Explorer sometimes crashes

[Debugger]

Explorer sometimes crashes when you view files or display thumbnails and when copying files .
How can I check which process or application causes this problem and solve this problem?




Note: Advanced diagnosing methods found on Microsoft page, with the entire list, have failed, so I am asking here.

When the Windows Explorer crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]
"DumpFolder"=hex(2):43,00,3a,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,44,00,75,\
00,6d,00,70,00,73,00,00,00
"DumpType"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"GlobalFlag"=dword:02000100
"PageHeapFlags"=dword:00000003



Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\MOJA\AppData\Local\CrashDumps\explorer.exe.9668.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Oct 18 09:05:45.000 2018 (UTC + 2:00)
System Uptime: not available
Process Uptime: 0 days 5:50:19.000
................................................................
...............................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(25c4.2ea0): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
00000000`76f99e3a c3 ret
0:005> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT: (.ecxr)
rax=0000000015e9f390 rbx=0000000000000000 rcx=00000000000c0eee
rdx=0000000000000219 rsi=0000000000000001 rdi=0000000000000000
rip=0000000016510fd8 rsp=0000000015e9f328 rbp=0000000000000000
r8=0000000000000007 r9=0000000000000000 r10=00000000000c0eee
r11=000000000039a148 r12=0000000000000000 r13=0000000000000219
r14=000000000039a148 r15=00000000000c0eee
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
00000000`16510fd8 ?? ???
Resetting default scope

FAULTING_IP:
+0
00000000`16510fd8 ?? ???

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000016510fd8
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000016510fd8
Attempt to execute non-executable address 0000000016510fd8

DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT

PROCESS_NAME: explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000008

EXCEPTION_PARAMETER2: 0000000016510fd8

FOLLOWUP_IP:
duser!CoreSC::xwProcessNL+173
000007fe`f56210f4 33d2 xor edx,edx

EXECUTE_ADDRESS: 16510fd8

FAILED_INSTRUCTION_ADDRESS:
+0
00000000`16510fd8 ?? ???

WATSON_BKT_PROCSTAMP: 57c44efe

WATSON_BKT_PROCVER: 6.1.7601.23537

PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System

WATSON_BKT_MODULE: unknown

WATSON_BKT_MODVER: 0.0.0.0

WATSON_BKT_MODOFFSET: 16510fd8

WATSON_BKT_MODSTAMP: bbbbbbb4

BUILD_VERSION_STRING: 6.1.7601.24260 (win7sp1_ldr.180908-0600)

MODLIST_WITH_TSCHKSUM_HASH: 525b1599354cd64041d168d53c525daf496e4e3e

MODLIST_SHA1_HASH: 90f4f716c7206b4cf01be4ff6c79ff051e786898

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

DUMP_FLAGS: 94

DUMP_TYPE: 1

ANALYSIS_SESSION_HOST: KOMPUTER

ANALYSIS_SESSION_TIME: 10-18-2018 09:12:48.0235

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

THREAD_ATTRIBUTES:
OS_LOCALE: PLK

PROBLEM_CLASSES:

ID: [0n301]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown

ID: [0n275]
Type: [INVALID_POINTER_EXECUTE]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown

ID: [0n283]
Type: [SOFTWARE_NX_FAULT]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x25c4]
TID: [0x2ea0]
Frame: [0] : unknown!unknown

BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE

PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT

IP_ON_HEAP: 0000000016510fd8
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

LAST_CONTROL_TRANSFER: from 0000000076d29bbd to 0000000016510fd8

STACK_TEXT:
00000000`15e9f328 00000000`76d29bbd : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`155638c0 : 0x16510fd8
00000000`15e9f330 00000000`76d2729b : 00000000`15e9f568 00000000`16510fd8 00000000`00000000 00000000`00000000 : user32!UserCallWinProcCheckWow+0x1ad
00000000`15e9f3f0 00000000`76d15a62 : 00000000`003c1d60 000007fe`fcb31430 00000000`15f51bb8 00000000`003c1d60 : user32!DispatchClientMessage+0xc3
00000000`15e9f450 00000000`76f9b5cf : 00000000`003bd720 00000000`00000000 00000000`00000000 000007fe`fceb35a6 : user32!_fnINDEVICECHANGE+0x39c
00000000`15e9f510 00000000`76d2913a : 000007fe`f56210f4 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f5d8 000007fe`f56210f4 : 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 00000000`ffffffff : user32!NtUserRealInternalGetMessage+0xa
00000000`15e9f5e0 000007fe`f56211fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : duser!CoreSC::xwProcessNL+0x173
00000000`15e9f650 00000000`76d29181 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`76d29bdb : duser!MphProcessMessage+0xbd
00000000`15e9f6b0 00000000`76f9b5cf : 00000000`00000000 00000000`76d29368 00000000`00000000 00000000`76d29b2f : user32!_ClientGetMessageMPH+0x3d
00000000`15e9f740 00000000`76d2908a : 00000000`76d29059 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f7b8 00000000`76d29059 : 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a 00000000`76d29702 : user32!ZwUserPeekMessage+0xa
00000000`15e9f7c0 000007fe`e511085e : 00000000`15fc4c04 00000000`15fc4cc0 00000000`00000000 00000000`00000000 : user32!PeekMessageW+0x105
00000000`15e9f810 000007fe`e5114d89 : 00000000`15fc4cc0 00000000`00000013 00000000`00000000 00000000`00000000 : EXPLORERFRAME!CExplorerFrame::FrameMessagePump+0x5a
00000000`15e9f890 000007fe`e51154fb : 00000000`15fc4cc0 00000000`1512bff0 00000000`00000000 00000000`00000000 : EXPLORERFRAME!BrowserThreadProc+0x180
00000000`15e9f910 000007fe`e5115492 : 17f32b32`00000001 00000000`15fe9c30 00000000`15e9fa08 000007fe`fcb3b5a0 : EXPLORERFRAME!BrowserNewThreadProc+0x53
00000000`15e9f940 000007fe`e510be90 : 00000000`1557af00 00000000`003c28d0 00000000`00000000 00000000`000001b8 : EXPLORERFRAME!CExplorerTask::InternalResumeRT+0x12
00000000`15e9f970 000007fe`fd79efb7 : 80000000`01000000 00000000`15e9fa00 ffffffff`fffffffe 00000000`0000000b : EXPLORERFRAME!CRunnableTask::Run+0xda
00000000`15e9f9a0 000007fe`fd79eef7 : 00000000`1557af80 00000000`1611fd30 ffffffff`fffffffe 000007fe`fd2407e4 : shell32!CShellTask::TT_Run+0x124
00000000`15e9f9d0 000007fe`fd7a2bb2 : 00000000`1557af80 00000000`1557af80 00000000`00000000 00000000`00000010 : shell32!CShellTaskThread::ThreadProc+0xd0
00000000`15e9fa70 000007fe`ff0ac71e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x26
00000000`15e9faa0 00000000`76e259cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shlwapi!WrapperThreadProc+0x19b
00000000`15e9fba0 00000000`76f8385d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`15e9fbd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


