explorer.exe hangs/crashes

[buck]

G'Day,

I hope someone can help me please.

I've been getting crashes in explorer lately just by opening files/folders.
Some internet research suggests it might be related to a windows update!!

It always relates to ntdll.dll which was altered apparently in update rollup 1 for win xp (826939) which contained the offending update 815021.

826939 is listed in add/remove programs, but not 815021.

There are 20 updates in the bundle so I'm reluctant to uninstall.

Here are a couple of error logs:

10/07/2004 5:51 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00008d2c.

11/07/2004 12:02 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x000085c2.
&#x000a


Pleeeeeeeeaaaaaaaaase Help.

I'm pulling my hair out.

Buck.

[davidwebb]

go to this address it is not what you want but it sais about the ntdll.dll file

http://support.microsoft.com/default...b;EN-US;314503

[buck]

Hi, thanks for that, but still got problems.
Here is a recent log of errors.

10/07/2004 5:51 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00008d2c.

11/07/2004 12:02 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x000085c2.

14/06/2004 8:31 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00007ec4.

2/06/2004 11:25 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00007d85.

27/06/2004 11:46 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x0001fca7.

28/06/2004 9:30 AM Application Hang Hanging application explorer.exe, version 6.0.2800.1221, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

30/06/2004 8:30 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x000080db.

5/07/2004 11:18 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module explorer.exe, version 6.0.2800.1221, fault address 0x000312a6.

5/07/2004 12:29 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00033aed.

6/06/2004 2:18 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00019d63.

6/06/2004 2:19 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x0001fafb.

6/06/2004 2:19 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module , version 0.0.0.0, fault address 0x00000000.

8/07/2004 6:02 PM Application Error Fault bucket 49029644.

8/07/2004 9:20 AM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00007ec4.

9/06/2004 8:44 PM Application Error Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x0000852f.



Now this is happening simply by opening folders etc.

Can someone please help.

Thanks,

Buck.

[davidwebb]

it sounds like you have the w32.blaster worm try and find software that can get rid of it like symantic! do a google search

[buck]

Thanks for the response David,

But I can't see how I've got Blaster.
Got NAV up to date, all windows updates, adaware,spybot, spyware blaster, cwshredder etc. All up to date and clean.

Running the Blaster tool anyway just for fun!

They are not really crashes. Explorer just stops, throws up an error message, screen refreshes and a couple of icons sometimes move around. Lose a couple of icons from systray too. Of course running apps shut down too.

Funny that it happens when I'm just opening/shutting folders/files.

read lots of threads on various forums all talking about windows updates messing with the ntdll.dll module.

At a bit of a loss at present. Don't really want to do a fresh install. And might get the pob staright back as soon as I get all the updates again.

Any other ideas?

Microsoft website was a waste of time!

And.........Symantec tool did not find Blaster! It just finished!

Cheers and thanks,

Buck.

[davidwebb]

have you checked for any unknown processes to see press ctrl+alt+delete and click on processes and see there

[buck]

Nothing particular that I can determine David.
All scans (spy/virus) come up clean.

Here is Hijackthis log if it's any good to you:

Logfile of HijackThis v1.97.7
Scan saved at 9:59:11 PM, on 11/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\QtDTAcer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\WINDOWS\System32\lexpps.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.altavista.yellowpages.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bigpond.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = BigPond Dial-Up Residential Internet Explorer
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtDTAcer.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Researcher (HKLM)
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 2002\AcDcToday.ocx
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/ca...ail/DASAct.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT 2002\InstBanr.ocx
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD LT 2002\InstFred.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{4ABD7739-8329-4CB9-82FC-D752DDE430D6}: NameServer = 203.49.70.92 139.134.2.190

Any help would be greatly appreciated.

Buck

[davidwebb]

goto www.systweak.com
it will help

[buck]

Couldn't see anything there of value.

thanks anyway,

Buck.

[phaze112]

The exact same thing is happening to me and I have updated nav 2004 scans regularly and come up empty. I use adaware professional, spybot, and spyblaster. I run them regularly. whenever i just go to browse folders and such on my os ide hard drive and also my sata data storage drive, the windows will do nothing and i will ctrl-alt-delete to find explorer.exe using 99% of my cpu and not changing any time fast.


please someone help, this has been going on for way way way too long.


thank you alot.

[phaze112]

Ok i found out the problem after doing some more forum searching online. Basically what I did was remember that there was this one movie file that I could never delete because windows always said it was being used by another program, i'm sure you've seen this before.

I was stupid and never thought much about it. I knew I could delete it via cmd but I wanted to see what was using the file. I downloaded a program called Process Explorer which can tell you what process is using what file, dll's etc.

You can get that program here .
The program broke down explorer.exe and sure enough it was using the movie file, which is why I could never delete it. I then went into cmd and deleted the file for good.

Since that moment I have not had one hang/crash of explorer.exe.

[buck]

Thanks,

I'll have a look at that.....

But I've just done a fresh install of XP and I'm STILL getting errors related to ntdll.dll.

Buck.

[nthitz]

i also have this problem.

for me though explorer.exe dies whenever i try to close certain folders.

i got Process Explorer and did the action that hangs explorer.exe but then saw nothing unusual on Process Explorer. anyone have anyone ideas?

[buck]

Nthitz,

I downloaded that process explorer but a dumb aussie boy like me can't really drive it.

I've still been getting a couple of errors. None today yet. Quite a few yesterday.

Check this thread out:

http://forums.viaarena.com/messagevi...threadid=52978

Cheers,

Buck

[buck]

Nthitz,

Have you seen this?


http://support.microsoft.com/default...b;EN-US;329692

Cheers,

Buck.