Explorer crash loop every second reboot

Question

Hi,

I'm having a problem where every second time I reboot, explorer.exe enters a crashloop rendering my PC unusable. The only way I can restart is via the PC reset button (restarting via Ctrl+Alt+Del starts a restart that never finishes).

I've tried several things that I've seen elsewhere, for example the extensive list here: https://superuser.com/questions/1502440/desktop-and-taskbar-crashing-refreshing-when-signed-into-microsoft-account, but so far nothing has worked. The solution on that page (to delete the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BannerStore registry key) doesn't work as I get an error when I try to delete it (even after taking ownership of the key). However, I think my error may be different anyway. I've attached a WinDbg analysis of an explorer.exe .dmp file below - the error is thrown in ucrtbase, but appears to originate in windows_immersiveshell_serviceprovider (judging by the name of the thread - the stack doesn't seem to include this info).

I'm very much at the limit of my knowledge here and am unsure how to proceed. I have a hunch (from that thread name) that it could be a failing shell plugin, but I'm not sure how to identify which. Can anyone offer any help or advice?

Thanks,

Karli

------------------------------------ WinDbg analysis -----------------------------------

Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\karli\AppData\Local\CrashDumps\explorer.exe.2300.dmp]
User Mini Dump File with Full Memory: Only application data is available

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 19042 MP (32 procs) Free x64
Product: WinNt, suite: SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Wed Nov 18 22:49:04.000 2020 (UTC + 0:00)
System Uptime: 0 days 0:01:03.796
Process Uptime: 0 days 0:00:01.000
................................................................
.................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(8fc.3358): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 
For analysis of this file, run !analyze -v
ucrtbase!abort+0x4e:
00007ffa`4b0c287e cd29            int     29h
0:021> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1686

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on KRONOS

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.mSec
    Value: 61082

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 260

    Key  : Analysis.System
    Value: CreateObject

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 63

    Key  : Timeline.Process.Start.DeltaSec
    Value: 1

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

    Key  : WER.Process.Version
    Value: 10.0.19041.610

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000001 rbx=00000000069fdde0 rcx=0000000000000007
rdx=000000000000000f rsi=00000000069fd450 rdi=0000000000000000
rip=00007ffa4b0c287e rsp=00000000069fcb20 rbp=00000000069fcc80
 r8=0000000000000001  r9=00000000069fcac8 r10=0000000000000012
r11=0088000002002080 r12=0000000000000001 r13=00007ffa3f326500
r14=00000000069fce30 r15=00000000069fcc70
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ucrtbase!abort+0x4e:
00007ffa`4b0c287e cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffa4b0c287e (ucrtbase!abort+0x000000000000004e)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000007
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000007

STACK_TEXT:  
00000000`069fcb20 00007ffa`4b0c1faf     : 00000000`00000003 00000000`00000003 00000000`069fd610 00000000`069fce30 : ucrtbase!abort+0x4e
00000000`069fcb50 00007ffa`4b08e5d6     : 00000000`069fdde0 00000000`069fcc80 00000000`069fd450 00000000`00000000 : ucrtbase!terminate+0x1f
00000000`069fcb80 00007ffa`4b08f254     : 00000000`00000000 00007ffa`4b4083cb 00000000`00000001 00000000`069fdde0 : ucrtbase!FindHandler<__FrameHandler4>+0x50a
00000000`069fcd50 00007ffa`4b08d0c0     : 00007ffa`3f2d0000 00000000`069fdde0 00000000`069fd610 00000000`069fd450 : ucrtbase!__InternalCxxFrameHandler<__FrameHandler4>+0x278
00000000`069fcdf0 00007ffa`10913f34     : 00000000`069ff530 00007ffa`10db1b68 00000000`069fdde0 00000000`069ff530 : ucrtbase!_CxxFrameHandler4+0xa0
00000000`069fce60 00007ffa`4d8d10ff     : 00000000`00000000 00000000`069fd400 00000000`069fdde0 00000000`00000001 : twinui_pcshell!DllCanUnloadNow+0x42184
00000000`069fce90 00000000`00000000     : 00000000`069fd400 00000000`069fdde0 00000000`00000001 00000000`069fd450 : ntdll!RtlpExecuteHandlerForException+0xf

SYMBOL_NAME:  ucrtbase!abort+4e

MODULE_NAME: ucrtbase

IMAGE_NAME:  ucrtbase.dll

STACK_COMMAND:  ~21s ; .ecxr ; kb

FAILURE_BUCKET_ID:  FAIL_FAST_FATAL_APP_EXIT_c0000409_ucrtbase.dll!abort

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.19041.546

FAILURE_ID_HASH:  {e31753ac-c98a-8055-3663-47e707543d20}

Followup:     MachineOwner
---------

0:021> ~# kP 25
 # Child-SP          RetAddr               Call Site
00 00000000`069fcb20 00007ffa`4b0c1faf     ucrtbase!abort+0x4e
01 00000000`069fcb50 00007ffa`4b08e5d6     ucrtbase!terminate+0x1f
02 00000000`069fcb80 00007ffa`4b08f254     ucrtbase!FindHandler<__FrameHandler4>+0x50a
03 00000000`069fcd50 00007ffa`4b08d0c0     ucrtbase!__InternalCxxFrameHandler<__FrameHandler4>+0x278
04 00000000`069fcdf0 00007ffa`10913f34     ucrtbase!_CxxFrameHandler4+0xa0
05 00000000`069fce60 00007ffa`4d8d10ff     twinui_pcshell!DllCanUnloadNow+0x42184
06 00000000`069fce90 00000000`00000000     ntdll!RtlpExecuteHandlerForException+0xf
0:021> dx Debugger.Sessions[0].Processes[2300].Threads[13144].Stack.Frames[6].SwitchTo();dv /t /v
Debugger.Sessions[0].Processes[2300].Threads[13144].Stack.Frames[6].SwitchTo()
Unable to enumerate locals, Win32 error 0n87
Private symbols (symbols.pri) are required for locals. 

