Windows 10: explorer.exe crash loop caused by ntdll.dll

so the latest update has caused my machine to open and close windows explorer every second or so. this renders the machine nearly unusable as the loop causes clicks to not be registered or cleared sometimes. i know that this is the update because i did a system restore before the update and it returned to normal. however last night windows decided to update again when i restarted my computer there is no way to disable the updates on preview. -__- i cant restore anymore and am stuck with a nonfuntioning computer because of this "feature". i did try a clean boot, safemode and alternate profile but problem persist. this is the sfc log. virus scan was clear and this is the event log report
Code: Faulting application name: EXPLORER.EXE, version: 6.4.9879.0, time stamp: 0x545852b9Faulting module name: ntdll.dll, version: 6.4.9879.0, time stamp: 0x545874b8Exception code: 0xc0000374Fault offset: 0x00000000000e1634Faulting process id: 0x22fcFaulting application start time: 0x01d00fa04138897bFaulting application path: C:\WINDOWS\EXPLORER.EXEFaulting module path: C:\WINDOWS\SYSTEM32\ntdll.dllReport Id: 8197e2b8-7b93-11e4-8315-88ae1d3f7f1cFaulting package full name: Faulting package-relative application ID: [/quote]


:)

 

LOW GAME PERFORMANCE

I still need help with the Explorer.EXE crashing and restarting isssue, due to the Shell constantly crashing becuase of the faulty module ntdll.dll

 

Explorer and task bar crashing and resetting when trying to load files.

How did the clean boot work out?

The Event Logs showed many explorer.exe errors some with other modules such as the ntdll.dll

Can you temporarily uninstall ASUS WebStorage as this software can sometimes cause Windows Explorer to crash.

 

I see 28 views but no one has responded. However, as I mentioned on the other forum, this is where I would have posted a problem such as this.

 

Sorry for not getting here sooner. The error is a heap corruption (memory) - no real info on it tho'
You can use Task Manager to force a crash and dump of the explorer.exe process - and that may reveal the cause.

Another thing to try would be to try a boot into Safe Mode to see if it continues there.
If not, then it's most likely a 3rd party component that's interfering with the ntdll.dll process, which then causes explorer.exe to crash.

If able to get it stable long enough, these reports might help us:

Please provide this information so we can provide a complete analysis (from the Pinned Topic at the top of the forum) - even though you're not reporting BSOD's:
Ten Forums: BSOD - Posting Instructions


Please do the following:
- open Event Viewer (run eventvwr.msc from the "Run" dialog)
- expand the Custom Views category (left click on the > next to the words "Custom Views")
- right click on Administrative Events
- select "Save all Events in Custom View as..."
- save the file as Admin.evtx
- zip up the file (right click on it, select "Send to", select "Compressed (zipped) folder")
- upload it with your next post (if it's too big, then upload it to a free file-hosting service and post a link here).

 

as mentioned in the op safe mode doesnt help, heres the log.

 

Sorry for missing the bit about Safe Mode in your original post. I'm generally rushed in the mornings and I have some eye problems that can contribute to me missing some things.

The only problem that I saw in the Event logs was with Comodo's cfpconfig service. It most likely belongs to the Comodo firewall program. Please uninstall it (and ensure that the Windows Firewall is running while you're testing).

The reports from here are incomplete: BSOD - Posting Instructions
Please rerun the application and let it run for at least 15 minutes (or until the app itself says that it's done). Then zip it up and upload it with your next post.

In particular, I'm looking for the MSINFO32 report.
If it's not in the upload, then try this:

 

here you are. idk if it matters that i force closed explorer because it interferes completely with using the computer. for now im using hotkeys to navigate.

 

If that's all that you can do to make it work - then that's what you've gotta do!

Your BIOS dates from 2011 - this may cause issues with later OS's (Win8 and above)
See if there are updates available from the Toshiba website. Here's my canned speech about BIOS':

Many, many Windows Updates failures in the WER section of the MSINFO32 report. If the problems continue, please post over in the Windows Updates & Activation - Windows 8 Forums for further expert assistance with this issue.

7 BSOD's - 1 from 4 Dec, the rest on 7 Dec. All blame your nVidia drivers
1 additional BSOD event on 8 Dec and one on 9 Dec - no details available for them.

Try installing the latest nVidia drivers from the Toshiba website.
I did notice that there are no supported drivers for Win8.1 there - so I have to wonder if the system is compatible w/Win10

Also, I see no trace of an Intel graphics driver on the system - but the system is equipped with an Intel graphics card (according to the specs at the Toshiba website). The Intel card isn't visible in either the dxdiag report or the MSINFO32 report.
Try installing the Win8 Intel graphics driver from the Toshiba website to see if that helps.

If none of that works, then try forcing a dump of the explorer.exe process (right click on it, select "create a dump file" - it'll give you the location of the dump file. Zip it up and upload it to a free file-hosting service (they're 300+ mB before zipping them up). FYI - mine is located in C:\Users\John\AppData\Local\Temp

Dunno if it'll help us out - but it can't hurt!

 

Many, many Windows Updates failures in the WER section of the MSINFO32 report. If the problems continue, please post over in the Windows Updates & Activation - Windows 8 Forums for further expert assistance with this issue.

7 BSOD's - 1 from 4 Dec, the rest on 7 Dec. All blame your nVidia drivers
1 additional BSOD event on 8 Dec and one on 9 Dec - no details available for them.

Try installing the latest nVidia drivers from the Toshiba website.
I did notice that there are no supported drivers for Win8.1 there - so I have to wonder if the system is compatible w/Win10

Also, I see no trace of an Intel graphics driver on the system - but the system is equipped with an Intel graphics card (according to the specs at the Toshiba website). The Intel card isn't visible in either the dxdiag report or the MSINFO32 report.
Try installing the Win8 Intel graphics driver from the Toshiba website to see if that helps.

