Windows 7 explorer always crashes, opens small "Personalized Settings" window
My Windows 7 desktop PC, built by me, started acting very weird in the last couple of days. I use it quite often, about half of the time through TeamViewer. Explorer would crash and restart randomly, almost always through TeamViewer. This made me suspect that TeamViewer was the problem but I have reproduced it with and without TeamViewer several times. The only way I can seem to get the problem not to occur is by booting into Safe Mode.
I have used CCleaner and Malwarebytes to make sure it wasn't a registry error or malware causing the problem, and I have tried the fix in the seemly related issue here as well every other fix I have found online including removing security updates KB980408 and KB2926765 as well as using "sfc /scannow" and a bunch of other things I can't remember.
More recently when I try to start explorer it is popping up a small window that says "Personalized Settings" on the top, but is completely empty and crashes instantly. The only way I can get it to disappear is to kill the explorer.exe process. I wish I could take a screenshot but I can't seem to open paint or even find the exe. I have tried restarting it, I have tried starting it while the personalized settings window was open.
I have come up with two lists of processes the first is the list of active processes when I boot into safe mode and explorer seems to work fine. The second is the list of processes that I can narrow it down to in normal boot and still replicate the problem. There is one process that I can't seem to close. NisSrv.exe which is describes as "Microsoft Network Realtime Inspection Service". When I try to close the process NisSrv.exe it says "The operation could not be completed. Access is denied." When I try to close the related service it gives the same message.
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 2,660 K
smss.exe 304 Services 0 1,196 K
csrss.exe 408 Services 0 4,156 K
wininit.exe 444 Services 0 4,608 K
csrss.exe 452 Console 1 8,700 K
services.exe 492 Services 0 7,700 K
winlogon.exe 524 Console 1 5,756 K
lsass.exe 536 Services 0 10,644 K
lsm.exe 544 Services 0 4,316 K
svchost.exe 652 Services 0 8,976 K
MsMpEng.exe 804 Services 0 40,696 K
explorer.exe 1332 Console 1 85,220 K
ctfmon.exe 1376 Console 1 3,680 K
dllhost.exe 1624 Console 1 8,656 K
chrome.exe 1408 Console 1 98,504 K
WmiPrvSE.exe 2352 Services 0 6,472 K
chrome.exe 1744 Console 1 65,116 K
taskmgr.exe 372 Console 1 14,948 K
cmd.exe 2776 Console 1 2,960 K
conhost.exe 1816 Console 1 3,580 K
tasklist.exe 2308 Console 1 5,868 K
And the list of processes I have narrowed it down to.
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 2,808 K
smss.exe 316 Services 0 1,216 K
csrss.exe 484 Services 0 4,532 K
wininit.exe 596 Services 0 4,604 K
csrss.exe 604 Console 1 23,676 K
services.exe 652 Services 0 11,344 K
lsass.exe 668 Services 0 12,692 K
lsm.exe 676 Services 0 4,464 K
MsMpEng.exe 972 Services 0 68,436 K
winlogon.exe 168 Console 1 7,784 K
svchost.exe 496 Services 0 19,140 K
NisSrv.exe 3176 Services 0 808 K
svchost.exe 1684 Services 0 11,260 K
taskmgr.exe 4524 Console 1 20,696 K
cmd.exe 4764 Console 1 7,224 K
conhost.exe 4772 Console 1 6,916 K
sublime_text.exe 2340 Console 1 45,012 K
dllhost.exe 4476 Console 1 8,736 K
tasklist.exe 3796 Console 1 5,768 K
WmiPrvSE.exe 1768 Services 0 6,344 K
Here is the event data xml from event viewer for the error I am getting.
<EventData>
<Data>explorer.exe</Data>
<Data>6.1.7601.17567</Data>
<Data>4d672ee4</Data>
<Data>vrfcore.dll</Data>
<Data>6.3.9600.16384</Data>
<Data>5215f8f5</Data>
<Data>80000003</Data>
<Data>0000000000003a00</Data>
<Data>12e4</Data>
<Data>01cfb84fa70f89dc</Data>
<Data>C:\Windows\system32\explorer.exe</Data>
<Data>C:\Windows\SYSTEM32\vrfcore.dll</Data>
<Data>e5957093-2442-11e4-9f8a-94de806ed9cb</Data>
</EventData>
I was looking through the eventvwr log again and I found this, possibly related
<EventData>
<Data>runonce.exe</Data>
<Data>6.1.7601.17514</Data>
<Data>4ce7a253</Data>
<Data>MSVCR100.dll</Data>
<Data>10.0.40219.325</Data>
<Data>4df2bcac</Data>
<Data>c0000005</Data>
<Data>000000000003c145</Data>
<Data>670</Data>
<Data>01cfb8dabbd85942</Data>
<Data>C:\Windows\system32\runonce.exe</Data>
<Data>C:\Windows\system32\MSVCR100.dll</Data>
<Data>fa6f82b9-24cd-11e4-80a8-94de806ed9cb</Data>
</EventData>
And the general error details
Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: vrfcore.dll, version: 6.3.9600.16384, time stamp: 0x5215f8f5
Exception code: 0x80000003
Fault offset: 0x0000000000003a00
Faulting process id: 0xc38
Faulting application start time: 0x01cfb84e5e852c5f
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\vrfcore.dll
Report Id: 9dc19e6d-2441-11e4-9f8a-94de806ed9cb
Another probably unrelated error that I seem to be getting pretty often.
