Windows Explorer Crashing

For the last few month I've been experiencing Windows Explorer crashes - window freezes and popup says it's encountered a problem and needs to be restarted. It's getting annoying, so thought I'd better investigate.

The event log entry always looks pretty much the same, except for the time and the Faulting process id: which do change. Latest entries for the Faulting process id: are 0xe18, 0x1458, 0x1878, 0xbf4, 0x1824

Latest full log entry is:
Log Name: Application
Source: Application Error
Date: 18/01/2016 14:23:42
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: xxxxxxxx
Description:
Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace4e7
Exception code: 0xc0000005
Fault offset: 0x000000000001e1ac
Faulting process id: 0x1824
Faulting application start time: 0x01d151f6786ad0b3
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\MSVCR90.dll
Report Id: 130015d9-bdef-11e5-84bb-10bf48bac320
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-01-18T14:23:42.000000000Z" />
<EventRecordID>101373</EventRecordID>
<Channel>Application</Channel>
<Computer>xxxxxxxx</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.1.7601.17567</Data>
<Data>4d672ee4</Data>
<Data>MSVCR90.dll</Data>
<Data>9.0.30729.6161</Data>
<Data>4dace4e7</Data>
<Data>c0000005</Data>
<Data>000000000001e1ac</Data>
<Data>1824</Data>
<Data>01d151f6786ad0b3</Data>
<Data>C:\Windows\Explorer.EXE</Data>
<Data>C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\MSVCR90.dll</Data>
<Data>130015d9-bdef-11e5-84bb-10bf48bac320</Data>
</EventData>
</Event>

I've done a full AV scan (Avast), and Malwarebytes scan, nothing found.
Any ideas what the problem is, or how I should investigate further?

(Win7 Pro SP1 up to date, 16Gb RAM, 256Mb SSD C: drive, 1Gb HDD D: data drive, Avast AV, W7 Firewall)

 

If you haven't already run it, carry out the system file checker: sfc /scannow
https://support.microsoft.com/en-gb/kb/929833
It needs to be run from an ADMINISTRATOR command prompt.

 

Done now, no problems reported.

 

davidm_uk...

Some information that may help:

https://social.technet.microsoft.co...with-fault-in-msvcr90dll?forum=w7itprogeneral

Are you clicking on anything when the crashes occur (like accessing a folder, etc.)? A specific type of file would help if it's a file you are trying to open. See here for Explorer.exe crashes with the same faulthing module (MSVCR90.dll) caused by a LibreOffice file:

http://answers.microsoft.com/en-us/...g/98ada2d3-06f4-479b-812c-d8c3bd37fea3?auth=1

Reaching the solution in the 2nd thread above involved the user creating a dump file for the Explorer event that is more specific to the problem than the standard crash data. If you don't have an idea what might be triggering the crashes (file type such as .odf or .xls, etc.) it might be a good idea to wait for Satrow or another of the experienced dump readers (or maybe MaxTurner has a better suggestion or can do this) to assist with this.

If you do have some idea, then you might try reinstalling the application. For example, if .xls files are causing the crashes, you might try reinstalling Excel (or Office if required).

The user in the second thread was using Vista and not W8. I am not sure what the registry call in Windows 8 would be for creating the Explorer.exe dump (as in the registry merge in the thread)...

 

Just happened again. Had just opened WE and was navigating to a sub folder when it crashed, so not even trying to open, copy or move a file, or start an application. Details displayed in error popup:

Problem signature:
Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 6.1.7601.17567
Application Timestamp: 4d672ee4
Fault Module Name: MSVCR90.dll
Fault Module Version: 9.0.30729.6161
Fault Module Timestamp: 4dace4e7
Exception Code: c0000005
Exception Offset: 000000000001e1ac
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 2057
Additional Information 1: 9995
Additional Information 2: 9995d827945b06c0d4281da711537947
Additional Information 3: d4cd
Additional Information 4: d4cd2a5d579c03ef5360c841a25f2898

I'll investigate the link above re creating a dump file.

 

OK, here's the crash dump file for that latest crash one my OneDrive: http://1drv.ms/1OCkmZ7
The PC was saving the dumps anyway once I found the location they were being saved to.

Edit: oh, and I don't have Libre Office installed, as seems to be a favourite response on other web forums to WE crashes.

 

davidm_uk

I installed the Windows debugger, but I find that I cannot find information on how to use the debugger to open the .dmp file you created. I was only able to find outdated instructions.

I guess you used the registry merge to create the file, so I suggest posting the link in the thread on the MS Answers site or perhaps starting a new thread there. There are some minidump experts around MGs who can break them down, but this larger type of dump file I feel like you will find more help for on an MS site.

Maybe you could contact the user who had the solution in the 2nd link posted previously. He was able to read the .dmp in that thread.

