2

My Windows 7 desktop PC, built by me, started acting very weird in the last couple of days. I use it quite often, about half of the time through TeamViewer. Explorer would crash and restart randomly, almost always through TeamViewer. This made me suspect that TeamViewer was the problem but I have reproduced it with and without TeamViewer several times. The only way I can seem to get the problem not to occur is by booting into Safe Mode.

I have used CCleaner and Malwarebytes to make sure it wasn't a registry error or malware causing the problem, and I have tried the fix in the seemly related issue here as well every other fix I have found online including removing security updates KB980408 and KB2926765 as well as using "sfc /scannow" and a bunch of other things I can't remember.

More recently when I try to start explorer it is popping up a small window that says "Personalized Settings" on the top, but is completely empty and crashes instantly. The only way I can get it to disappear is to kill the explorer.exe process. I wish I could take a screenshot but I can't seem to open paint or even find the exe. I have tried restarting it, I have tried starting it while the personalized settings window was open.


I have come up with two lists of processes the first is the list of active processes when I boot into safe mode and explorer seems to work fine. The second is the list of processes that I can narrow it down to in normal boot and still replicate the problem. There is one process that I can't seem to close. NisSrv.exe which is describes as "Microsoft Network Realtime Inspection Service". When I try to close the process NisSrv.exe it says "The operation could not be completed. Access is denied." When I try to close the related service it gives the same message.

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
System                           4 Services                   0      2,660 K
smss.exe                       304 Services                   0      1,196 K
csrss.exe                      408 Services                   0      4,156 K
wininit.exe                    444 Services                   0      4,608 K
csrss.exe                      452 Console                    1      8,700 K
services.exe                   492 Services                   0      7,700 K
winlogon.exe                   524 Console                    1      5,756 K
lsass.exe                      536 Services                   0     10,644 K
lsm.exe                        544 Services                   0      4,316 K
svchost.exe                    652 Services                   0      8,976 K
MsMpEng.exe                    804 Services                   0     40,696 K
explorer.exe                  1332 Console                    1     85,220 K
ctfmon.exe                    1376 Console                    1      3,680 K
dllhost.exe                   1624 Console                    1      8,656 K
chrome.exe                    1408 Console                    1     98,504 K
WmiPrvSE.exe                  2352 Services                   0      6,472 K
chrome.exe                    1744 Console                    1     65,116 K
taskmgr.exe                    372 Console                    1     14,948 K
cmd.exe                       2776 Console                    1      2,960 K
conhost.exe                   1816 Console                    1      3,580 K
tasklist.exe                  2308 Console                    1      5,868 K

And the list of processes I have narrowed it down to.

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
System                           4 Services                   0      2,808 K
smss.exe                       316 Services                   0      1,216 K
csrss.exe                      484 Services                   0      4,532 K
wininit.exe                    596 Services                   0      4,604 K
csrss.exe                      604 Console                    1     23,676 K
services.exe                   652 Services                   0     11,344 K
lsass.exe                      668 Services                   0     12,692 K
lsm.exe                        676 Services                   0      4,464 K
MsMpEng.exe                    972 Services                   0     68,436 K
winlogon.exe                   168 Console                    1      7,784 K
svchost.exe                    496 Services                   0     19,140 K
NisSrv.exe                    3176 Services                   0        808 K
svchost.exe                   1684 Services                   0     11,260 K
taskmgr.exe                   4524 Console                    1     20,696 K
cmd.exe                       4764 Console                    1      7,224 K
conhost.exe                   4772 Console                    1      6,916 K
sublime_text.exe              2340 Console                    1     45,012 K
dllhost.exe                   4476 Console                    1      8,736 K
tasklist.exe                  3796 Console                    1      5,768 K
WmiPrvSE.exe                  1768 Services                   0      6,344 K

Personalized Settings Error


Here is the event data xml from event viewer for the error I am getting.

