60b        movzx   ecx,byte ptr [r11]

I'm not sure what file or data it's trying to run CalculateHashKey on. I assume some third party shell extension is responsible.

I've tried disabling swaths of shell extensions using ShellExView, but so far have been unable to find the culprit (if any) which triggers the crash. (EDIT: I tried disabling ALL non-Microsoft extensions and it didn't help)

It also crashes in Safe Mode with Networking, and under a fresh, new user account.

I've run sfc /scannow and other basic troubleshooting steps. Note I'm on Windows 7 64-bit.

Classic Explorer

I'm running Classic Explorer, but I'm unconvinced the problem is related to it. When I open the native start menu and repeat the steps above, Explorer crashes as soon as I type a single character into the search box.

Related Issues

I've also noticed thousands of EventID 1006 coming from Property System in Event Viewer. I'm not sure if it's related, as they've been piling up for months. They look something like:

Omitted duplicate property.
Keeping: 'Corel.File.CompressionRatio' ({2B51404E-62C1-46B6-A319-90B63412D0EE} 102)  Publisher: 'Corel'  Product: 'CGS'  URL: 'corelproperties.propdesc'
Omitting: 'Corel.File.CompressionRatio' ({2B51404E-62C1-46B6-A319-90B63412D0EE} 102)  Publisher: 'Corel'  Product: 'CGS'  URL: 'corelproperties.propdesc'

All of them are related to Corel. I thought I disabled all Corel shell extensions.

Crash Dump

Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\dumps\explorer.exe_190605_023725.dmp]
User Mini Dump File with Full Memory: Only application data is available

Comment: '
*** "C:\Program Files\SysInternals\Procdump\procdump64.exe" -accepteula -ma -j "c:\dumps" 9960 212 000000000AB80000
*** Just-In-Time debugger. PID: 9960 Event Handle: 212 JIT Context: .jdinfo 0xab80000'

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Wed Jun  5 02:37:25.000 2019 (UTC - 7:00)
System Uptime: 0 days 0:53:47.591
Process Uptime: 0 days 0:14:40.000
................................................................
................................................................
................................................................
.................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(26e8.14ac): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
00000000`76d79e3a c3              ret
0:056> .ecxr
rax=0000000012b9b0a5 rbx=0000000000000000 rcx=0000000004ae6c29
rdx=000000002969a8c9 rsi=0000000000000000 rdi=0000000000000000
rip=000007fef75119bf rsp=000000002c49e3d0 rbp=00000000029362a0
 r8=0000000000000010  r9=000000000000001d r10=0000000000000010
r11=000000000b1d0774 r12=00000000029362a0 r13=0000000000000010
r14=0000000000000010 r15=000000000b1d0774
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
propsys!CByteHashTable::_CalculateHashKey+0x2e:
000007fe`f75119bf 410fb60b        movzx   ecx,byte ptr [r11] ds:00000000`0b1d0774=??
0:056> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for DropboxExt64.27.0.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for WindowsCodecs.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ClassicStartMenuDLL.dll - 
*** WARNING: Unable to verify checksum for System.Windows.Forms.ni.dll
*** WARNING: Unable to verify checksum for QTTabBar.ni.dll
*** ERROR: Module load completed but symbols could not be loaded for QTTabBar.ni.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ClassicExplorer64.dll - 
Cannot find frame 0x27, previous scope unchanged
GetUrlPageData2 (WinHttp) failed: 12002.

FAULTING_IP: 
propsys!CByteHashTable::_CalculateHashKey+2e
000007fe`f75119bf 410fb60b        movzx   ecx,byte ptr [r11]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fef75119bf (propsys!CByteHashTable::_CalculateHashKey+0x000000000000002e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000000000b1d0774
Attempt to read from address 000000000b1d0774

CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
rax=0000000000000058 rbx=000000002c49d420 rcx=0000000000000002
rdx=000000002c49d390 rsi=0000000000000000 rdi=0000000000000002
rip=0000000076d79e3a rsp=000000002c49d2e8 rbp=0000000000000002
 r8=000000002c49ca08  r9=000000002c49cb70 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=000000002c49d390
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0xa:
00000000`76d79e3a c3              ret

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  explorer.exe

OVERLAPPED_MODULE: Address regions for 'NaturalLanguage6' and 'styleman.cpl' overlap

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000000b1d0774

READ_ADDRESS:  000000000b1d0774 

FOLLOWUP_IP: 
propsys!CByteHashTable::_CalculateHashKey+2e
000007fe`f75119bf 410fb60b        movzx   ecx,byte ptr [r11]