Apologies that I don't have an answer. After I read the thread and realized this type of dump analysis might be required, I started thinking that going to MS might be the quickest way for you to find out what's happening. With the .dmp link in hand, I should think you will be able to get quick help...

 

Code:

STACK_TEXT: 
00000000`05f8f1b8 000007fe`f69e3dee : 0000510f`51f27511 00000000`05f8f2c0 00000000`05f8f718 00000000`00000005 : msvcr90!strncmp+0x4c
00000000`05f8f1c0 000007fe`f69e2a0f : 00000000`00000000 00000000`05f8f2c0 00000000`01fb70f0 00000000`05f8f2c8 : googledrivesync64!DllCanUnloadNow+0x1b7e
00000000`05f8f1f0 000007fe`f69e2f8d : 00000000`00000001 00000000`002ba888 00000000`00000000 00000000`01fb7090 : googledrivesync64!DllCanUnloadNow+0x79f
00000000`05f8f270 000007fe`fe8a6983 : 00000000`002ba870 000007fe`00000000 00000000`002c7920 00000000`002ba888 : googledrivesync64!DllCanUnloadNow+0xd1d
00000000`05f8f310 000007fe`fe9c0e00 : 00000000`80004005 000007fe`fe8a261b 00000000`05f8f3f0 00000000`00000001 : shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0x13e
00000000`05f8f3d0 000007fe`fe8a1b8f : ffffffff`eeebb0a0 00000000`00000001 00000000`00000000 000007fe`fe4544e7 : shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x1c
00000000`05f8f410 000007fe`fe8a1aa0 : 00000000`1137dda0 00000000`00000000 00000000`112ac860 0000510f`51edef52 : shell32!CFSFolder::_GetOverlayInfo+0xf1
00000000`05f8f6b0 000007fe`fe8a9217 : 00000000`0afa5840 00000000`11154560 00000000`05f8f718 00000000`0af09df0 : shell32!CFSFolder::GetOverlayIndex+0x23
00000000`05f8f6e0 000007fe`fe8cc600 : 00000000`0b0fd400 00000000`11154560 00000000`00000000 00000000`00000000 : shell32!CIconOverlayTask::InternalResumeRT+0x129
00000000`05f8f760 000007fe`fe8ff087 : 80000000`01000000 00000000`05f8f7f0 ffffffff`fffffffe 00000000`0000000a : shell32!CRunnableTask::Run+0xda
00000000`05f8f790 000007fe`fe8fefc7 : 00000000`0b0fd400 00000000`0b0a3bb0 ffffffff`fffffffe 00000000`00000002 : shell32!CShellTask::TT_Run+0x124
00000000`05f8f7c0 000007fe`fe902c82 : 00000000`0b0fd400 00000000`0b0fd400 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::ThreadProc+0xd0
00000000`05f8f860 000007fe`fe453843 : 00000000`026ce100 00000000`0b0fda60 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x26
00000000`05f8f890 00000000`776b0d4b : 00000000`1115a440 000007ff`fff7c000 00000000`00000000 000007fe`0000000d : shlwapi!ExecuteWorkItemThreadProc+0xf
00000000`05f8f8c0 00000000`776b03c6 : 00000000`00000000 00000000`0b0fda60 00000000`002ac240 00000000`027484b8 : ntdll!RtlpTpWorkCallback+0x16b
00000000`05f8f9a0 00000000`774859ed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x5ff
00000000`05f8fca0 00000000`776bb831 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`05f8fcd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

The stack trace seems to implicate googledrivesync64.dll which is a shell extension related to Google Drive.

You could use ShellExView (64 Bit) to temporarily disable the shell extension to see if that resolves the explorer crashes.

 

There's no entry in ShellExView for googledrivesync64.dll in the Filename column, however I've now disabled GoogleSync from running at startup, and set the option for context menu entries to off, rebooted machine and checked with Process Explorer that there's nothing with the words googlesync running either in processes or Google process related dlls.

I'll leave it like this for a few days to see if this makes any difference and then report back. I only have few files in my Google Sync folder anyway, which I use to sync them to a tablet, so having it turned off for a while isn't a problem.

Thanks for the help so far.

 

If you want to try just disabling the shell extension, in ShellExView it will be listed multiple times as Google Drive Shell extension.
If you right click on Google Drive Shell extension and select File properties, it should point to googledrivesync64.dll
From there you can also disable the selected item(s)

 

At the moment there's nothing listed in ShellExView in any column with the word google in it, so I'm content to leave it like that for a few days.

 

Just to report back.

Having disabled GoogleSync the problem disappeared. After a few days I then re enabled GoogleSync, but on the Preferences...Advanced tab.....System settings left the "Show file sync status icons and right click menu" box unticked.

The problem hasn't reappeared - so far.

Thanks for your help.