Type ".hh dbgerr005" for details.

Answer 1

Hi,

No, unfortunately I still have the problem. I couldn't face reinstalling everything. In general I'm ok, as from a cold start it generally works. I only have headaches where I need to restart, so installing updates is an issue. Every now and then I sick a few hours into it and get frustrated. Would be very nice to have a fix!

Karli

Answer 2

Hi @Karliwatson,

You're not alone - loads of people complaining about explorer crash and flickering screen on startup...

It is messed up that such a key issue has not yet been address by Mcsft...

Did you ever manage to find a way around it or just reinstalling?

Cheers

J

Answer 3

Hi Jerico,

I thought I'd tracked down the problem to some brother printer utilities that were running on startup, so I disabled those and thought for a while things were working, but a few restarts later and the problem is back. So I decided to try a repair install as you suggested, but unfortunately it's not letting me do that. Well, it would, but it's not giving me the option to "Keep personal files and apps". To confirm, before attempting the install I completely uninstalled my antivirus software and unplugged all peripherals except the keyboard and mouse, as instructed in the links. It says I can't keep my files, apps and settings as "my current version of Windows might be installed in an unsupported directory" (it isn't, it's in C:\Windows) or "you're trying to install an older version of Windows". I'm using the version downloaded from the Windows 10 download site, so I'm not sure how that could happen (unless they haven't updated it since 20H2).

All of which means I'm a bit stuck again.

One new symptom to report - sometimes after logging in everything seems fine except the windows start menu, which flashes up for a moment and then vanishes.

My next test (I'm running out of ideas) is to try disabling OneDrive and DropBox. Who knows, maybe I'll get lucky...

Karli

Answer 4

Hi Jerico,

Thanks for the reply!

I've already tried the sfc / DISM method - DISM found something to fix, but unfortunately it didn't solve my problem. I have been trying a variant of method 2 where I'm selectively disabling things to try to figure out the problem, but obviously this is very time consuming so I have some way to go. I'm reluctant to use method 3 as it's so destructive (and I might just end up recreating the problem as I reinstall updates etc.), so I'm hoping that the error details, stack trace etc. will point us toward the culprit. Does it help at all?

Thanks,

Karli

Answer 5

Hi Karliwatson -

I'm Jerico T., one of the Independent Advisor and a fellow Windows 10 user like you. I understand that you're having some issues right now, let us sort things out.

Is this the first time the issue occurs? Does your computer works fine in the past? Try to perform the methods below and check if any of the resolves fixes the issue.

1. Boot your computer in safemode, click the link below

https://support.microsoft.com/en-us/windows/sta...

In safemode, perform the methods below.

Method 1: Perform SFC Scan and Repair Windows Image

-This process will perform scan for any corrupted system files or integrity violation and will attempt to repair it along with the Windows Image.

1. Open command prompt with administrator access
2. Type each command below and wait until scan is completed.

* sfc /scannow

* DISM /Online /Cleanup-Image /CheckHealth

* DISM /Online /Cleanup-Image /ScanHealth

* DISM /Online /Cleanup-Image /RestoreHealth

Quick note: While the command is running, it's expected to see the process stuck at 20 or 40 percent. After a few minutes, the process will complete successfully.

Once you complete the steps, the Deployment Image Servicing and Management tool will connect to the Windows Update servers to download and replace any damaged files in the local image for Windows 10 as necessary.

3. Close the command prompt.

Method 2: Perform Clean Boot

• This process will eliminate 3rd party application running in the background of your computer along with services that are not needed to run windows. If there's any conflicting 3rd party application that causes the issue on your computer, this process will stop it.

1. Open the run box by pressing the Windows Key + R and type msconfig
2. System Configuration Utility box will open and by default you are on general tab.
3. On the General tab, click the selective startup and make sure that load system service and load startup items both have checked mark.
4. Click on services tab
5. Put a check mark on Hide All Microsoft Services > This is a very important part as if you miss to click on this, computer might not boot properly or permanently and will end up on clean installation.
6. Once Hide all Microsoft Services have checked mark on it, click on Disable All
7. Click on the Startup Tab and click open task manager. This will open another window which contains all your startup applications on the administrator account.
8. Disable all application that you're not using. You can simply just click on them and select disable.
9. Click OK , Apply and close the configuration utility.

Method 3: System Restore

• System restore is where it will take your computer settings back to an earlier point in time where everything is working fine.

1. Open the run box by pressing Windows Key + R and type rstrui.exe then press enter.
2. System restore windows will open. Normally it will suggest a restore point(Sometimes it doesn't), if it does, select the 2nd option to select more restore points.
3. Select your desired restore point date and time.
4. Once selected, hit next and finish.

Windows will restart itself to start system restore. System restore might take some time to complete and it is very important that system restore must not be interrupted during restore process as it might damaged the operating system. System restore will take at least 20 minutes or more depending on the content of the computer and the changes on the settings that was done prior to the date selected. System restore will also removed application , updates and drivers installed prior to the date selected.

DISCLAIMER:

System Restore is a recovery tool for Windows that allows you to reverse certain kinds of changes made to the operating system. System Restore is used to return important Windows files and settings—like drivers, registry keys, system files, installed programs, and more—back to previous versions and settings. Being said all applications and changes made prior to the date selected will be removed and needs to be re-installed if its needed.

Feel free to reach us back if the given methods above did not work.

Hope this help. Have a good day.

Thank you.

Jerico T.

Independent Advisor