Explorer crashes by working with files and folders

[tucktuck2]

Hi everyone,


my windows explorer (Windows 10) is crashing most of the time by selecting multiple files or when I try to display the file/folder properties.

The Explorer is closing down then the Taskbar is empty and soon afterwards it is filled with th eicons again.

Error message from event viewer (german)



- System
- Provider
[ Name] .NET Runtime
- EventID 1026
[ Qualifiers] 0
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2020-11-06T10:15:47.5274568Z
EventRecordID 606
Correlation
- Execution
[ ProcessID] 0
[ ThreadID] 0
Channel Application
Computer KNIRSCH
Security

- EventData
Anwendung: explorer.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 00007FFA64F59267


- System
- Provider
[ Name] Application Error
- EventID 1000
[ Qualifiers] 0
Version 0
Level 2
Task 100
Opcode 0
Keywords 0x80000000000000

- TimeCreated
[ SystemTime] 2020-11-06T10:15:47.8171245Z
EventRecordID 607
Correlation
- Execution
[ ProcessID] 0
[ ThreadID] 0
Channel Application
Computer KNIRSCH
Security

- EventData
explorer.exe
10.0.19041.546
89ce2e55
shcore.dll
10.0.19041.546
0f272e72
c0000005
0000000000029267
3e40
01d6b412b510a74c
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\shcore.dll
322f569c-f2ee-4fab-a1d3-817ffd206dab


A few days ago always ntdll.dll was mentioned but now it is only shcore.dll

Unfortunatelly I only have a dump for the shcore.dll events.

One dump from yesterday:


*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************


KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.Sec
Value: 17

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on KNIRSCH

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 1676

Key : Analysis.Memory.CommitPeak.Mb
Value: 342

Key : Analysis.System
Value: CreateObject

Key : CLR.Engine
Value: CLR

Key : CLR.NOSOS
Value: 1

Key : CLR.Version
Value: 4.0.30319.0

Key : Timeline.OS.Boot.DeltaSec
Value: 433343

Key : Timeline.Process.Start.DeltaSec
Value: 17270


NTGLOBALFLAG: 2000100

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS: 48004

APPLICATION_VERIFIER_LOADED: 1

CONTEXT: (.ecxr)
rax=00007ffb3c0b50f8 rbx=0000000080004005 rcx=00000000176adb40
rdx=00007ffb653230f0 rsi=0000000000000000 rdi=00000000176adb40
rip=00007ffb652c8417 rsp=000000000926dad0 rbp=000000000926dd20
r8=000000000926db20 r9=0000000019a2c1d0 r10=00000fff65d398d4
r11=ffffffffffffffff r12=0000000000000000 r13=00000000000003e0
r14=0000000002360b15 r15=000000000963fb60
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
SHCore!IUnknown_SetSite+0x27:
00007ffb`652c8417 488b00 mov rax,qword ptr [rax] ds:00007ffb`3c0b50f8=????????????????
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffb652c8417 (SHCore!IUnknown_SetSite+0x0000000000000027)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00007ffb3c0b50f8
Attempt to read from address 00007ffb3c0b50f8

PROCESS_NAME: explorer.exe

READ_ADDRESS: 00007ffb3c0b50f8

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 00007ffb3c0b50f8

MISSING_CLR_SYMBOL: 0

ADDITIONAL_DEBUG_TEXT: SOS.DLL is not loaded for managed code. Analysis might be incomplete