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"
could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003.
Events cannot be delivered through this filter until the problem is corrected.
My explorer tab in Autoruns seen below along with the error when I try to uncheck something. I should add that I seem to be able to disable shell extensions with ShellExView but I still can't get explorer to start correctly.
EXPLORER SHELL UPDATE - See screenshot below I can access the explorer right click menu through a file manager I downloaded called NexusFile, but still no luck starting explorer.
Another round of errors that I am getting regarding Windows Search Service
The search service has detected corrupted data files in the index {id=4700}.
The service will attempt to automatically correct this problem by rebuilding the index.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
followed by
The Windows Search Service is being stopped because there is a problem with the
indexer: The catalog is corrupt.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801
and
The plug-in in <Search.JetPropStore> cannot be initialized.
Context: Windows Application, SystemIndex Catalog
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
and
The gatherer object cannot be initialized.
Context: Windows Application, SystemIndex Catalog
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
and
The Windows Search Service cannot load the property store information.
Context: Windows Application, SystemIndex Catalog
Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)
WER Log
UPDATE
The problem turned out to be Visual Studio trying to debug the explorer crash that caused it to never be able to start. I uninstalled Visual Studio and rebooted and explorer then crashed on boot but immediately restarted and worked fine. I have isolated the crash on boot and traced it to an error with Synergy found here http://synergy-project.org/spit/issues/details/3980/
Thank you to everyone for being patient and helping me, and I will be accepting @and31415 as the answer since he pointed out that the vrfcore.dll was a Visual Studio dll.
Spaceman Spiff
Community3 Answers
Quick analysis
The vrfcore.dll library file mentioned in the log is related to the Microsoft Application Verifier tool, which is part of the Windows 8.1 SDK/WDK (in fact, the file version is 6.3.9600.16384) and is also included with Visual Studio 2013.
Quoting the documentation:
Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage.
Source: Application Verifier
Workaround
Although it's not an actual solution, uninstalling Visual Studio can serve as a temporary workaround. Before doing so, you might try to remove just the Application Verifier by following these steps:
Open an elevated command prompt.
Run one of the following commands depending on the Windows version you're running:
x86 (32-bit)
msiexec /uninstall {13A3E02D-36D4-BBD6-0BBD-D0BFDBEA0079}x64 (64-bit)
msiexec /uninstall {77F3D72C-465F-BD51-890E-CC3914B1365F}
Restart Windows.
Note You might want to ensure that you have all Visual Studio updates installed, which can include bug fixes to specific issues.
and31415I'm not entirely sure what the cause of your problem is to be honest but from the sounds of it, if your computer doesn't have this problem in safe mode then I wouldn't worry about Windows having any problems with its registry or etc. If I were you though, to further troubleshoot the problem, I would start the computer in safe mode, save the list of active process (Windows + R, "cmd", enter, "TASKLIST >safemode.txt", ALT + F4) and then save a list of active process after a normal boot (Windows + R, "cmd", enter, "TASKLIST >normal.txt", ALT + F4). From there, I would target the processes that are on normal.txt but not on safemode.txt. Try terminating those processes (or even better 'End Process Tree') and see if the problem ceases. And lastly, the only other idea I could offer would be to prevent any programs from starting on start up. Then if the problem doesn't occur with no start-up programs, at the very least you can be confident in the culprit.
Jacob WolfeOne of my users had a similar issue like this a while back and it was caused by an explorer shell extension. An explorer extension is what you see when you right-click on a program and you see extra entries in the context menu like using Winzip or doing an anti-virus scan on the folder.
Explorer shell extensions aren't loaded up as processes and so one wouldn't see them in task manager. Hence we needed a tool like Autoruns, which we could use to stop Explorer making use of the shell extension upon startup.
Once we downloaded Autoruns, we went straight to the Explorer tab and we unchecked anything that looked odd. We restarted the machine and the problem was gone.
Give that a go and hope that helps.
--Editing answer to address new information that user has provided--
If you find however that Autoruns, even when running it as administrator, does not allow you to deselect the auto-start point, then I suggest any of the following. Take a note of the programs listed under the Explorer tab in Autoruns and uninstall them one by one retesting to see the issue goes away after each installation. Alternatively you can try the suggestion here How to list Explorer extensions and disable them?.
user319647User contributions licensed under CC BY-SA 3.0