Explorer crashes, every 10 minutes...

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

About every 12 minutes or so, I have the explorer crash. The symptoms
are "only" a refreshing of the taskbar and the disappearance of many -
but not all - of the tray icons. The logs of these crashes - about 1000
so far, for the last few days - state "The system shell stopped
unexpectedly and explorer.exe was restarted" (hopefully I'm translating
it using the right MS terms - I don't know what the exact equivalent of
that message is in the US XP...) They're listed as "source: Winlogon; no
category; event identifier: 1002", with nothing in the hex dump. It's
beyond infuriating. I tried every fix I could find, ran windows update,
sfc, Norton's regscan (I won't even mention the regular AV and spyware
scans), but nothing even decreased the regularity of this. It just
happens for no reason - I could be browsing online (from Firefox,
obviously), watching something, running NASA's Worldwing, writing, or
just letting the PC stand and idle with nothing running, and the crashes
will happen, regardless of anything else...

 

[Malke]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Wells wrote:

> About every 12 minutes or so, I have the explorer crash. The symptoms
> are "only" a refreshing of the taskbar and the disappearance of many -
> but not all - of the tray icons. The logs of these crashes - about
> 1000 so far, for the last few days - state "The system shell stopped
> unexpectedly and explorer.exe was restarted" (hopefully I'm
> translating it using the right MS terms - I don't know what the exact
> equivalent of that message is in the US XP...) They're listed as
> "source: Winlogon; no category; event identifier: 1002", with nothing
> in the hex dump. It's beyond infuriating. I tried every fix I could
> find, ran windows update, sfc, Norton's regscan (I won't even mention
> the regular AV and spyware scans), but nothing even decreased the
> regularity of this. It just happens for no reason - I could be
> browsing online (from Firefox, obviously), watching something, running
> NASA's Worldwing, writing, or just letting the PC stand and idle with
> nothing running, and the crashes will happen, regardless of anything
> else...

1. Does the crash happen at regular intervals? Your post starts out
suggesting that it is every 12 minutes, but I'd like you to clarify
that. If this is really the case, then something must be running in the
background doing something every 12 minutes that is causing the error.
So if this is accurate and the crashes aren't random, do clean-boot
troubleshooting:

Clean Boot - http://support.microsoft.com/default.aspx?kbid=310353
and How to Troubleshoot By Using the Msconfig Utility in Windows XP -
http://support.microsoft.com/?id=310560

2. If the crashes are actually random, it's time to do some hardware
troubleshooting. I'm happy to give you some troubleshooting steps, but
please post back first with the answer to the actual randomness of the
event.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

It does seem to happen regardless of what I'm doing. Right now, I just tried one
thing; I sat down, ran Sysinternals' File Monitor and had it log every
file access, waiting for the crash to happen. It logged about 3 KB of
text during the 30 seconds or so when the crash and explorer restart
occurred... it's below. At that moment I was only reading a cached web
page, opened quite a while earlier.

Using PS Tray Factory, I can restore the icons that disappear, but the
problem is with the crashes, and restoring the icons is like putting cotton under
a leaking hole in the roof instead of trying to patch up the hole...
unfortunately in this case I can't even see the hole.

(The KAVICHS thing is from Kaspersky's Antivirus, but I had the program
many days before the crashes began)



