[stern]

Hi

I am using IE8 and very often when I use explorer a message appears saying ''Windows Explorer has stopped wotking'' followed by ''Windows is checking for a solution to the problem'' eventually it goes on to say ''Windows Explorer is restarting''

The bottom line is, as long as this happens I am unable to use explorer. H/ever if I restart my PC, I am able to use explorer, but at a later stage the same thiing reoccurs which as you can imagine is very frustrating.

Can anyone suggest what might possibly be causing this problem. Any further information required will be glad to proviide to best of my ability.

Thanks
Stern

[Advertisements]

You'll have to check your Event Viewer for errors relating to this, and then post that information here.

To do this, go to Start and type in "eventvwr.msc" (without the quotes) and press Enter.
Expand the Windows Logs category, and check both the Application and System logs for errors around the time that explorer.exe crashed. Those error entries will have some information on the crashes, please post that in your next reply.

[usasma]

You'll have to check your Event Viewer for errors relating to this, and then post that information here.

To do this, go to Start and type in "eventvwr.msc" (without the quotes) and press Enter.
Expand the Windows Logs category, and check both the Application and System logs for errors around the time that explorer.exe crashed. Those error entries will have some information on the crashes, please post that in your next reply.

[stern]

Hi

Went through the procedure suggested and found many errors. As hinted previously this irregularity has been happening on a regular basis. There are many instances in the application log referring to windows explorer over a period of time. Being a novice I really don't know / understand much of the details which I am about to send. The fact there are so many I will only venture to send those referring to yesterday.
Not quite sure if I should be sending them all, as apart from a few differences here and there, to me they all appear similar. No doubt you will be able to decipher

quote

Log Name: Application
Source: Application Error
Date: 23/04/2009 12:14:47
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x1698, application start time 0x01c9c3fc048972cd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T10:14:47.000Z" />
<EventRecordID>41060</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>1698</Data>
<Data>01c9c3fc048972cd</Data>
</EventData>
</Event>


Log Name: Application
Source: Application Error
Date: 23/04/2009 12:12:26
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0xa84, application start time 0x01c9c3f9a1350d3d.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T10:12:26.000Z" />
<EventRecordID>41058</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>a84</Data>
<Data>01c9c3f9a1350d3d</Data>
</EventData>
</Event>

Log Name: Application
Source: Application Error
Date: 23/04/2009 11:55:20
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x105c, application start time 0x01c9c3f15c6f488d.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T09:55:20.000Z" />
<EventRecordID>41054</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>105c</Data>
<Data>01c9c3f15c6f488d</Data>
</EventData>
</Event>

Log Name: Application
Source: Application Error
Date: 23/04/2009 10:56:09
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x16f0, application start time 0x01c9c3f142aae8ad.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:56:09.000Z" />
<EventRecordID>41050</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>16f0</Data>
<Data>01c9c3f142aae8ad</Data>
</EventData>
</Event>



Log Name: Application
Source: Application Error
Date: 23/04/2009 10:55:26
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x17cc, application start time 0x01c9c3f1297beafd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:55:26.000Z" />
<EventRecordID>41048</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>17cc</Data>
<Data>01c9c3f1297beafd</Data>
</EventData>
</Event>

Log Name: Application
Source: Application Error
Date: 23/04/2009 10:54:44
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x1568, application start time 0x01c9c3eda23583bd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:54:44.000Z" />
<EventRecordID>41046</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>1568</Data>
<Data>01c9c3eda23583bd</Data>
</EventData>
</Event>

Log Name: Application
Source: Application Error
Date: 23/04/2009 10:29:28
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0xa90, application start time 0x01c9c3ed8501788d.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:29:28.000Z" />
<EventRecordID>41043</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>a90</Data>
<Data>01c9c3ed8501788d</Data>
</EventData>
</Event>



Log Name: Application
Source: Application Error
Date: 23/04/2009 10:28:39
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x864, application start time 0x01c9c3ed631fc3cd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:28:39.000Z" />
<EventRecordID>41041</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>864</Data>
<Data>01c9c3ed631fc3cd</Data>
</EventData>
</Event>


Log Name: Application
Source: Application Error
Date: 23/04/2009 10:28:39
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x864, application start time 0x01c9c3ed631fc3cd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:28:39.000Z" />
<EventRecordID>41041</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>864</Data>
<Data>01c9c3ed631fc3cd</Data>
</EventData>
</Event>