STACK_TEXT:
00000000`0926dad0 00007ffb`65d11228 : 00000000`00000000 00000000`0926dd20 00000000`00000000 00000000`02600000 : SHCore!IUnknown_SetSite+0x27
00000000`0926db10 00007ffb`65d111c1 : 00000000`0b47afa0 00007ffb`669bfb50 00000000`00000000 00007ffb`57201e1c : shell32!HDXA_SetSite+0x40
00000000`0926db40 00007ffb`652c8439 : 00000000`80004005 00007ffb`669bfb50 00007ffb`64b049b0 00007ffb`57224350 : shell32!CDefFolderMenu::SetSite+0x21
00000000`0926db70 00007ffb`44aa61fa : 00000000`00000000 00007ffb`57226168 00000000`0b47afa0 00000000`00000000 : SHCore!IUnknown_SetSite+0x49
00000000`0926dbb0 00007ffb`652c8439 : 00000000`80004005 00000000`00000000 00000000`0926dcc8 00000000`0deaf9b0 : explorerframe!CContextMenuOnContextMenuArray::SetSite+0x2a
00000000`0926dbe0 00007ffb`44a256c8 : 00000000`0deaf9b0 00000000`0963f980 00000000`19394000 00007ffb`44b16a10 : SHCore!IUnknown_SetSite+0x49
00000000`0926dc20 00007ffb`449dba0d : 00000000`0926f840 00007ffb`44b18600 00000000`00000004 00000000`0963f980 : explorerframe!CNscTree::_OnContextMenu+0x8a4
00000000`0926e030 00007ffb`4499ad23 : 00000000`00000000 00007ffb`57212abd 00000000`00000000 00000000`0926ee58 : explorerframe!CNscTree::_OnNotify+0x40b11
00000000`0926e240 00007ffb`449659ee : 00000000`0963fa68 00000000`00000064 00000000`001a08f6 00000000`00000001 : explorerframe!CNscTree::v_WndProc+0x43
00000000`0926e2b0 00007ffb`66375c1d : 00000000`00000001 00000000`00000064 00000000`00000000 00000000`80000022 : explorerframe!CImpWndProc::s_WndProc+0x6e
00000000`0926e2f0 00007ffb`663758ee : 00000000`001a08f6 00007ffb`44965980 00000000`001a08f6 00000000`0000004e : user32!UserCallWinProcCheckWow+0x2bd
00000000`0926e480 00007ffb`572ebc89 : 00000000`0926e710 00000000`0926ee58 00000000`00000064 00000000`037a0000 : user32!CallWindowProcW+0x8e
00000000`0926e4d0 00007ffb`572ebbd7 : 00000000`00000001 00000000`08b985b0 00000000`001a08f6 00007ffb`66a356a4 : comctl32!CallNextSubclassProc+0x89
00000000`0926e540 00007ffb`4496ad41 : 00000000`001a08f6 00000000`00000000 00000000`0000004e 00000000`11000003 : comctl32!DefSubclassProc+0x77
00000000`0926e590 00007ffb`449633ef : 00000000`ffffffff 00000000`0963fa10 00000000`00000000 00007ffb`57212abd : explorerframe!CNotifySubclassWndProc::_DefWindowProc+0x41
00000000`0926e5d0 00007ffb`572ebc89 : 00000000`001a08f6 00000000`0926e710 00000000`00000064 00000000`00000001 : explorerframe!CNotifySubclassWndProc::s_SubclassWndProc+0xcf
00000000`0926e650 00007ffb`572ebab2 : 00000000`00000001 00000000`00000064 00000000`001a08f6 00007ffb`57211bed : comctl32!CallNextSubclassProc+0x89
00000000`0926e6c0 00007ffb`66375c1d : 00000000`00000001 00000000`00000064 00000000`00000000 00000000`0926e980 : comctl32!MasterSubclassProc+0xa2
00000000`0926e760 00007ffb`663758ee : 00000000`001a08f6 00007ffb`572eba10 00000000`001a08f6 00000000`0000004e : user32!UserCallWinProcCheckWow+0x2bd
00000000`0926e8f0 00007ffb`4548df35 : 00000000`0c0bf710 00000000`0926ee58 00000000`00000000 00000000`0000004e : user32!CallWindowProcW+0x8e
00000000`0926e940 00007ffb`58251538 : 00000000`00000000 00000000`00000000 00000000`0000004e 00000000`001a08f6 : duser!WndBridge::RawWndProc+0xa5
00000000`0926e9c0 00007ffb`66375c1d : 00000000`00000001 00000000`0926ed40 00000000`00000000 00000000`00000000 : atlthunk!AtlThunk_0x1B+0x18
00000000`0926ea00 00007ffb`663757ec : 00000000`00000388 00007ffb`58251520 00000000`001a08f6 00000000`80000000 : user32!UserCallWinProcCheckWow+0x2bd
00000000`0926eb90 00007ffb`66381f83 : 00000000`00000000 00000000`00000000 00000000`00000064 00000000`00000007 : user32!DispatchClientMessage+0x9c
00000000`0926ebf0 00007ffb`66a1fe34 : 00000000`00000000 00007ffb`6637f775 00000000`00000001 00000000`00000000 : user32!_fnDWORD+0x33
00000000`0926ec50 00007ffb`63c11184 : 00007ffb`6637511b 00007ffb`66375ee0 00007ffb`57226be0 00005bc1`00000002 : ntdll!KiUserCallbackDispatcherContinue
00000000`0926ecd8 00007ffb`6637511b : 00007ffb`66375ee0 00007ffb`57226be0 00005bc1`00000002 00000000`0926ee69 : win32u!NtUserMessageCall+0x14
00000000`0926ece0 00007ffb`66374f98 : 00000000`00000000 00000000`00000000 00000000`00000064 00000000`061ac690 : user32!SendMessageWorker+0x11b
00000000`0926ed80 00007ffb`572f8325 : 00000000`0926ee58 00000000`00000001 00000000`0926ee99 00000000`001a08f6 : user32!SendMessageW+0xf8
