Explorer crashes, every 10 minutes...

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

About every 12 minutes or so, I have the explorer crash. The symptoms
are "only" a refreshing of the taskbar and the disappearance of many -
but not all - of the tray icons. The logs of these crashes - about 1000
so far, for the last few days - state "The system shell stopped
unexpectedly and explorer.exe was restarted" (hopefully I'm translating
it using the right MS terms - I don't know what the exact equivalent of
that message is in the US XP...) They're listed as "source: Winlogon; no
category; event identifier: 1002", with nothing in the hex dump. It's
beyond infuriating. I tried every fix I could find, ran windows update,
sfc, Norton's regscan (I won't even mention the regular AV and spyware
scans), but nothing even decreased the regularity of this. It just
happens for no reason - I could be browsing online (from Firefox,
obviously), watching something, running NASA's Worldwing, writing, or
just letting the PC stand and idle with nothing running, and the crashes
will happen, regardless of anything else...
3 answers Last reply
More about explorer crashes minutes
  1. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

    Wells wrote:

    > About every 12 minutes or so, I have the explorer crash. The symptoms
    > are "only" a refreshing of the taskbar and the disappearance of many -
    > but not all - of the tray icons. The logs of these crashes - about
    > 1000 so far, for the last few days - state "The system shell stopped
    > unexpectedly and explorer.exe was restarted" (hopefully I'm
    > translating it using the right MS terms - I don't know what the exact
    > equivalent of that message is in the US XP...) They're listed as
    > "source: Winlogon; no category; event identifier: 1002", with nothing
    > in the hex dump. It's beyond infuriating. I tried every fix I could
    > find, ran windows update, sfc, Norton's regscan (I won't even mention
    > the regular AV and spyware scans), but nothing even decreased the
    > regularity of this. It just happens for no reason - I could be
    > browsing online (from Firefox, obviously), watching something, running
    > NASA's Worldwing, writing, or just letting the PC stand and idle with
    > nothing running, and the crashes will happen, regardless of anything
    > else...

    1. Does the crash happen at regular intervals? Your post starts out
    suggesting that it is every 12 minutes, but I'd like you to clarify
    that. If this is really the case, then something must be running in the
    background doing something every 12 minutes that is causing the error.
    So if this is accurate and the crashes aren't random, do clean-boot
    troubleshooting:

    Clean Boot - http://support.microsoft.com/default.aspx?kbid=310353
    and How to Troubleshoot By Using the Msconfig Utility in Windows XP -
    http://support.microsoft.com/?id=310560

    2. If the crashes are actually random, it's time to do some hardware
    troubleshooting. I'm happy to give you some troubleshooting steps, but
    please post back first with the answer to the actual randomness of the
    event.

    Malke
    --
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic!"
    MS-MVP Windows - Shell/User
  2. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

    It does seem to happen regardless of what I'm doing. Right now, I just tried one
    thing; I sat down, ran Sysinternals' File Monitor and had it log every
    file access, waiting for the crash to happen. It logged about 3 KB of
    text during the 30 seconds or so when the crash and explorer restart
    occurred... it's below. At that moment I was only reading a cached web
    page, opened quite a while earlier.

    Using PS Tray Factory, I can restore the icons that disappear, but the
    problem is with the crashes, and restoring the icons is like putting cotton under
    a leaking hole in the roof instead of trying to patch up the hole...
    unfortunately in this case I can't even see the hole.

    (The KAVICHS thing is from Kaspersky's Antivirus, but I had the program
    many days before the crashes began)


