Hello.
I've been having issues with 4 computers now. All of them Windows 7 Professional 32 bits.
The error they're having is the same on each PC: explorer.exe fails and restarts after clicking Ok to the dialog.
Level: Error Source: Application Error Event ID: 1000 Faulting application: explorer.exe, version: 6.1.7601.175xx, time stamp: <changes> faulting module: unknown, version: 0.0.0.0, time stamp: 0x00000000 exception code : 0xc0000005 fault offset: <changes> process id: <changes> application start time: <changes>
The oldest issue is november 6th (there's not a single instance of the error before that date); since then the issue is happening at least once a day but more like 5-10 times a day.
I ran Windbg and for almost all errors it point to fundisc.dll as the culprit.
This is one of the dumps:
Loading Dump File [C:\Users\<user>\Desktop\<other_user>\explorer.exe.680.dmp] User Mini Dump File: Only registers, stack and portions of memory are available Symbol search path is: srv*;D:\WinDbg\Symbols\Win7AMD64;D:\WinDbg\Symbols\Win7x86;D:\WinDbg\Symbols\XPSP3 Executable search path is: D:\WinDbg\Image\XPSP3 Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible Product: WinNt, suite: SingleUserTS Machine Name: Debug session time: Tue Nov 20 09:43:21.000 2012 (UTC - 6:00) System Uptime: not available Process Uptime: 0 days 0:06:02.000 ................................................................ ........................................................... Loading unloaded module list ........ This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (2a8.884): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=0472f040 ecx=00000400 edx=00000000 esi=00000002 edi=00000000 eip=77c57094 esp=0472eff0 ebp=0472f08c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 77c57094 c3 ret 0:012> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* Unable to load image C:\Windows\System32\ieframe.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ieframe.dll FAULTING_IP: +0 0472f64c fc cld EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 0472f64c ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000008 Parameter[1]: 0472f64c Attempt to execute non-executable address 0472f64c DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT PROCESS_NAME: explorer.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s. EXCEPTION_PARAMETER1: 00000008 EXCEPTION_PARAMETER2: 0472f64c WRITE_ADDRESS: 0472f64c FOLLOWUP_IP: fundisc!CNotificationQueue::ThreadProc+31b 728963ee bfc0808a72 mov edi,offset fundisc!WPP_GLOBAL_Control (728a80c0) FAILED_INSTRUCTION_ADDRESS: +31b 0472f64c fc cld NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: explorer.exe LAST_CONTROL_TRANSFER: from 76aa5d3f to 0472f64c FAULTING_THREAD: 00000884 PRIMARY_PROBLEM_CLASS: SOFTWARE_NX_FAULT BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT IP_ON_STACK: +31b 0472f64c fc cld STACK_TEXT: WARNING: Frame IP not in any known module. Following frames may be wrong. 0472f64c 76aa5d3f 00000008 03207428 fffffffe 0x472f64c 0472f7fc 76ad8f82 2246d5ac 03207428 00000000 ole32!COIDTable::ThreadCleanup+0xcb 0472f840 76ad8ec3 00000000 0472f890 76bd7724 ole32!FinishShutdown+0x9d 0472f860 76acbac3 00000000 728945f0 03207428 ole32!ApartmentUninitialize+0x96 0472f878 76ad88e8 0472f890 00000000 728a810c ole32!wCoUninitialize+0x153 0472f894 728963ee 00000000 00000000 0015c9d0 ole32!CoUninitialize+0x72 0472f8b0 77aded6c 0015c9d0 0472f8fc 77c7377b fundisc!CNotificationQueue::ThreadProc+0x31b 0472f8bc 77c7377b 0015c9d0 73c46ab8 00000000 kernel32!BaseThreadInitThunk+0xe 0472f8fc 77c7374e 72895224 0015c9d0 00000000 ntdll!__RtlUserThreadStart+0x70 0472f914 00000000 72895224 0015c9d0 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: .ecxr ; kb ; ~12s; .ecxr ; kb SYMBOL_STACK_INDEX: 6 SYMBOL_NAME: fundisc!CNotificationQueue::ThreadProc+31b FOLLOWUP_NAME: MachineOwner MODULE_NAME: fundisc IMAGE_NAME: fundisc.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bd9ff FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_c0000005_fundisc.dll!CNotificationQueue::ThreadProc BUCKET_ID: APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_IP_fundisc!CNotificationQueue::ThreadProc+31b WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_17567/4d6727a7/unknown/0_0_0_0/bbbbbbb4/c0000005/0472f64c.htm?Retriage=1 Followup: MachineOwner ---------
There's another similar error but points to "NetworkItemFactory" module instead of "fundisc", but i'm not sure they're related yet.
I already:
- Ran viruschecks and spywarescans and the computers are clean.
- clean booted and the issue persists.
- sfc'd and no files were corrupt.
They all are HP Compaq 8000 series; besides that, the only other thing i can think of that could be common between those particular machines is that not all of them may had been wiped out when bought and the problems came from the bloatware and some update.
The only updates they had installed were security and critical updates via WSUS.
I'm starting to worry and i'm out of ideas.
Any help will be appreciated.
"When something is not working as it is supposed to, then it is working as expected" -R