0

I turned my computer off to go on vacation, and came back to find that, on reboot, it would not start correctly.

When I try to login, I get a blinking strobe light effect, and the start menu never shows up. Event log showed that explorer.exe crashed in a loop.

I've tried

  • safe mode
  • create new user and log in as that one
  • sfc
  • dism repair
  • automatic repair through recovery mode
  • disable auto shell restart (which helps -- it allows me to type on the computer)
  • clean boot
  • removal of drivers

The problem seems to be in twinui_pcshell.dll

Any other ideas?

Timeline: Process.Start
    Name: <blank>
    Time: 2020-01-16T14:00:59.0Z
    Diff: 1000 mSec


DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=0000000080004002 rbx=000000000580c320 rcx=000000000580c390
rdx=00007ff8e5ca2f68 rsi=000000000509f820 rdi=000000000580c320
rip=00007ff8e5939bfc rsp=000000000509f778 rbp=00007ff8c2b77cf0
 r8=000000000509f808  r9=000000000580c328 r10=0000000080004002
r11=000000000509f818 r12=0000000005816f10 r13=0000000000000000
r14=000000000509f9a0 r15=000000000363abf0
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo:
00007ff8`e5939bfc a15b98de39e403186c mov   eax,dword ptr [6C1803E439DE985Bh] ds:6c1803e4`39de985b=????????
Resetting default scope

FAULTING_IP: 
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo+0
00007ff8`e5939bfc a15b98de39e403186c mov   eax,dword ptr [6C1803E439DE985Bh]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ff8e5939bfc (twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

PROCESS_NAME:  explorer.exe

FOLLOWUP_IP: 
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo+0
00007ff8`e5939bfc a15b98de39e403186c mov   eax,dword ptr [6C1803E439DE985Bh]

READ_ADDRESS:  ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

WATSON_BKT_PROCSTAMP:  d3046e6b

WATSON_BKT_PROCVER:  6.2.18362.449

PROCESS_VER_PRODUCT:  Microsoft® Windows® Operating System

WATSON_BKT_MODULE:  twinui.pcshell.dll

WATSON_BKT_MODSTAMP:  6141e983

WATSON_BKT_MODOFFSET:  109bfc

WATSON_BKT_MODVER:  6.2.18362.449

MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

MODLIST_WITH_TSCHKSUM_HASH:  394d58ebce4bf5a65cf3420d267041c51a17133a

MODLIST_SHA1_HASH:  6006e4cea17b6f773e22b86c0ef37ce94b909267

COMMENT:  
*** "C:\Users\gbronner\Desktop\Procdump\procdump.exe" -accepteula -mp -j "C:\users\gbronner\Desktop\Procdump" 1336 508 0000000004F30000
*** Just-In-Time debugger. PID: 1336 Event Handle: 508 JIT Context: .jdinfo 0x4f30000

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

CHKIMG_EXTENSION: !chkimg -lo 50 -db !twinui_pcshell
254 errors : !twinui_pcshell (7ff8e5939b7c-7ff8e5939c7b)
7ff8e5939b70  85  c9  74  05  e8  e7  61  f8  ff  48  89  3b *d6 *ab *2c *6a ..t...a..H.;..,j
7ff8e5939b80 *d2 *34 *ce *41 *38 *0a *00 *a8 *9a *da *20 *ae *54 *1c *f5 *15 .4.A8..... .T...
7ff8e5939b90 *2e *56 *35 *29 *c5 *6d *11 *36 *4e *36 *a4 *63 *ef *64 *74 *ab .V5).m.6N6.c.dt.
7ff8e5939ba0 *e2 *58 *9a *73 *1e *d1 *83 *c2 *b0 *e8 *7e *82 *99 *e4 *a4 *50 .X.s......~....P
7ff8e5939bb0 *34 *c5 *d7 *6f *f7 *0f *ad *57 *79 *22 *2d *05 *cd *ba *13 *28 4..o...Wy"-....(
7ff8e5939bc0 *1c *fa *0a *c9 *b0 *28 *5c *db *99 *e4 *f2 *62 *52 *93 *31 *3d .....(\....bR.1=
7ff8e5939bd0 *b8 *3d *6a *93 *41 *74 *b3 *2d  b4 *b1 *6d *70 *06 *5b *d6 *ba .=j.At.-..mp.[..
7ff8e5939be0 *eb *19 *77 *97 *7f *2e *3f *38 *7e *9e *f5 *52 *5b *9b *79 *ae ..w...?8~..R[.y.
7ff8e5939bf0 *e5 *79 *3c *b9 *76 *9d *a4 *a7 *55 *a4 *04 *50 *a1 *5b *98 *de .y<.v...U..P.[..
7ff8e5939c00 *39 *e4 *03 *18 *6c *74 *15 *a8 *b1 *bd *b3 *cf *25 *c3  36 *e6 9...lt......%.6.
7ff8e5939c10 *c0 *05 *8f *4a *5c *a4 *4a *25 *55 *89 *55 *7e *e9 *1e *b4 *f8 ...J\.J%U.U~....
7ff8e5939c20 *a2 *fb *40 *8e *79 *e4 *f3 *90 *9c *91 *9c *e2 *b2 *94 *80 *86 ..@.y...........
7ff8e5939c30 *f6 *fa *22 *aa *b1 *c6 *24 *23 *9c *9e *86 *aa *47 *60 *f2 *a9 .."...$#....G`..
7ff8e5939c40 *bb *05 *b6 *e0 *b6 *d7 *e9 *56 *a5 *58 *c4 *8f *04 *6a *3c *a3 .......V.X...j<.
7ff8e5939c50 *d3 *23 *80 *3d *aa *ab *99 *55 *60 *b4 *f3 *1a *58 *9f *70 *e0 .#.=...U`...X.p.
7ff8e5939c60 *f4 *1e *95 *00 *73 *57 *97 *97 *12 *ba *cd *66 *86 *37 *5e *aa ....sW.....f.7^.
7ff8e5939c70 *bc *0c *7b *d5 *7b *2d *4a *6f *35 *9d *97 *7c  08  33  c0  eb ..{.{-Jo5..|.3..