THREAD_SHA1_HASH_MOD_FUNC: da5bffcc33f2bafbba02948bfdd78e36009d2a2d

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 38fcc11961b4bc87e57d274027de761e30cf4598

THREAD_SHA1_HASH_MOD: 6d61e634c2a91644881791475c3b5265fa3ac4c0

FAULT_INSTR_CODE: d88bd233

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: duser!CoreSC::xwProcessNL+173

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: duser

IMAGE_NAME: duser.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bdf26

STACK_COMMAND: ~5s ; .ecxr ; kb

FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_c0000005_duser.dll!CoreSC::xwProcessNL

BUCKET_ID: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_duser!CoreSC::xwProcessNL+173

FAILURE_EXCEPTION_CODE: c0000005

FAILURE_IMAGE_NAME: duser.dll

BUCKET_ID_IMAGE_STR: duser.dll

FAILURE_MODULE_NAME: duser

BUCKET_ID_MODULE_STR: duser

FAILURE_FUNCTION_NAME: CoreSC::xwProcessNL

BUCKET_ID_FUNCTION_STR: CoreSC::xwProcessNL

BUCKET_ID_OFFSET: 173

BUCKET_ID_MODTIMEDATESTAMP: 4a5bdf26

BUCKET_ID_MODCHECKSUM: 489a3

BUCKET_ID_MODVER_STR: 6.1.7600.16385

BUCKET_ID_PREFIX_STR: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_

FAILURE_PROBLEM_CLASS: APPLICATION_FAULT

FAILURE_SYMBOL_NAME: duser.dll!CoreSC::xwProcessNL

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/ex ... Retriage=1

TARGET_TIME: 2018-10-18T07:05:45.000Z

OSBUILD: 7601

OSSERVICEPACK: 24260

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 256

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) SingleUserTS

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-09-09 03:01:39

BUILDDATESTAMP_STR: 180908-0600

BUILDLAB_STR: win7sp1_ldr

BUILDOSVER_STR: 6.1.7601.24260

ANALYSIS_SESSION_ELAPSED_TIME: ce8a

ANALYSIS_SOURCE: UM

FAILURE_ID_HASH_STRING: um:software_nx_fault_c0000005_duser.dll!coresc::xwprocessnl

FAILURE_ID_HASH: {d1cce4a6-6e7b-bdc3-af00-bcf298405279}

Followup: MachineOwner
---------

[therube]

Not that I'm good at this stuff, it appears that Explorer itself has crashed.

Question is, I suppose, is Everything a contributing factor, or would the same have occurred if you performed the same operations outside of Everything?

And I gather that all Everything is doing, in essence, is making calls to system functions in order to display thumbnails or to view files.
(And in that respect, has MS ever been robust in media handling .)


PS: If you look at, 57c44efe, fairly quickly, you could read that as "McAfee" .


(Never seen an Explorer crash on my end [related to or during the use of Everything]. [Typically don't use thumbnails or file Previews.].)

[Debugger]

I do not use this program - McAfee.
In some cases, the Explorator crashes when I want to copy, delete folders with files (!!!). I was looking for a solution on many microsoft and other websites, but I have not found a solution anywhere for a long time. How to read this DMP file correctly?
I will add that this problem has always occurred on different PCs.

! analyze -v does not show the specific process or file that causes this problem.
On the microsoft site someone once posted a full command, where the log will contain more information, but I do not know the full command in the WinDbg program.
Does anyone know this advanced command?


I do not know the process, because the process, application or file that causes the program is "Unknown". How do I get to know its name?

[Debugger]

Not that I'm good at this stuff, it appears that Explorer itself has crashed.

Question is, I suppose, is Everything a contributing factor, or would the same have occurred if you performed the same operations outside of Everything?

And I gather that all Everything is doing, in essence, is making calls to system functions in order to display thumbnails or to view files.
(And in that respect, has MS ever been robust in media handling .)


PS: If you look at, 57c44efe, fairly quickly, you could read that as "McAfee" .


(Never seen an Explorer crash on my end [related to or during the use of Everything]. [Typically don't use thumbnails or file Previews.].)

It's better to debug the explorer application and the problem is caused by the library.
C:\Program Files (x86)\CoolUtils\TotalHTMLConverter\axTotalConverter64.dll