<EventData>
  <Data>explorer.exe</Data> 
  <Data>6.1.7601.17567</Data> 
  <Data>4d672ee4</Data> 
  <Data>vrfcore.dll</Data> 
  <Data>6.3.9600.16384</Data> 
  <Data>5215f8f5</Data> 
  <Data>80000003</Data> 
  <Data>0000000000003a00</Data> 
  <Data>12e4</Data> 
  <Data>01cfb84fa70f89dc</Data> 
  <Data>C:\Windows\system32\explorer.exe</Data> 
  <Data>C:\Windows\SYSTEM32\vrfcore.dll</Data> 
  <Data>e5957093-2442-11e4-9f8a-94de806ed9cb</Data> 
</EventData>

I was looking through the eventvwr log again and I found this, possibly related

<EventData>
  <Data>runonce.exe</Data> 
  <Data>6.1.7601.17514</Data> 
  <Data>4ce7a253</Data> 
  <Data>MSVCR100.dll</Data> 
  <Data>10.0.40219.325</Data> 
  <Data>4df2bcac</Data> 
  <Data>c0000005</Data> 
  <Data>000000000003c145</Data> 
  <Data>670</Data> 
  <Data>01cfb8dabbd85942</Data> 
  <Data>C:\Windows\system32\runonce.exe</Data> 
  <Data>C:\Windows\system32\MSVCR100.dll</Data> 
  <Data>fa6f82b9-24cd-11e4-80a8-94de806ed9cb</Data> 
</EventData>

And the general error details

Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: vrfcore.dll, version: 6.3.9600.16384, time stamp: 0x5215f8f5
Exception code: 0x80000003
Fault offset: 0x0000000000003a00
Faulting process id: 0xc38
Faulting application start time: 0x01cfb84e5e852c5f
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\vrfcore.dll
Report Id: 9dc19e6d-2441-11e4-9f8a-94de806ed9cb

Another probably unrelated error that I seem to be getting pretty often.

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"
could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. 
Events cannot be delivered through this filter until the problem is corrected.

My explorer tab in Autoruns seen below along with the error when I try to uncheck something. I should add that I seem to be able to disable shell extensions with ShellExView but I still can't get explorer to start correctly.

Autoruns explorer with error


EXPLORER SHELL UPDATE - See screenshot below I can access the explorer right click menu through a file manager I downloaded called NexusFile, but still no luck starting explorer.

Nexus File Manager with Explorer right-click context menu


Another round of errors that I am getting regarding Windows Search Service

The search service has detected corrupted data files in the index {id=4700}. 
The service will attempt to automatically correct this problem by rebuilding the index.

Details:
    The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

followed by

The Windows Search Service is being stopped because there is a problem with the
indexer: The catalog is corrupt.

Details:
    The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801

and

The plug-in in <Search.JetPropStore> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
    The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

and

The gatherer object cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
    The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

and

The Windows Search Service cannot load the property store information.

Context: Windows Application, SystemIndex Catalog

Details:
    The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)

WER Log

http://pastebin.com/WXKGDT4Q


UPDATE

The problem turned out to be Visual Studio trying to debug the explorer crash that caused it to never be able to start. I uninstalled Visual Studio and rebooted and explorer then crashed on boot but immediately restarted and worked fine. I have isolated the crash on boot and traced it to an error with Synergy found here http://synergy-project.org/spit/issues/details/3980/

Thank you to everyone for being patient and helping me, and I will be accepting @and31415 as the answer since he pointed out that the vrfcore.dll was a Visual Studio dll.

11
  • Is Windows 7 fully patched? Do you get the same issue if you perform a clean boot? Did you check the system event log for further details? – and31415 Aug 15 '14 at 9:15
  • It is hard to tell for sure if windows is fully patched because I can't start control panel or windows update either. When I run the command wuauclt /detectnow I get no output. I have updated the question with event viewer details for the error. I am about to run clean boot so I will further update the question when that is done. – Spaceman Spiff Aug 15 '14 at 20:00
  • No luck with the clean boot. – Spaceman Spiff Aug 15 '14 at 21:18
  • The vrfcore.dll mentioned in the event log is part of the Microsoft Application Verifier software which is bundled with the Windows 8.1 SDK/WDK (in fact, the file version is 6.3.9600.16384) and Visual Studio 2013. Have you ever installed any of these? – and31415 Aug 16 '14 at 11:19
  • Yes I got visual studio 2013 through the dreamspark program. – Spaceman Spiff Aug 16 '14 at 17:30
2
+50

Quick analysis

The vrfcore.dll library file mentioned in the log is related to the Microsoft Application Verifier tool, which is part of the Windows 8.1 SDK/WDK (in fact, the file version is 6.3.9600.16384) and is also included with Visual Studio 2013.

Quoting the documentation:

Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage.

