I turned my computer off to go on vacation, and came back to find that, on reboot, it would not start correctly.
When I try to login, I get a blinking strobe light effect, and the start menu never shows up. Event log showed that explorer.exe crashed in a loop.
I've tried
The problem seems to be in twinui_pcshell.dll
Any other ideas?
Timeline: Process.Start
Name: <blank>
Time: 2020-01-16T14:00:59.0Z
Diff: 1000 mSec
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000080004002 rbx=000000000580c320 rcx=000000000580c390
rdx=00007ff8e5ca2f68 rsi=000000000509f820 rdi=000000000580c320
rip=00007ff8e5939bfc rsp=000000000509f778 rbp=00007ff8c2b77cf0
r8=000000000509f808 r9=000000000580c328 r10=0000000080004002
r11=000000000509f818 r12=0000000005816f10 r13=0000000000000000
r14=000000000509f9a0 r15=000000000363abf0
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo:
00007ff8`e5939bfc a15b98de39e403186c mov eax,dword ptr [6C1803E439DE985Bh] ds:6c1803e4`39de985b=????????
Resetting default scope
FAULTING_IP:
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo+0
00007ff8`e5939bfc a15b98de39e403186c mov eax,dword ptr [6C1803E439DE985Bh]
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff8e5939bfc (twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
PROCESS_NAME: explorer.exe
FOLLOWUP_IP:
twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo+0
00007ff8`e5939bfc a15b98de39e403186c mov eax,dword ptr [6C1803E439DE985Bh]
READ_ADDRESS: ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
WATSON_BKT_PROCSTAMP: d3046e6b
WATSON_BKT_PROCVER: 6.2.18362.449
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: twinui.pcshell.dll
WATSON_BKT_MODSTAMP: 6141e983
WATSON_BKT_MODOFFSET: 109bfc
WATSON_BKT_MODVER: 6.2.18362.449
MODULE_VER_PRODUCT: Microsoft® Windows® Operating System
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
MODLIST_WITH_TSCHKSUM_HASH: 394d58ebce4bf5a65cf3420d267041c51a17133a
MODLIST_SHA1_HASH: 6006e4cea17b6f773e22b86c0ef37ce94b909267
COMMENT:
*** "C:\Users\gbronner\Desktop\Procdump\procdump.exe" -accepteula -mp -j "C:\users\gbronner\Desktop\Procdump" 1336 508 0000000004F30000
*** Just-In-Time debugger. PID: 1336 Event Handle: 508 JIT Context: .jdinfo 0x4f30000
NTGLOBALFLAG: 0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
CHKIMG_EXTENSION: !chkimg -lo 50 -db !twinui_pcshell
254 errors : !twinui_pcshell (7ff8e5939b7c-7ff8e5939c7b)
7ff8e5939b70 85 c9 74 05 e8 e7 61 f8 ff 48 89 3b *d6 *ab *2c *6a ..t...a..H.;..,j
7ff8e5939b80 *d2 *34 *ce *41 *38 *0a *00 *a8 *9a *da *20 *ae *54 *1c *f5 *15 .4.A8..... .T...
7ff8e5939b90 *2e *56 *35 *29 *c5 *6d *11 *36 *4e *36 *a4 *63 *ef *64 *74 *ab .V5).m.6N6.c.dt.
7ff8e5939ba0 *e2 *58 *9a *73 *1e *d1 *83 *c2 *b0 *e8 *7e *82 *99 *e4 *a4 *50 .X.s......~....P
7ff8e5939bb0 *34 *c5 *d7 *6f *f7 *0f *ad *57 *79 *22 *2d *05 *cd *ba *13 *28 4..o...Wy"-....(
7ff8e5939bc0 *1c *fa *0a *c9 *b0 *28 *5c *db *99 *e4 *f2 *62 *52 *93 *31 *3d .....(\....bR.1=
7ff8e5939bd0 *b8 *3d *6a *93 *41 *74 *b3 *2d b4 *b1 *6d *70 *06 *5b *d6 *ba .=j.At.-..mp.[..
7ff8e5939be0 *eb *19 *77 *97 *7f *2e *3f *38 *7e *9e *f5 *52 *5b *9b *79 *ae ..w...?8~..R[.y.
7ff8e5939bf0 *e5 *79 *3c *b9 *76 *9d *a4 *a7 *55 *a4 *04 *50 *a1 *5b *98 *de .y<.v...U..P.[..
7ff8e5939c00 *39 *e4 *03 *18 *6c *74 *15 *a8 *b1 *bd *b3 *cf *25 *c3 36 *e6 9...lt......%.6.
7ff8e5939c10 *c0 *05 *8f *4a *5c *a4 *4a *25 *55 *89 *55 *7e *e9 *1e *b4 *f8 ...J\.J%U.U~....
7ff8e5939c20 *a2 *fb *40 *8e *79 *e4 *f3 *90 *9c *91 *9c *e2 *b2 *94 *80 *86 ..@.y...........