00000000`0926ede0 00007ffb`5738ed32 : 00000000`0e992d20 00000000`0e992d20 00000000`0931a6c0 00000000`0931a6c0 : comctl32!CCSendNotify+0x105
00000000`0926ef00 00007ffb`5731bc1e : 00000000`00000004 00000000`00000001 00000000`0926eff9 00000000`00000000 : comctl32!TV_SendRButtonDown+0xb2
00000000`0926ef50 00007ffb`66375c1d : 00000000`00000001 00000000`00000002 00000000`00000000 00000000`00000000 : comctl32!TV_WndProc+0x9421e
00000000`0926f060 00007ffb`663758ee : 00000000`00340686 00007ffb`57287a00 00000000`00340686 00000000`00000204 : user32!UserCallWinProcCheckWow+0x2bd
00000000`0926f1f0 00007ffb`572ebc89 : 00000000`0926f480 00000000`0323008a 00000000`00000002 00000000`ffffffc4 : user32!CallWindowProcW+0x8e
00000000`0926f240 00007ffb`572ebbd7 : 00000000`00000001 00000000`0df3f390 00000000`00340686 00000000`00000204 : comctl32!CallNextSubclassProc+0x89
00000000`0926f2b0 00007ffb`4499e23b : 00000000`00000000 00000000`00000002 00000000`00000204 00007ffb`665ca9bc : comctl32!DefSubclassProc+0x77
00000000`0926f300 00007ffb`4499e17b : 00000000`0963f980 00000000`0963f980 00007ffb`66a1bf70 00000000`00000204 : explorerframe!CNscTree::_SubClassTreeWndProc+0x7b
00000000`0926f380 00007ffb`572ebc89 : 00000000`0926f480 00000000`00000001 00000000`00000002 00000000`00000001 : explorerframe!CNscTree::s_SubClassTreeWndProc+0x5b
00000000`0926f3c0 00007ffb`572ebab2 : 00000000`00000001 00000000`00000002 00000000`00340686 00007ffb`57211bed : comctl32!CallNextSubclassProc+0x89
00000000`0926f430 00007ffb`66375c1d : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000001 : comctl32!MasterSubclassProc+0xa2
00000000`0926f4d0 00007ffb`66375612 : 00000000`06188980 00007ffb`572eba10 00000000`00340686 00000000`0926f710 : user32!UserCallWinProcCheckWow+0x2bd
00000000`0926f660 00007ffb`449488d3 : 00007ffb`572eba10 00000000`0e3f5050 00000000`0e4d32f0 00000000`19f982e0 : user32!DispatchMessageWorker+0x1e2
00000000`0926f6e0 00007ffb`449487d9 : 00000000`0e3f5050 00000000`00000003 00000000`00000000 00000000`0e4d32f0 : explorerframe!CExplorerFrame::FrameMessagePump+0xe3
00000000`0926f760 00007ffb`44947e92 : 00000000`0e3f5050 00000000`00000000 00000000`00000000 00007ffb`5721f6e4 : explorerframe!BrowserThreadProc+0x85
00000000`0926f7e0 00007ffb`44947e42 : 192fdce4`00000001 00000000`16da9bc0 00000000`00000000 00007ffb`57212d23 : explorerframe!BrowserNewThreadProc+0x3a
00000000`0926f810 00007ffb`4496a502 : 00000000`0c7d8e60 00000000`0926fa09 ffffffff`fffffffe 00000000`00000000 : explorerframe!CExplorerTask::InternalResumeRT+0x12
00000000`0926f840 00007ffb`641be1c4 : 00000000`00000000 00000000`00000000 00000000`0cac4250 00000000`00000009 : explorerframe!CRunnableTask::Run+0xb2
00000000`0926f880 00007ffb`641bde05 : 00000000`0c7d8e60 ffffffff`fffffffe 00000000`0926fa09 ffffffff`fffffffe : windows_storage!CShellTask::TT_Run+0x3c
00000000`0926f8b0 00007ffb`641bdce5 : 00000000`0c7d8e60 00000000`0c7d8e60 00000000`0926fa09 00000000`00000000 : windows_storage!CShellTaskThread::ThreadProc+0xdd
00000000`0926f960 00007ffb`652cc235 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : windows_storage!CShellTaskThread::s_ThreadProc+0x35
00000000`0926f990 00007ffb`5721e684 : 00000000`00000000 00000000`00000000 00000000`1feb7900 00000000`00000000 : SHCore!_WrapperThreadProc+0xf5
00000000`0926fa70 00007ffb`665c7c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : verifier!AVrfpStandardThreadFunction+0x44
00000000`0926fab0 00007ffb`669ecea1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000000`0926fae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


SYMBOL_NAME: SHCore!IUnknown_SetSite+27

MODULE_NAME: SHCore

IMAGE_NAME: SHCore.dll

STACK_COMMAND: ~64s ; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_READ_NOSOS_AVRF_c0000005_SHCore.dll!IUnknown_SetSite

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {df6fdc38-1b30-7043-9686-5c72b13eb53e}

Followup: MachineOwner
---------

0:064>
ExceptionAddress: 00007ffb652c8417 (SHCore!IUnknown_SetSite+0x0000000000000027)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00007ffb3c0b50f8
Attempt to read from address 00007ffb3c0b50f8


Is it probably faulty RAM?


Thanks

Continue reading...