1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Explorer in XP crashes every 10 minutes, like an alarm clock...?

Discussion in 'Windows XP' started by HGWells, Jul 25, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. HGWells

    HGWells Thread Starter

    Joined:
    Jul 25, 2005
    Messages:
    3
    Has anyone encountered anything of this sort?

    About every 12 minutes or so, I have the explorer crash. The symptoms are "only" a refreshing of the taskbar and the disappearance of many - but not all - of the tray icons. The logs of these crashes - about 1000 so far, for the last few days - state "The system shell stopped unexpectedly and explorer.exe was restarted". They're listed as "source: Winlogon; no category; event identifier: 1002", with nothing in the hex dump. It's beyond infuriating. I tried every fix I could find, ran windows update, sfc, Norton's regscan (I won't even mention the regular AV and spyware scans), but nothing even decreased the regularity of this. I even installed the dreaded SP2, and it fixed nothing (just slowed down the system considerably).

    The crashes seem to happen for no reason at all - I could be browsing online (from Firefox, obviously), watching something, running NASA's Worldwind, writing, or just letting the PC stand and idle with nothing running, and the crashes will happen, regardless of anything else...

    It does seem to happen regardless of what I'm doing. Right now, I just tried one thing; I sat down, ran Sysinternals' File Monitor and had it log every file access, waiting for the crash to happen. It logged about 3 KB of text during the 30 seconds or so when the crash and explorer restart occurred... it's below. At that moment I was only reading a cached web page, opened quite a while earlier.

    Using PS Tray Factory, I can restore the icons that disappear, but the problem is with the crashes, and restoring the icons is like putting cotton under a leaking hole in the roof instead of trying to patch up the hole... unfortunately in this case I can't even see the hole.

    (The KAVICHS thing is from Kaspersky's Antivirus, but I had the program many days before the crashes began)

    4969 winlogon.exe:612 OPEN C:\Documents and Settings\User SUCCESS Options: Open Directory Access: Traverse
    4970 winlogon.exe:612 CLOSE C:\WINDOWS\system32 SUCCESS
    4971 winlogon.exe:612 OPEN C:\WINDOWS\system32\:KAVICHS NAME INVALID Options: Open Access: All
    4972 winlogon.exe:612 OPEN C:\autoexec.bat SUCCESS Options: Open Access: All
    4973 winlogon.exe:612 QUERY INFORMATION C:\autoexec.bat SUCCESS Length: 206
    4974 winlogon.exe:612 READ C:\autoexec.bat SUCCESS Offset: 0 Length: 206
    4975 winlogon.exe:612 CLOSE C:\autoexec.bat SUCCESS
    4976 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
    4977 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4978 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
    4979 winlogon.exe:612 CLOSE C:\ SUCCESS
    4980 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
    4981 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
    4982 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
    4983 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    4984 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
    4985 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4986 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
    4987 winlogon.exe:612 CLOSE C:\ SUCCESS
    4988 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
    4989 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
    4990 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
    4991 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    4992 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4993 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: WINDOWS
    4994 winlogon.exe:612 CLOSE C:\ SUCCESS
    4995 winlogon.exe:612 OPEN C:\WINDOWS\ SUCCESS Options: Open Directory Access: All
    4996 winlogon.exe:612 CLOSE C:\WINDOWS\ SUCCESS
    4997 winlogon.exe:612 OPEN C:\WINDOWS\:KAVICHS NAME INVALID Options: Open Access: All
    4998 winlogon.exe:612 OPEN C:\WINDOWS\system32 SUCCESS Options: Open Directory Access: Traverse
    4999 winlogon.exe:612 CLOSE C:\Documents and Settings\User SUCCESS
    5000 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    5001 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485036 Length: 140
    5002 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485176 Length: 40

    And here is a Procexp screenshost from my typical session:
    http://img176.imageshack.us/img176/5775/procexp0av.gif

    Here's a HijackThis log, by the way, if anyone recognizes anything problematic... By the way, are there any real-time process, etc. monitors that would perhaps help in finding out and logging some specific information about the system situation at the exact moments of the crashes? (I already used tools such as Sysinternals' ones - File Monitor, etc. - and similar...)

    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\PS Tray Factory\PSTrayFactory.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    C:\Program Files\Far\Far.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /silent
    O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus\kav.exe" -run -n PersonalPro -v 5.0.0.0
    O4 - HKLM\..\RunOnce: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: FAR.lnk = C:\Program Files\Far\Far.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus\kavmm.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
     
  2. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    "far.exe" is evidently a target of the "bugbear" worm, so you might want to try removing that from your startups, just in case it has escaped detection by your anitivirus:

    http://64.233.179.104/search?q=cach...nfo/descriptions/bugbear_b.html+Far.exe&hl=en

    Also run eventvwr.msc and look for "Explorer" errors in the Applications log. Double click these to open the details window, then use the "copy" icon to copy the details to the clipboard and paste some of these here. They might show what module Explorer is faulting in.

    System tray icons normally "disappear" after an explorer crash -- but if you are having taskbar related problems prior to this, perhaps you should take PSTRAYFactory out of your startups.
     
  3. HGWells

    HGWells Thread Starter

    Joined:
    Jul 25, 2005
    Messages:
    3
    FAR is Eugene Roshal's file manager, which I keep in Autostart for convenience...

    The event log does not actually list explorer as causing any errors. All the crashes are apparently caused by Winlogon - that's what's listed as the source. The description of every of those (now many hundreds) crashes states that explorer was restarted... This is a sample of such a logged event, from the exported file (translated):
    Type Date Hour Source Category Event User Computer
    Information 2005-07-25 01:59:53 Winlogon 1002

    I started using PSTrayFactory days after the crashes began, to restore the missing icons. There are no taskbar problems per se; it disappears momentarily along with the tray whenever explorer is shut down and restarted, as logged...
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Some coverage here:

    http://www.eventid.net/display.asp?eventid=1002&eventno=826&source=Winlogon&phase=1

    Personally I think you may have a damaged User Profile.

    if there is no other detail to the "winlogon" errors, then go to the Control Panel > User Accounts applet, open it and create a new User Account and give it full Administrative rights.

    Reboot and log on under that and see if you get errors.

    By the way, from your copy/paste of the HijackThis Scanlog, you cut out the version number; if the version is not: 1.99.1 you should repost with that version.
     
  5. Vinda-Lou

    Vinda-Lou

    Joined:
    Aug 6, 2004
    Messages:
    13
    I've been having the same problem, with explorer crashing out of nowhere every so often. "Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvenience." is the window that pops open whenever it happens. More info :AppName: explorer.exe AppVer: 6.0.2800.1106 ModName: unknown
    ModVer: 0.0.0.0 Offset: 0237200c"

    This is what the Event Viewer says when I double click on the problem:

    Faulting application explorer.exe, version 6.0.2800.1106, faulting module , version 0.0.0.0, fault address 0x00000000.


    I have an HP a640n Pavillion. I don't know what caused all of this, and I don't remember when it started, but I do know that nothing had really changed at the time - as far as I know.

    Any help would be appreciated. (Sorry to hijack this thread :eek: ).
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Explorer crashes every
  1. sp113
    Replies:
    3
    Views:
    198
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/384244

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice