Peculiar bug concerning explorer.exe on Windows 7 (x64 Pro)

[Alpha-Critik]

Whenever explorer crashes while I'm still using it, it's supposed to recover fully and give me back my desktop environment. To my knowledge, it's never actually recovered properly for me. Instead of recovering, it instead brings up an explorer window, which appears when you press Windows Key and E.

Can anyone inform me as to why it's doing this and provide some kind of fix? I've racked my brains for a solution and have yet to find one.

-AC

[Pwned]

Yes, reinstall Windows. It's a registry error.

[Alpha-Critik]

Yes, reinstall Windows. It's a registry error.

Pfffwaaaaaaaaaaaaaaah!?

I was hoping for something a little less drastic... Any other suggestions or possible fixes? =/

[Spider-Vice]

It's Windows 7. Though I use it, I do admit Windows 7 is half bug half OS. Did you try starting explorer from taskmgr? I've got Windows 7 32-bit and sometimes Explorer crashes randomly :\

[Derf]

It's Windows 7. Though I use it, I do admit Windows 7 is half bug half OS. Did you try starting explorer from taskmgr? I've got Windows 7 32-bit and sometimes Explorer crashes randomly :\

Don't blame Windows 7 for this behavior, I've never had an issue like this. It's not "half bug, half OS" as you're suggesting. :\

[giantsteen]

Me neither. I use Windows 7 x64 Pro too, and I have never had a problem. Maybe something happened during installation.

[xpclient]

This happens because you either have "Run in separate process" enabled in Folder Options. Disable that.

If it still happens, then it's because some shell extension is locking Explorer so it can't exit properly. Download ShellExView from here: http://www.nirsoft.net/utils/shexview.html and carefully try unregistering third party shell extensions one at a time using regsvr32 /u and exit Explorer and restart it and then exit it again (You can exit Explorer by holding down Ctrl+Shift+right clicking in an empty area of the Start menu). If after exitting, Explorer.exe is still showing in Task Manager, it means the shell extension you just unregistered is not the one locking Explorer. Continue till you find the one that's locking Explorer and disable it for good so whenever Explorer crashes, it will restart properly.

[Alpha-Critik]

This happens because you either have "Run in separate process" enabled in Folder Options. Disable that.

If it still happens, then it's because some shell extension is locking Explorer so it can't exit properly. Download ShellExView from here: http://www.nirsoft.net/utils/shexview.html and carefully try unregistering third party shell extensions one at a time using regsvr32 /u and exit Explorer and restart it and then exit it again (You can exit Explorer by holding down Ctrl+Shift+right clicking in an empty area of the Start menu). If after exitting, Explorer.exe is still showing in Task Manager, it means the shell extension you just unregistered is not the one locking Explorer. Continue till you find the one that's locking Explorer and disable it for good so whenever Explorer crashes, it will restart properly.

Update: Neither methods have fixed the problem...

What in the hell's going on here?

[PortalCake]

What's running in different processes, Explorer?
I have TuneUP run Explorer and Taskbar in 2 separate processes.

And yes, it is with the registry. What Explorer extensions do you have? I only have HashTab.

[Pwned]

Why not reinstall Windows, or even repair? Yes, it's the best solution, because Windows sometimes become bloated with these apps and stuff...

Offtopic Comment

PortalCake, my comment on cs-bsp.info is still awaiting moderation

[PortalCake]

MS shouldnt have taken away "repair" install IMO, as the new one actually does a full install (upgrade).

Offtopic Comment

Comment approved, sorry btw, as I dont get email notifications of site posts.

[Spider-Vice]

It's Windows 7. Though I use it, I do admit Windows 7 is half bug half OS. Did you try starting explorer from taskmgr? I've got Windows 7 32-bit and sometimes Explorer crashes randomly :\

Don't blame Windows 7 for this behavior, I've never had an issue like this. It's not "half bug, half OS" as you're suggesting. :\

lol, yeah I might have exaggerated but it does have some bugs.

[spunker88]

This happens because you either have "Run in separate process" enabled in Folder Options. Disable that.

I have that enabled and don't have any issues. The only thing I notice is sometimes I get too many explorer.exe processes. There should only be two, one for the desktop/taskbar explorer and one for the file explorer version.

If it ever happened to me, couldn't you just manually kill all explorer.exe processes and then run explorer.exe as a new task in task manager.

[Phenom II]

Before drastically reinstalling the full OS try this:

Open command prompt with admin rights by right clicking and choosing Run as admin

Now type the following:

sfc /scannow

Press enter and let it do its scan, if it finds any damaged or missing system files, it will replace / repair them

Once the scan is done, reboot and see if it has fixed it

When explorer crashes, if you bring up the task manager by pressing CTRL + SHIFT + ESC (on the left of the keyboard) and then choose new task > then type in explorer and press enter, it should restart explorer properly

[Alpha-Critik]

Here's a general update on things including information requested...

ShellExView yielded the information show here: http://pastebin.com/XyxSndd4. Apologies for the extensive length of the file; I'm not entirely sure what information you want.

After performing the sfc /scannow command, this appeared on my desktop.



Also, I only ever have one explorer process running. If you do need more information just ask.

[Phenom II]

sfc command should not have set windows into test mode

BUT - it does make me think that you have an unsigned driver installed causing the crashes

Test mode in x64 is to allow developers test out unsigned drivers


My bet is you have an unsigned driver installed that is messing with explorer

Try looking through device manager for anything sus, and / or reinstall your drivers for chipset / graphics / sound / lan etc


EDIT - Is your copy of windows genuine ? Dont be offended - or is it activated using one of the less legal ways ?


Open command prompt with admin rights again and type this:

Bcdedit.exe -set TESTSIGNING OFF


Press enter and reboot


EDIT - 2 _ It also looks like you are running a 3rd party theme? Must be using UXSTYLE to allow unsigned themes too or SFC would have killed the patch.

Try a different theme, and / or remove UXSTYLE, and reinstall with the latest version

[Alpha-Critik]

I'll do a general driver update after this post.

EDIT: I do recall installing an unsigned driver; something to do with ISO burning...

I do have a legitimate version of Windows running; I wouldn't take offence at you accusing me of having a non-legitimate copy. Piracy is so common these days, no?

I am indeed running a third party theme. I've uninstalled the old version of UxStyle and reinstalled the newest version.

[xpclient]

Try unregistering these shell extensions *at an elevated command prompt* using these commands:
regsvr32 /u "C:\Windows\system32\BWContextHandler.dll"
regsvr32 /u "C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll"
regsvr32 /u "C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll"
If they give an error about not unregistering properly, try putting %windir%\SysWOW64\regsvr32 /u before the DLLs.
Then logoff Explorer, login back and see if exitting Explorer using Shift+Ctrl+right click on start menu cleanly exits it from Task Manager.

[Phenom II]

I'll do a general driver update after this post.

EDIT: I do recall installing an unsigned driver; something to do with ISO burning...

I do have a legitimate version of Windows running; I wouldn't take offence at you accusing me of having a non-legitimate copy. Piracy is so common these days, no?

I am indeed running a third party theme. I've uninstalled the old version of UxStyle and reinstalled the newest version.

I would have a look for that unsigned driver and remove it - there are plenty of ISO burning apps that have signed drivers available

Once you turn test mode off, it should /will fail to load that driver anyway, and you will have an explaination mark in your device manager for the driver in Question, so it should be easy to find and remove

And yea loads of piracy, but I was asking because some of the activation methods do weird and wonderful things to windows, and activating test mode happens to be one of them.

I think once you remove the bad driver, reinstall / update the rest of your system drivers, and turn test mode off, you could have a lot happier system

[Alpha-Critik]

Once you turn test mode off, it should /will fail to load that driver anyway, and you will have an explaination mark in your device manager for the driver in Question, so it should be easy to find and remove

There are no explanation marks in my device manager for any device listed.

[Phenom II]

How has it been since the SFC scan ? Any further crashes ?


And have you managed to turn test mode signing off, the driver will not show up until you turn off test mode with the command I gave you

It should either attempt to install and fail with a message on screen, and / or show up in device manager

[Alpha-Critik]

How has it been since the SFC scan ? Any further crashes ?

And have you managed to turn test mode signing off, the driver will not show up until you turn off test mode with the command I gave you

It should either attempt to install and fail with a message on screen, and / or show up in device manager

The crashes weren't frequent in the first place; they only happen when I put the system under extreme duress (which since this started happening, I've been trying to avoid). However, it would be nice to have an environment which actually recovers from crashes rather than limping its way back to me.

If by "test mode signing off" you mean that little "Test Mode" watermark, then yes that is gone. I did perform the command you gave me concerning it.

[Phenom II]

Well the perfect environment would be where we find out the cause of the crashes and stop them - Windows 7 very rarely crashes, if ever for me, and when it does, it is due to me messing around with a 3rd party app that freezes explorer - so not actually windows fault at all

This is what is happening to you, we just need to narrow down to the actual cause

Did you check the Event Logs? (Type "Event Viewer" into start menu search bar - click on Event Viewer in the results > Click on "Windows Logs > System" - now in the results, which can take a while to show, scroll down to the time and day of the last crash, and see what the Logs say was the cause of the crash - there should deffinately be an entry as Windows is not rebooting, only explorer is crashing

And yea, Explorer does usually restart on its own, unless there is something stopping it - but task manager > file > new task > explorer.exe usually starts it back up again if it doesnt do it on its own

Ok so you have disabled TEST MODE - this means now, that any drivers you try to install, have to be signed, (All reputable manufacturers drivers are all signed) so you should not have issues with drivers anymore

Put the system under stress and try and cause a crash (Fingers crossed it wont crash) but if it does then you will have a fresh Log to view the cause of the crash with.

[Alpha-Critik]

Did you check the Event Logs? (Type "Event Viewer" into start menu search bar - click on Event Viewer in the results > Click on "Windows Logs > System" - now in the results, which can take a while to show, scroll down to the time and day of the last crash, and see what the Logs say was the cause of the crash - there should deffinately be an entry as Windows is not rebooting, only explorer is crashing

OK, this is where things get weird.

1. The Event Viewer service wasn't running.
2. I went to start it using services.msc, but the error below occured.



EDIT: Rebooting yields the same error.
EDIT: Also, thanks for helping with this for so long. I appreciate it.

[Phenom II]

No probs, Im just reading up on the Event Viewer problem - It is not a quick fix from what I am reading so far - it seems to be a permissions issue in the registry but I`m just double checking as the fix is from 2007 for Vista (I would have thought the issue would have either a hotfix or been fixed in windows 7)

I`ll post back soon with what I think would be your best option / fix



---

EDIT

Can you navigate to this folder

C:\Windows\System32\LogFiles

And right click on WMI folder, click properties and choose the Security Tab


Can you check to make sure that the following have FULL permission (Full Control)

SYSTEM
LOCAL SERVICE
NETWORK SERVICE
Administrators
Performance Log Users


If they do not - Take ownership of the folder and give full permissions to the afore mentioned users


EDIT -

Also check the permissions of C:\Windows\System32\LogFiles folder
and C:\windows\logs

Make sure your Administrator account and the SYSTEM account has full permissions on the LogFiles and Logs folder


---------

Some instructions from a member of the technet forums suggest the following:

--
One of the reasons for this error is a corrupted Repository file.



Follow the steps listed below and check if that resolves the issue:



1. Restart the computer into Safe Mode (without networking).

Start your computer in safe mode

http://windows.microsoft.com/en-US/wind ... -safe-mode

2. In safe mode, click ‘Start’, type ‘cmd’, right click and select ‘Run as administrator’.
3. Type net stop winmgmt and press Enter.

NOTE: This is to make certain the wmi service is not running.

4. Wait until the successful message appears, and then close the elevated command prompt.
5. Open Windows Explorer and navigate to C:\Windows\System32\wbem.
6. Right click on the Repository folder and click on Rename.
7. Type in RepositoryOld and press Enter.

NOTE: This is to make this a backup of the original Repository folder.

8. Restart the computer back into normal mode to an administrator account.
9. Click ‘Start’, type ‘cmd’, right click and select ‘Run as administrator’.
10. In the elevated command prompt, type net stop winmgmt and press Enter.

NOTE: This is to make certain the wmi service is not running.

11. Wait until successful message appears, and then type winmgmt /resetRepository in the elevated command prompt and press Enter.
12. Wait until the successful message appears and then close the elevated command prompt.
13. Reboot and check the Event Viewer


---

1)Another successful method

2) Booted to safe mode
3) ran cmd.exe as an administrator
4) typed "cd C:\Windows\System32\LogFiles\WMI"
5) typed "rename RtBackup RtBackup2"
6) Used msconfig to switch to normal boot mode
7) Reboot and found event viewer working