4969 winlogon.exe:612 OPEN C:\Documents and Settings\User SUCCESS Options: Open Directory Access: Traverse
4970 winlogon.exe:612 CLOSE C:\WINDOWS\system32 SUCCESS
4971 winlogon.exe:612 OPEN C:\WINDOWS\system32\:KAVICHS NAME INVALID Options: Open Access: All
4972 winlogon.exe:612 OPEN C:\autoexec.bat SUCCESS Options: Open Access: All
4973 winlogon.exe:612 QUERY INFORMATION C:\autoexec.bat SUCCESS Length: 206
4974 winlogon.exe:612 READ C:\autoexec.bat SUCCESS Offset: 0 Length: 206
4975 winlogon.exe:612 CLOSE C:\autoexec.bat SUCCESS
4976 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
4977 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
4978 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
4979 winlogon.exe:612 CLOSE C:\ SUCCESS
4980 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
4981 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
4982 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
4983 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
4984 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
4985 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
4986 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
4987 winlogon.exe:612 CLOSE C:\ SUCCESS
4988 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
4989 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
4990 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
4991 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
4992 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
4993 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: WINDOWS
4994 winlogon.exe:612 CLOSE C:\ SUCCESS
4995 winlogon.exe:612 OPEN C:\WINDOWS\ SUCCESS Options: Open Directory Access: All
4996 winlogon.exe:612 CLOSE C:\WINDOWS\ SUCCESS
4997 winlogon.exe:612 OPEN C:\WINDOWS\:KAVICHS NAME INVALID Options: Open Access: All
4998 winlogon.exe:612 OPEN C:\WINDOWS\system32 SUCCESS Options: Open Directory Access: Traverse
4999 winlogon.exe:612 CLOSE C:\Documents and Settings\User SUCCESS
5000 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
5001 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485036 Length: 140
5002 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485176 Length: 40

 

[Malke]

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Wells wrote:

> It does seem to happen regardless of what I'm doing. Right now, I just
> tried one thing; I sat down, ran Sysinternals' File Monitor and had it
> log every file access, waiting for the crash to happen. It logged
> about 3 KB of text during the 30 seconds or so when the crash and
> explorer restart occurred... it's below. At that moment I was only
> reading a cached web page, opened quite a while earlier.
>
> Using PS Tray Factory, I can restore the icons that disappear, but the
> problem is with the crashes, and restoring the icons is like putting
> cotton under a leaking hole in the roof instead of trying to patch up
> the hole... unfortunately in this case I can't even see the hole.
>
> (The KAVICHS thing is from Kaspersky's Antivirus, but I had the
> program many days before the crashes began)
>
>
(snip log)

OK, I'd start by doing the clean-boot troubleshooting, including
stopping Kaspersky. Just don't go on the Internet while you're testing
and you'll be fine. Lots of people love Kaspersky and I know you said
it has worked for a long time, but it was dreadful on one of my testbed
machines. You need to eliminate all extraneous programs and processes
first. Here are the links for clean-boot troubleshooting again:

Clean Boot - http://support.microsoft.com/default.aspx?kbid=310353
and How to Troubleshoot By Using the Msconfig Utility in Windows XP -
http://support.microsoft.com/?id=310560

If you still get the crashes in a clean-boot state, then start hardware
testing. If you don't get the crashes (and give it enough time, not
just a few minutes; let it run in the clean-boot state for a number of
hours), then you know it is some piece of software and you have to find
it by the process of elimination. It is a tedious process, but it is
useless to be anything less than methodical in troubleshooting.

Here are some general hardware troubleshooting steps:

1) Open the computer and run it open, cleaning out all dust bunnies and
observing all fans (overheating will cause system freezing). Obviously
you can't do this with a laptop, but you can hear if the fan is running
and feel if the laptop is getting too hot.

2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
have to get the program from a working machine. You will either
download the precompiled Windows binary to make a bootable floppy or
the .iso to make a bootable cd. If you want to use the latter, you'll
need to have third-party burning software on the machine where you
download the file - XP's built-in burning capability won't do the job.
In either case, boot with the media you made. The test will run
immediately. Let the test run for an extended period of time - unless
errors are seen immediately. If you get any errors, replace the RAM.

3) Test the hard drive with a diagnostic utility from the mftr. Usually
you will download the file and make a bootable floppy with it. Boot
with the media and do a thorough test. If the drive has physical
errors, replace it.

4) The power supply may be going bad or be inadequate for the devices
you have in the system. The adequacy issue doesn't really apply to a
laptop, although of course the power
supply can be faulty.

5) Test the motherboard with something like TuffTest from
www.tufftest.com. Sometimes this is useful, and sometimes it isn't.

Testing hardware failures often involves swapping out suspected parts
with known-good parts. If you can't do the testing yourself and/or are
uncomfortable opening your computer, take the machine to a professional
computer repair shop (not your local equivalent of BigStoreUSA).

Let me know what happens.

Malke
--
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"