7ff8e5939c30 *f6 *fa *22 *aa *b1 *c6 *24 *23 *9c *9e *86 *aa *47 *60 *f2 *a9 .."...$#....G`..
7ff8e5939c40 *bb *05 *b6 *e0 *b6 *d7 *e9 *56 *a5 *58 *c4 *8f *04 *6a *3c *a3 .......V.X...j<.
7ff8e5939c50 *d3 *23 *80 *3d *aa *ab *99 *55 *60 *b4 *f3 *1a *58 *9f *70 *e0 .#.=...U`...X.p.
7ff8e5939c60 *f4 *1e *95 *00 *73 *57 *97 *97 *12 *ba *cd *66 *86 *37 *5e *aa ....sW.....f.7^.
7ff8e5939c70 *bc *0c *7b *d5 *7b *2d *4a *6f *35 *9d *97 *7c 08 33 c0 eb ..{.{-Jo5..|.3..
DUMP_FLAGS: 4c96
DUMP_TYPE: 1
ANALYSIS_SESSION_HOST: BUTTERHEAD
ANALYSIS_SESSION_TIME: 01-16-2020 09:14:32.0243
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
THREAD_ATTRIBUTES:
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
OS_LOCALE: ENU
BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_MEMORY_CORRUPTION_LARGE_256
DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_256
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
PROBLEM_CLASSES:
ID: [0n313]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x12dc]
Frame: [0] : twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo
ID: [0n285]
Type: [INVALID_POINTER_READ]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x12dc]
Frame: [0] : twinui_pcshell!Microsoft::WRL::Details::ImplementsHelper<Microsoft::WRL::RuntimeClassFlags<1>,1,IWeakReferenceSource,Microsoft::WRL::FtmBase>::CanCastTo
ID: [0n209]
Type: [MEMORY_CORRUPTION]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x538]
TID: [0x12dc]
Frame: [Unspecified]
ID: [0n155]
Type: [LARGE]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Add
String: [256]
PID: [0x538]
TID: [0x12dc]
Frame: [Unspecified]
LAST_CONTROL_TRANSFER: from 00007ff8e5a14973 to 00007ff8e5939bfc
STACK_TEXT:
00000000`00000000 00000000`00000000 memory_corruption!twinui_pcshell+0x0
THREAD_SHA1_HASH_MOD_FUNC: d7032d110b0be66578467d7a091eaa1ecf498302
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4705f75888593d9413f48c2d55c5165cf7e8a19b
THREAD_SHA1_HASH_MOD: 7da7fbec386ce361a40d03d69a994bc4836f03e8
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: memory_corruption!twinui_pcshell
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: ** Pseudo Context ** ManagedPseudo ** Value: 1cf64035dd0 ** ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_256_c0000005_memory_corruption!twinui_pcshell
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_MEMORY_CORRUPTION_LARGE_256_memory_corruption!twinui_pcshell
FAILURE_EXCEPTION_CODE: c0000005
IMAGE_NAME: memory_corruption
FAILURE_IMAGE_NAME: memory_corruption
BUCKET_ID_IMAGE_STR: memory_corruption
MODULE_NAME: memory_corruption
FAILURE_MODULE_NAME: memory_corruption
BUCKET_ID_MODULE_STR: memory_corruption
FAILURE_FUNCTION_NAME: twinui_pcshell
BUCKET_ID_FUNCTION_STR: twinui_pcshell
BUCKET_ID_OFFSET: 0
BUCKET_ID_MODTIMEDATESTAMP: 0
BUCKET_ID_MODCHECKSUM: 0
BUCKET_ID_MODVER_STR: 0.0.0.0
BUCKET_ID_PREFIX_STR: APPLICATION_FAULT_INVALID_POINTER_READ_
FAILURE_PROBLEM_CLASS: APPLICATION_FAULT
FAILURE_SYMBOL_NAME: memory_corruption!twinui_pcshell
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer.exe/6.2.18362.449/d3046e6b/twinui.pcshell.dll/6.2.18362.449/6141e983/c0000005/00109bfc.htm?Retriage=1
TARGET_TIME: 2020-01-16T14:01:00.000Z
OSBUILD: 18362
OSSERVICEPACK: 329
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 768
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt SingleUserTS Personal
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2cc6c
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:memory_corruption_large_256_c0000005_memory_corruption!twinui_pcshell
FAILURE_ID_HASH: {8501c6a9-9fbe-2820-276c-c9dd5d473898}
I was unable to come up with a solution to fix this, so I elected to update to Version 1909.
A few more things I tried:
Took about a day of work. Not happy about this!
I've got a loop crash at explorer.exe with a Windows 10 build 2004 due to the settings of using thumbnail preview icons for folders cause there was an .odt file downloaded to the desktop who was crashing it. Moving that file to my documents folder was enough.
There are some causes to theses loop crashes, it is always good to have a spare admin account; anyway using crtl-alt-del to get task manager, and using file / new task for mmc command allows to get to computer management console and create an account (make it member of Administrators) terminate session, into the new one, and clean from there.
User contributions licensed under CC BY-SA 3.0