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  explorer.exe

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x14ac (56)
Child-SP         RetAddr          Call Site

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS

LAST_CONTROL_TRANSFER:  from 000007fef7511909 to 000007fef75119bf

STACK_TEXT:  
00000000`2c49e3d0 000007fe`f7511909 : 00000000`00000001 00000000`029362a0 00000000`00000000 000007fe`f754fd37 : propsys!CByteHashTable::_CalculateHashKey+0x2e
00000000`2c49e400 000007fe`f7511a71 : 00000000`00000000 00000000`00000000 00000000`00000000 000007fe`f7512c77 : propsys!CByteHashTable::_LookupEntry+0x31
00000000`2c49e460 000007fe`f751ef95 : 00000000`02936280 00000000`0b1d0774 00000000`00000000 00000000`02936280 : propsys!CByteHashTable::_GetValue+0x88
00000000`2c49e4b0 000007fe`f753e99e : 00000000`02936280 00000000`0b1d0774 00001b81`fd9e055e 00000000`76d3d4ea : propsys!CSchemaCache::_EnsureSchemaLoadedWithCacheItem+0x65
00000000`2c49e550 000007fe`f7532f5b : 00000000`00000000 00000000`02936280 000007fe`e0ebdbf8 00000000`76b115aa : propsys!CSchemaCache::_EnsureSchemaLoaded+0x59
00000000`2c49e590 000007fe`f7532c6a : 00000000`00000000 00000000`00000000 00000000`00000443 000007fe`f75161da : propsys!CSchemaCache::EnumSemanticTypes+0x77
00000000`2c49e620 000007fe`e0efd61c : 00000000`00000000 00000000`08d5001f 00000000`00000001 00000000`00000000 : propsys!SchemaCache_EnumSemanticTypes+0x4a
00000000`2c49e670 000007fe`e0efd088 : 00000000`00000000 00000000`00000443 00000000`0a61d020 00000000`00000000 : StructuredQuery!StructuredQuery1::CSchemaFromPropertySystem::Load+0xfc
00000000`2c49e6f0 000007fe`e0eca9de : 00000000`2c49e840 00000000`2c49e840 00000000`0a60a930 00000000`00000000 : StructuredQuery!StructuredQuery1::CreateSchemaBinaryFromPropertySystem+0xe8
00000000`2c49e750 000007fe`e0ecb420 : 00000000`00000000 00000000`00000000 00000000`2c49e840 00000000`00000000 : StructuredQuery!StructuredQuery1::QueryParser::LoadSchema+0xca
00000000`2c49e790 000007fe`e0eda5ae : 00000000`00000001 00000000`00000409 00000000`08dc2630 00000000`08dc2630 : StructuredQuery!StructuredQuery1::QueryParser::SetOption+0x1ec
00000000`2c49e7d0 000007fe`e0eda9a6 : 00000000`00000000 00000000`00000409 00000000`08dc2630 00000000`08dc2630 : StructuredQuery!StructuredQuery1::QueryParserManager::LoadLocalizedSchema+0x1f6
00000000`2c49eab0 000007fe`e0eefa8c : 00000000`00000000 00000000`003c9358 00000000`003c92f0 00000000`00000409 : StructuredQuery!StructuredQuery1::QueryParserManager::CreateLoadedParser+0xb2
00000000`2c49eb20 000007fe`e0eef987 : 00000000`003c92f0 00000000`00000000 000007fe`fdba2318 000007fe`fd188300 : StructuredQuery!StructuredQuery1::CStructuredQueryHelper::_CreateQueryParser+0xc8
00000000`2c49ebb0 000007fe`e0eef2a3 : 00000000`00000000 00000000`003c92f0 00000000`00000409 000007fe`fdb77c98 : StructuredQuery!StructuredQuery1::CStructuredQueryHelper::_EnsureInitializedParser+0xb3
00000000`2c49ebf0 000007fe`fd7cb58f : 00000000`00000000 00000000`2c49eda0 00000000`2c49ee80 00000000`2c49ecd0 : StructuredQuery!StructuredQuery1::CStructuredQueryHelper::ParseStructuredQuery+0x33
00000000`2c49ec30 000007fe`fd9595bd : 00000000`00000000 00000000`003c92f0 00000000`2c49ee80 000007fe`fdb5b450 : shell32!TextToCondition+0x8d
00000000`2c49ec70 000007fe`fd9599c8 : 00000000`2c49ee90 00000000`2c49ee00 00000000`2c49ee80 00000000`2c49ee10 : shell32!SHCreateFilterFromFullText+0x65
00000000`2c49ed60 000007fe`fd90a21c : 00000000`2c49f430 00000000`2c49ef00 00000000`2c49ee90 00000000`00000104 : shell32!DoesItemArrayMatchAQS+0x48
00000000`2c49ee40 000007fe`fd772c32 : 00000000`2c49f128 00000000`2c49f120 00000000`00000001 00000000`00000001 : shell32!CRegDataDrivenCommand::_CheckEnabledStateFromAQSQuery+0x7c
00000000`2c49f0c0 000007fe`fd77153f : 00000000`09e75b98 00000000`09e75b98 00000000`09e75b98 00000000`00000000 : shell32!CRegDataDrivenCommand::GetState+0x154
00000000`2c49f260 000007fe`fd76f1da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shell32!CRegistryVerbsContextMenu::QueryContextMenu+0x656
00000000`2c49f740 000007fe`fd76eb49 : 00000000`0a60a690 00000000`005b0e7f 00000000`0a60a690 00000000`0a60a690 : shell32!HDXA_QueryContextMenu+0x454
00000000`2c49f960 000007fe`fd83a141 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`09ed8630 : shell32!CDefFolderMenu::QueryContextMenu+0x625
00000000`2c49fb70 000007fe`fd83a070 : 00000000`0a6f6150 00000000`0a4ffdf0 00000000`00000000 00000000`09c203b8 : shell32!CShellExecute::_InvokeInProcExec+0xc0
00000000`2c49fc60 000007fe`fd83a003 : 00000000`0a6f6150 00000000`0a6f6150 00000000`00000974 00000000`00000000 : shell32!CShellExecute::_InvokeCtxMenu+0x48
00000000`2c49fca0 000007fe`fd747a0d : 000007fe`fd0d53d0 00000000`0a6f6150 00000000`00000974 00000000`0a6f6150 : shell32!CShellExecute::_DoExecute+0xb4
00000000`2c49fce0 000007fe`fe74c71e : 00000000`00000000 00000000`0a4ffdf0 000007fe`fd122140 00000000`00000000 : shell32!CShellExecute::s_ExecuteThreadProc+0x39
00000000`2c49fd20 00000000`76b0556d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shlwapi!WrapperThreadProc+0x19b
00000000`2c49fe20 00000000`76d6385d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`2c49fe50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  propsys!CByteHashTable::_CalculateHashKey+2e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: propsys

