"Explorer has generated errors and will be closed by Windows..."

I have reformatted and reinstalled Win2000 ver 5.00.2195 (Service Pack 4), but constantly get the error: "Explorer has generated errors and will be closed by Windows... ".

In Event Viewer, it alternately gives the Dr. Watson error, "The application, explorer.exe, generated an application error The error occurred on 09/01/2004 @ 18:38:03.245 The exception generated was c0000005 at address 77C72A84 (Ordinal169) ". Event: 4097.
....Appl
0008: 69 63 61 74 69 6f 6e 20 ication
0010: 65 78 63 65 70 74 69 6f exceptio
0018: 6e 20 6f 63 63 75 72 72 n occurr
0020: 65 64 3a 0d 0a 20 20 20 ed:..
0028: 20 20 20 20 20 41 70 70 App
0030: 3a 20 65 78 70 6c 6f 72 : explor
0038: 65 72 2e 65 78 65 20 28 er.exe (
0040: 70 69 64 3d 39 33 32 29 pid=932)

then the Winlogon error: "The shell stopped unexpectedly and Explorer.exe was restarted ". Event 1002.

Following this, all Windows Explorer/My Computer windows close - no other application windows are affected. This happens about 2 or 3 times an hour, on an average. There has to be a fix for this most annoying problem...

TIA.

 

go look for a user.dmp, and run it through the tool in my signature

 

Thanks for your amazingly swift response. I will certainly do that. I already see hope for me. It looks like this tool is going to help.

Will soon post the results. Thanks.

 

Hmmm...okay, that's what I did. But I got the following:

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp]
Could not match Dump File signature - invalid file format
Could not open dump file [C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp], HRESULT 0x80004002
"No such interface supported "

 

That dumps no good, hopefully its just old.
search your machine for *.dmp. Try to find one that has a time date stamp corrisponding to an application crash (such as 09/01/2004 @ 18:38)

 

I just found out that the one file that gets updated every time Explorer shuts down is C:\WINNT\system32\config\software.LOG. However, it cannot be opened or copied because it says there is a sharing violation. I tried to access it in Safe mode, with the same results! I tried to bootup DOS using a bootup disk but could not find the file at all It is only 1 KB and seems to be a text file, but darned if I can access it.

Lately, all my desktop icons are also starting to be rearranged from where I had it before. It is getting more disconcerting by the minute. Thanks for your help.

 

I found four .DMP files. The only one that has been modified today is the one you initially (and correctly) suggested - user.dmp. The next newest one in the list has a January 8th time stamp. And, I had at least 7 crashes today.

User.dmp has a time stamp of 3:05 PM, 5 minutes before the most recent crash, but software.LOG's time stamp is the exact time of the crash. And, I have been tracking the time stamp on it - it coincided with every crash. But how to access the file, is the question.

 

Hi
I am having similar problems - I installed XP, then SP2, then started installed apps. Soon after I installed ACE mega codecs pack and Dr Divx, I noticed that every time I right click on a file explorer crashes generating the error below. These apps definitely will use regsvr32.exe which is mentioned in the error dumps. I located the dump as you instructed and have included the output of debugwiz below. Can you help?

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 2005/02/19
Time: 04:54:19 PM
User: N/A
Computer: ARMADILLO
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.




Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Sat Feb 19 17:00:38.000 2005 (GMT+2)
System Uptime: not available
Process Uptime: 0 days 0:00:30.000
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: D:\WINDOWS;D:\WINDOWS\system32;D:\WINDOWS\system32\drivers
........................
(97c.d68): Wake debugger - code 80000007 (!!! second chance !!!)
eax=000000c0 ebx=0007d61c ecx=00001000 edx=7c90eb94 esi=00000078 edi=00000000
eip=7c90eb94 esp=0007d600 ebp=0007d908 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
0:000> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************


FAULTING_IP:
+0
00000000 ?? ???

EXCEPTION_RECORD: 0007da58 -- (.exr 7da58)
.exr 7da58
ExceptionAddress: 008d415b
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00000008

BUGCHECK_STR: 80000007

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: regsvr32.exe

ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened} the system debugger was awakened by an interrupt.