Log Name: Application
Source: Application Error
Date: 23/04/2009 10:27:42
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0xb54, application start time 0x01c9c3e6025ca9bd.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-23T08:27:42.000Z" />
<EventRecordID>41037</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>b54</Data>
<Data>01c9c3e6025ca9bd</Data>
</EventData>
</Event>



Log Name: Application
Source: Application Error
Date: 22/04/2009 23:43:28
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Knox-PC
Description:
Faulting application explorer.exe, version 6.0.6001.18164, time stamp 0x4907e242, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc000071c, fault offset 0x00089825, process id 0x1440, application start time 0x01c9c391f276e21f.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-22T21:43:28.000Z" />
<EventRecordID>40964</EventRecordID>
<Channel>Application</Channel>
<Computer>Knox-PC</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e242</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791a7a6</Data>
<Data>c000071c</Data>
<Data>00089825</Data>
<Data>1440</Data>
<Data>01c9c391f276e21f</Data>
</EventData>
</Event>

ûnquote

[usasma]

The errors state that ntdll.dll crashed in explorer.exe with the exception code 0xc000071c (STATUS_INVALID_THREAD)

An invalid thread, handle %p, is specified for this operation. Possibly, a threadpool worker thread was specified.

What this tells us is that ntdll.dll is trying to launch something that's not valid. This can be malware, corrupted files, non-existent files, or other problems. So, it's a start - but isn't a whole bunch of help.

So, let's try two things:

1 - search your hard drive for files ending in .mdmp If you don't find any, wait for the next crash but DO NOT dismiss the Error Reporting dialog (if Error Reporting is turned off, it'll have to be turned back on for this). What will happen is that Windows will save the .mdmp file in a Temporary file on your hard drive. The details link of the Error Reporting dialog will give you the location. Save the file to another location before closing the Error Reporting dialog. Once you capture the .mdmp file, upload it here for us to have a look at (we'll analyze it using the same tools that we use for BSOD's - but the output will be a bit different).

2 - Download this free tool from Microsoft: http://www.microsoft...ssExplorer.mspx
Install it on your system and open it. Right click on the explorer.exe process and select properties, then select the threads tab. Take a look at the threads running to see if you can spot anything running that starts with "ntdll.dll" (without the quotes). Let us know what the rest of the Start Address says for each thread that starts with ntdll.dll

Then keep an eye on it to see if anything strange happens with the ntdll.dll threads. Then attempt to force an explorer.exe crash, again keeping your eye on the ntdll.dll threads. If nothing reveals itself we may have to resort to another free Microsoft tool called Process Monitor (but I prefer to avoid this because the log files can consume your entire hard drive if left unattended).

[DeadEyeRS]

Not sure if this was ever resolved for you or not.. I had the same problem. I solved this problem by uninstalling the last thing I could remember installing. Which happen to be K-lite Codec pack x64 beta... The problem was solved instantly. Maybe it is something similar for you. Codecs can be tricky little things! I believe it is related to the programs that are used to open the files in the folder... ie. Nero, Cycerdvd etc

Edited by DeadEyeRS, 25 April 2009 - 11:29 AM.

[stern]

Hi Guys

Late response regretted but this is due to fact ran into a major problem which has not yet been solved. I am currently using anoth PC to respond,

The problem was, very suddenly discovered that I no longer had Internet connection. Contact my provider and according to them there was no problem with the line. This I evently had to accept because I was able to connect using another PC. This I assume there was a problem with PC.

In any event when it was discovered that connecting to Internet was not possible, I wasseeing several notification on my monitor which I made a note of. They are as follows:

quote

Unable to start the core engine .The application cannot continue.

Failed to connect to a windows service

Failed to connect to a Windows service Windows could not connect to this system event notification service. This problem prevents limited users from logging on to the system.

As an administrator user, you can review the system event log for details about why the service didn’t respond.

Critical socket error 2.11003

Event log service is unavailable. Verify that the service is running

unquote

Not being really PC orientated, most of it was beyond me and t/fore in process of trying to get some help as to what might be the cause of the above mentioned.

This of course means that until problem sorted, won't be able to carry out the procedure from your last input.

Thanks for help thus far

[usasma]

Search the hard drive for the .mdmp file(s) and copy them to a flash drive or other removable media.
Carry it over to the PC that you used to post this, and zip it up and upload it here for us to take a look at.

You can also download the Process Explorer program to a flash drive on the computer that you're using, then carry it over to the other one and install it from there.

You can also post over in the Malware section ( http://www.geekstogo...emoval-f37.html ) for some help in downloading tools to check the other computer with.

Edited by usasma, 13 May 2009 - 06:23 PM.