IMAGE_NAME:  propsys.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c94a

STACK_COMMAND:  ~56s; .ecxr ; kb

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_c0000005_propsys.dll!CByteHashTable::_CalculateHashKey

BUCKET_ID:  X64_APPLICATION_FAULT_WRONG_SYMBOLS_propsys!CByteHashTable::_CalculateHashKey+2e

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:wrong_symbols_c0000005_propsys.dll!cbytehashtable::_calculatehashkey

FAILURE_ID_HASH:  {d68d6dd3-5216-ea76-dfab-705cfd6c172d}

Followup: MachineOwner
---------
8
  • This blog post was extremely helpful: chentiangemalc.wordpress.com/2012/06/07/… (specifically, the lvm command in WinDbg to list loaded modules, which I'm currently investigating)
    – rkagerer
    Jun 5, 2019 at 13:00
  • So what Corel software do you have installed? What about ClassicStartMenu? What about DropBox? Disable ClassicStartMenu and DropBox
    – Ramhound
    Jun 5, 2019 at 14:03
  • I would also remove QTTabBar from your system.
    – Ramhound
    Jun 5, 2019 at 14:23
  • Thanks @Ramhound. Tried your suggestions and it still happens. As mentioned, without ClassicStartMenu it crashes as soon as anything is typed in the Start Menu searchbox.
    – rkagerer
    Jun 5, 2019 at 14:29
  • Classic Menu and QTTabBar both interface with Windows Explorer (File Explorer on Windows 8+). Either one of those could cause this behavior. Unless you remove ClassicStartMenu and/or QTTabBar (or at the very least did not load its modules) using the shortcut to open the default start menu isn't enough to verify it's not caused by Classic Menu.
    – Ramhound
    Jun 5, 2019 at 14:38

0

You must log in to answer this question.

Browse other questions tagged .