FAULTING_THREAD: 00000d68

CONTEXT: 0007dab0 -- (.cxr 7dab0)
.cxr 7dab0
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=00000000 esp=00000000 ebp=00000000 iopl=0 nv up di pl nz na pe nc
cs=0000 ss=0010 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
00000000 ?? ???
.cxr
Resetting default scope

THREAD_ATTRIBUTES:
LAST_CONTROL_TRANSFER: from 00000000 to 00000000

STACK_TEXT:
fffffffc 00000000 00000000 00000000 00000000 0x0


STACK_COMMAND: .cxr 7dab0 ; kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: ZEROED_STACK

Followup: MachineOwner
---------

eax=000000c0 ebx=0007d61c ecx=00001000 edx=7c90eb94 esi=00000078 edi=00000000
eip=7c90eb94 esp=0007d600 ebp=0007d908 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
ChildEBP RetAddr Args to Child
0007d5fc 7c90e9ab 7c8633d5 00000002 0007d738 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0007d600 7c8633d5 00000002 0007d738 00000001 ntdll!ZwWaitForMultipleObjects+0xc (FPO: [5,0,0])
0007d908 7c965714 0007daa8 0007dd7c 008d415b kernel32!UnhandledExceptionFilter+0x82d (FPO: [Non-Fpo])
0007da48 7c9661a1 0007daa8 008c0000 c0000005 ntdll!RtlCallKernel32UnhandledExceptionFilter+0x111 (FPO: [Non-Fpo])
0007dd80 7c94ea5f 008d415b fffffffe fffffffe ntdll!RtlInvalidHandlerDetected+0x90 (FPO: [Non-Fpo])
0007ddd4 7c93783a 008d415b 008c0000 0007de68 ntdll!RtlIsValidHandler+0xe7 (FPO: [Non-Fpo])
0007de50 7c90eafa 00000000 0007de84 0007de68 ntdll!RtlDispatchException+0x7e (FPO: [Non-Fpo])
0007de50 008d41a4 00000000 0007de84 0007de68 ntdll!KiUserExceptionDispatcher+0xe (FPO: [2,0,0]) (CONTEXT @ 0007de84)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e14c 0007e298 008d415b 1001540c 00000000 0x8d41a4
0007e158 00000000 10015804 00000001 0007e194 0x7e298
start end module name
01000000 01005000 regsvr32 regsvr32.exe Wed Aug 04 08:05:46 2004 (41107CBA)
10000000 10026000 EncodeDivXExt EncodeDivXExt.dll Mon Jul 12 19:48:22 2004 (40F2CEE6)
5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 09:56:43 2004 (411096BB)
5cb70000 5cb96000 shimeng shimeng.dll Wed Aug 04 09:56:42 2004 (411096BA)
5d090000 5d127000 comctl32_5d090000 comctl32.dll Wed Aug 04 09:56:31 2004 (411096AF)
6f880000 6fa4a000 acgenral acgenral.dll Wed Aug 04 09:55:58 2004 (4110968E)
769c0000 76a73000 userenv userenv.dll Wed Aug 04 09:56:41 2004 (411096B9)
76b20000 76b31000 atl atl.dll Wed Aug 04 09:56:55 2004 (411096C7)
76b40000 76b6d000 winmm winmm.dll Wed Aug 04 09:57:10 2004 (411096D6)
77120000 771ac000 oleaut32 oleaut32.dll Wed Aug 04 09:57:39 2004 (411096F3)
773d0000 774d2000 comctl32 comctl32.dll Wed Aug 04 09:55:56 2004 (4110968C)
774e0000 7761c000 ole32 ole32.dll Wed Aug 04 09:57:38 2004 (411096F2)
77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 09:56:36 2004 (411096B4)
77be0000 77bf5000 msacm32 msacm32.dll Wed Aug 04 09:57:03 2004 (411096CF)
77c00000 77c08000 version version.dll Wed Aug 04 09:56:39 2004 (411096B7)
77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 09:59:14 2004 (41109752)
77d40000 77dd0000 user32 user32.dll Wed Aug 04 09:56:40 2004 (411096B8)
77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 09:56:23 2004 (411096A7)
77e70000 77f01000 rpcrt4 rpcrt4.dll Wed Aug 04 09:56:30 2004 (411096AE)
77f10000 77f56000 gdi32 gdi32.dll Wed Aug 04 09:56:07 2004 (41109697)
77f60000 77fd6000 shlwapi shlwapi.dll Wed Aug 04 09:56:44 2004 (411096BC)
7c800000 7c8f4000 kernel32 kernel32.dll Wed Aug 04 09:56:36 2004 (411096B4)
7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 09:56:36 2004 (411096B4)
7c9c0000 7d1d4000 shell32 shell32.dll Wed Aug 04 09:56:39 2004 (411096B7)
Closing open log file c:\debuglog.txt

 

This crash has nothing to do with the explorer crashes directly.

I noticed that every time I right click on a file explorer crashes generating the error below.

You need to use ShellExView to disable any shell extensions that came with that codec pack. If you search the history, there was someone else who had the same problem.