    4969 winlogon.exe:612 OPEN C:\Documents and Settings\User SUCCESS Options: Open Directory Access: Traverse
    4970 winlogon.exe:612 CLOSE C:\WINDOWS\system32 SUCCESS
    4971 winlogon.exe:612 OPEN C:\WINDOWS\system32\:KAVICHS NAME INVALID Options: Open Access: All
    4972 winlogon.exe:612 OPEN C:\autoexec.bat SUCCESS Options: Open Access: All
    4973 winlogon.exe:612 QUERY INFORMATION C:\autoexec.bat SUCCESS Length: 206
    4974 winlogon.exe:612 READ C:\autoexec.bat SUCCESS Offset: 0 Length: 206
    4975 winlogon.exe:612 CLOSE C:\autoexec.bat SUCCESS
    4976 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
    4977 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4978 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
    4979 winlogon.exe:612 CLOSE C:\ SUCCESS
    4980 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
    4981 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
    4982 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
    4983 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    4984 winlogon.exe:612 QUERY INFORMATION C:\Documents and Settings\User\Local Settings\Temp SUCCESS Attributes: D
    4985 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4986 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings
    4987 winlogon.exe:612 CLOSE C:\ SUCCESS
    4988 winlogon.exe:612 OPEN C:\Documents and Settings\User\ SUCCESS Options: Open Directory Access: All
    4989 winlogon.exe:612 DIRECTORY C:\Documents and Settings\User\ SUCCESS FileBothDirectoryInformation: Local Settings
    4990 winlogon.exe:612 CLOSE C:\Documents and Settings\User\ SUCCESS
    4991 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    4992 winlogon.exe:612 OPEN C:\ SUCCESS Options: Open Directory Access: All
    4993 winlogon.exe:612 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: WINDOWS
    4994 winlogon.exe:612 CLOSE C:\ SUCCESS
    4995 winlogon.exe:612 OPEN C:\WINDOWS\ SUCCESS Options: Open Directory Access: All
    4996 winlogon.exe:612 CLOSE C:\WINDOWS\ SUCCESS
    4997 winlogon.exe:612 OPEN C:\WINDOWS\:KAVICHS NAME INVALID Options: Open Access: All
    4998 winlogon.exe:612 OPEN C:\WINDOWS\system32 SUCCESS Options: Open Directory Access: Traverse
    4999 winlogon.exe:612 CLOSE C:\Documents and Settings\User SUCCESS
    5000 winlogon.exe:612 OPEN C:\Documents and Settings\User\:KAVICHS NAME INVALID Options: Open Access: All
    5001 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485036 Length: 140
    5002 services.exe:656 WRITE C:\WINDOWS\system32\config\AppEvent.Evt SUCCESS Offset: 485176 Length: 40
  3. Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

    Wells wrote:

    > It does seem to happen regardless of what I'm doing. Right now, I just
    > tried one thing; I sat down, ran Sysinternals' File Monitor and had it
    > log every file access, waiting for the crash to happen. It logged
    > about 3 KB of text during the 30 seconds or so when the crash and
    > explorer restart occurred... it's below. At that moment I was only
    > reading a cached web page, opened quite a while earlier.
    >
    > Using PS Tray Factory, I can restore the icons that disappear, but the
    > problem is with the crashes, and restoring the icons is like putting
    > cotton under a leaking hole in the roof instead of trying to patch up
    > the hole... unfortunately in this case I can't even see the hole.
    >
    > (The KAVICHS thing is from Kaspersky's Antivirus, but I had the
    > program many days before the crashes began)
    >
    >
    (snip log)

    OK, I'd start by doing the clean-boot troubleshooting, including
    stopping Kaspersky. Just don't go on the Internet while you're testing
    and you'll be fine. Lots of people love Kaspersky and I know you said
    it has worked for a long time, but it was dreadful on one of my testbed
    machines. You need to eliminate all extraneous programs and processes
    first. Here are the links for clean-boot troubleshooting again:

    Clean Boot - http://support.microsoft.com/default.aspx?kbid=310353
    and How to Troubleshoot By Using the Msconfig Utility in Windows XP -
    http://support.microsoft.com/?id=310560

    If you still get the crashes in a clean-boot state, then start hardware
    testing. If you don't get the crashes (and give it enough time, not
    just a few minutes; let it run in the clean-boot state for a number of
    hours), then you know it is some piece of software and you have to find
    it by the process of elimination. It is a tedious process, but it is
    useless to be anything less than methodical in troubleshooting.

    Here are some general hardware troubleshooting steps:

    1) Open the computer and run it open, cleaning out all dust bunnies and
    observing all fans (overheating will cause system freezing). Obviously
    you can't do this with a laptop, but you can hear if the fan is running
    and feel if the laptop is getting too hot.

    2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
    have to get the program from a working machine. You will either
    download the precompiled Windows binary to make a bootable floppy or
    the .iso to make a bootable cd. If you want to use the latter, you'll
    need to have third-party burning software on the machine where you
    download the file - XP's built-in burning capability won't do the job.
    In either case, boot with the media you made. The test will run
    immediately. Let the test run for an extended period of time - unless
    errors are seen immediately. If you get any errors, replace the RAM.

    3) Test the hard drive with a diagnostic utility from the mftr. Usually
    you will download the file and make a bootable floppy with it. Boot
    with the media and do a thorough test. If the drive has physical
    errors, replace it.

    4) The power supply may be going bad or be inadequate for the devices
    you have in the system. The adequacy issue doesn't really apply to a
    laptop, although of course the power
    supply can be faulty.

    5) Test the motherboard with something like TuffTest from
    www.tufftest.com. Sometimes this is useful, and sometimes it isn't.

    Testing hardware failures often involves swapping out suspected parts
    with known-good parts. If you can't do the testing yourself and/or are
    uncomfortable opening your computer, take the machine to a professional
    computer repair shop (not your local equivalent of BigStoreUSA).

    Let me know what happens.

    Malke
    --
    MS-MVP Windows User/Shell
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic"
Ask a new question

Read More

Microsoft Explorer Windows XP