Source: Application Verifier


Workaround

Although it's not an actual solution, uninstalling Visual Studio can serve as a temporary workaround. Before doing so, you might try to remove just the Application Verifier by following these steps:

  1. Open an elevated command prompt.

  2. Run one of the following commands depending on the Windows version you're running:

    • x86 (32-bit)

      msiexec /uninstall {13A3E02D-36D4-BBD6-0BBD-D0BFDBEA0079}
      
    • x64 (64-bit)

      msiexec /uninstall {77F3D72C-465F-BD51-890E-CC3914B1365F}
      
  3. Restart Windows.

Note You might want to ensure that you have all Visual Studio updates installed, which can include bug fixes to specific issues.

1

I'm not entirely sure what the cause of your problem is to be honest but from the sounds of it, if your computer doesn't have this problem in safe mode then I wouldn't worry about Windows having any problems with its registry or etc. If I were you though, to further troubleshoot the problem, I would start the computer in safe mode, save the list of active process (Windows + R, "cmd", enter, "TASKLIST >safemode.txt", ALT + F4) and then save a list of active process after a normal boot (Windows + R, "cmd", enter, "TASKLIST >normal.txt", ALT + F4). From there, I would target the processes that are on normal.txt but not on safemode.txt. Try terminating those processes (or even better 'End Process Tree') and see if the problem ceases. And lastly, the only other idea I could offer would be to prevent any programs from starting on start up. Then if the problem doesn't occur with no start-up programs, at the very least you can be confident in the culprit.

5
  • It would be in your user account folder. So if your user account is still named Administrator, it would be in the C:\Documents and Settings\Administrator folder. If you don't like command lines though, you can always just hit CNTL + SHIFT + ESC to pull up task manager and then write down the processes on paper. – Jacob Wolfe Aug 15 '14 at 4:51
  • Sorry for deleting the previous comment, I just directed the output where I could find it. See my updated question for the tasklists and result – Spaceman Spiff Aug 15 '14 at 5:02
  • Don't worry about it. I looked over the information you posted it doesn't seem to be a third party application causing the problems.. It must be a user configuration that gets disabled in Safe Mode I'm thinking now. Just out of curiosity, if you were to log into a different user account does the problem still occur? I know it's lazy but I had once where I couldn't get a PC to restore its SSL certificates so I just moved over all the data to a different user account to fix it so. And if you wanted to be even lazier, you could really just leave all the data there and just change your shortcuts. – Jacob Wolfe Aug 15 '14 at 5:30
  • And I forgot to say, that process you couldn't end is part of Microsoft Security Essentials so don't try to end it. – Jacob Wolfe Aug 15 '14 at 5:35
  • I created a new user through the command line since I was the only user on my computer. When I tried to log in though it took forever to prepare the desktop and then I got the exact same crash from explorer. – Spaceman Spiff Aug 15 '14 at 6:05
1

One of my users had a similar issue like this a while back and it was caused by an explorer shell extension. An explorer extension is what you see when you right-click on a program and you see extra entries in the context menu like using Winzip or doing an anti-virus scan on the folder.

Explorer shell extensions aren't loaded up as processes and so one wouldn't see them in task manager. Hence we needed a tool like Autoruns, which we could use to stop Explorer making use of the shell extension upon startup.

Once we downloaded Autoruns, we went straight to the Explorer tab and we unchecked anything that looked odd. We restarted the machine and the problem was gone.

Give that a go and hope that helps.

--Editing answer to address new information that user has provided--

If you find however that Autoruns, even when running it as administrator, does not allow you to deselect the auto-start point, then I suggest any of the following. Take a note of the programs listed under the Explorer tab in Autoruns and uninstall them one by one retesting to see the issue goes away after each installation. Alternatively you can try the suggestion here How to list Explorer extensions and disable them?.

4
  • I downloaded Autoruns and when I try to disable explorer extensions I get the same error for all of them. It is the same as this one here. – Spaceman Spiff Aug 15 '14 at 20:49
  • Try this again but this time running Autoruns as administrator. File -> Run as administrator. If that doesn't work, can you edit your question and add the list of items you found under the Explorer tab as well as the file and registry paths the items are pointing to. – user319647 Aug 15 '14 at 21:28
  • I actually tried it the first time as admin. I added a screenshot of my explorer tab to the question. – Spaceman Spiff Aug 15 '14 at 21:45
  • Good screen grab. I haven't unfortunately come across the Autoruns error you experienced but I've edited my answer and given some more suggestions that may help. – user319647 Aug 15 '14 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.