DUMP_FLAGS:  4c96

DUMP_TYPE:  1

ANALYSIS_SESSION_HOST:  BUTTERHEAD

ANALYSIS_SESSION_TIME:  01-16-2020 09:14:32.0243

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

THREAD_ATTRIBUTES: 
ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

OS_LOCALE:  ENU

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_MEMORY_CORRUPTION_LARGE_256

DEFAULT_BUCKET_ID:  MEMORY_CORRUPTION_LARGE_256

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

PROBLEM_CLASSES: 

    ID:     [0n313]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x12dc]
    Frame:  [0] : twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo

    ID:     [0n285]
    Type:   [INVALID_POINTER_READ]
    Class:  Primary
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x12dc]
    Frame:  [0] : twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo

    ID:     [0n209]
    Type:   [MEMORY_CORRUPTION]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x538]
    TID:    [0x12dc]
    Frame:  [Unspecified]

    ID:     [0n155]
    Type:   [LARGE]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Add
            String: [256]
    PID:    [0x538]
    TID:    [0x12dc]
    Frame:  [Unspecified]

LAST_CONTROL_TRANSFER:  from 00007ff8e5a14973 to 00007ff8e5939bfc

STACK_TEXT:  
00000000`00000000 00000000`00000000 memory_corruption!twinui_pcshell+0x0


THREAD_SHA1_HASH_MOD_FUNC:  d7032d110b0be66578467d7a091eaa1ecf498302

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  4705f75888593d9413f48c2d55c5165cf7e8a19b

THREAD_SHA1_HASH_MOD:  7da7fbec386ce361a40d03d69a994bc4836f03e8

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  memory_corruption!twinui_pcshell

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  ** Pseudo Context ** ManagedPseudo ** Value: 1cf64035dd0 ** ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE_256_c0000005_memory_corruption!twinui_pcshell

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_MEMORY_CORRUPTION_LARGE_256_memory_corruption!twinui_pcshell

FAILURE_EXCEPTION_CODE:  c0000005

IMAGE_NAME:  memory_corruption

FAILURE_IMAGE_NAME:  memory_corruption

BUCKET_ID_IMAGE_STR:  memory_corruption

MODULE_NAME: memory_corruption

FAILURE_MODULE_NAME:  memory_corruption

BUCKET_ID_MODULE_STR:  memory_corruption

FAILURE_FUNCTION_NAME:  twinui_pcshell

BUCKET_ID_FUNCTION_STR:  twinui_pcshell

BUCKET_ID_OFFSET:  0

BUCKET_ID_MODTIMEDATESTAMP:  0

BUCKET_ID_MODCHECKSUM:  0

BUCKET_ID_MODVER_STR:  0.0.0.0

BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  memory_corruption!twinui_pcshell

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer.exe/6.2.18362.449/d3046e6b/twinui.pcshell.dll/6.2.18362.449/6141e983/c0000005/00109bfc.htm?Retriage=1

TARGET_TIME:  2020-01-16T14:01:00.000Z

OSBUILD:  18362

OSSERVICEPACK:  329

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  768

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS Personal

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  2cc6c

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:memory_corruption_large_256_c0000005_memory_corruption!twinui_pcshell

FAILURE_ID_HASH:  {8501c6a9-9fbe-2820-276c-c9dd5d473898}
  • Have you tried Safe Mode? It does not appear you have specifically tried Safe Mode. I would also enable the default Administrator account, log into that account, and see if the behavior is limited to just a single user. You might also consider performing an upgrade to 1909 since you are currently running 1903. – Ramhound Jan 16 at 15:38
  • Yes. Tried Safe mode, and created a new user. – gbronner Jan 16 at 16:29
  • What happens if you replace the twinui_pcshell.dll with a copy from a similar build? – DBADon Jan 16 at 16:38
  • I don't think you can do that easily. – gbronner Jan 16 at 17:08
0

I was unable to come up with a solution to fix this, so I elected to update to Version 1909.

A few more things I tried:

  • Updating from the MS store
  • Deleting explorer cache files
  • etc.

Took about a day of work. Not happy about this!

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.