If none of that works, then try forcing a dump of the explorer.exe process (right click on it, select "create a dump file" - it'll give you the location of the dump file. Zip it up and upload it to a free file-hosting service (they're 300+ mB before zipping them up). FYI - mine is located in C:\Users\John\AppData\Local\Temp

Dunno if it'll help us out - but it can't hurt! cant flash the drivers because i have a newer version. and i dont see the issue with the bios, it just wont install. the bsods from the nvidia drivers are from when windows 10 installs an automatic update and i have to do a system restore to get a functioning system again. from my knowledge the gpu is nvidia only, im currently running the standard windows drivers though. heres the dump

 

Nice download site! One of the best that I've seen - no fuss, just a simple download. Thanks!
I don't see any specific solutions in this. I'd try seeing if there are any known issues at the Toshiba forums. You also may want to try the nVidia forums - but be sure that they know this is a Toshiba laptop (due to the Intel/nVidia driver issues).

If it says that you have a newer version, try uninstalling the newer version before trying to install the one from Toshiba.

As you are using the standard Windows drivers - I have to wonder if there's something missing from them.
Most laptops require custom modified drivers to let the 2 different cards work together (that's why we suggest getting your video drivers from Toshiba rather than Intel/nVidia. It may be that the drivers from Windows Update won't properly take care of the problem either.

For example, my Samsung laptop has Intel and AMD graphics cards - and the AMD driver has to be signed by Intel in order for it to work on my system. If I use the AMD driver from the AMD site - my AMD graphics card won't be enabled.


If not that, then I suspect that there's either a problem with the Intel graphics card - or that the system isn't compatible w/Win10.
Reinstalling another OS (Win7 would be best IMO) and seeing if the Intel card works without problems should tell you which one it is.


Regardless, the problems are:
- crashing with the nVidia driver
- no sign of the Intel graphics card
I just don't think that these are just coincidental - I think that solving one will also involve solving the other.


If using the method to update the BIOS inside of Windows, it could be that the system just won't recognize the OS - so it won't install it (as it can't decide on exactly how to do it). If that's the case, when you try another OS you should be able to update it. If not, then I'd have to suspect a lower level problem (such as a motheroard issue).


Here's the output of the explorer dump. I don't see anything significant in it.
Code: Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\John\Downloads\explorer\explorer.DMP] User Mini Dump File with Full Memory: Only application data is available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*c:\symbols*Symbol information Deferred srv*c:\SymcachePublic*http://ctxsym.citrix.com/symbolsad/symbols Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/...ic*http://ctxsym.citrix.com/symbolsad/symbols Executable search path is: Windows 8 Version 9879 MP (8 procs) Free x64 Product: WinNt, suite: SingleUserTS Built by: 6.4.9879.0 (fbl_release.141103-1722) Machine Name: Debug session time: Tue Dec 9 19:32:18.000 2014 (UTC - 5:00) System Uptime: 1 days 0:34:29.540 Process Uptime: 0 days 0:00:02.000 ................................................................ ................................................................ ................................................................ ....... Loading unloaded module list .. user32!NtUserWaitMessage+0xa: 00007ff8`8e6f058a c3 ret 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for nvwgf2umx.dll - *** The OS name list needs to be updated! Unknown Windows version: 6.4 *** FAULTING_IP: +7ed089d130 00000000`00000000 ?? ??? EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 0000000000000000 ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0 CONTEXT: 0000000000000000 -- (.cxr 0x0;r) rax=0000000080004001 rbx=00000000028c4100 rcx=00000000028bc750 rdx=5555555555555555 rsi=00007ff88ccdccb0 rdi=00000000028bc750 rip=00007ff88e6f058a rsp=000000000035fa28 rbp=000000000035faa0 r8=00007ff88d53a620 r9=000000000035f078 r10=0000000000000003 r11=0000000080004001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 user32!NtUserWaitMessage+0xa: 00007ff8`8e6f058a c3 ret FAULTING_THREAD: 0000000000001e68 DEFAULT_BUCKET_ID: STATUS_BREAKPOINT PROCESS_NAME: explorer.exe ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached. EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: explorer.exe ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT LAST_CONTROL_TRANSFER: from 00007ff88ce65fb5 to 00007ff88e6f058a STACK_TEXT: 00000000`0035fa28 00007ff8`8ce65fb5 : 00000000`028c4100 00000000`0035faa0 00007ff8`8ccdccb0 00000000`00000210 : user32!NtUserWaitMessage+0xa 00000000`0035fa30 00007ff8`8ce652f9 : 00000000`00000000 00000000`028bc750 00000000`028bc750 00000000`00000001 : shell32!CDesktopBrowser::_MessageLoop+0x61 00000000`0035fac0 00007ff6`11612e7c : 00000000`00002000 00000000`0000063e 00007ff8`7bd872d0 00000000`028bc750 : shell32!SHDesktopMessageLoop+0x39 00000000`0035faf0 00007ff6`1166b614 : 00007ff6`11795710 00007ff6`11795710 00000000`0000001f 00000000`00000001 : explorer!wWinMain+0x6ec 00000000`0035fe10 00007ff8`8ca4a6e2 : 00007ff6`1166b6c0 00007ff6`1142f000 00007ff6`1142f000 00000000`00000000 : explorer!Microsoft::WRL::ComPtr<CMarshaledInterface::CMarshalStream>::~ComPtr<CMarshaledInterface::CMarshalStream>+0x318 00000000`0035fee0 00007ff8`8f1cc9a4 : 00007ff8`8ca4a6c0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22 00000000`0035ff10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34 STACK_COMMAND: ~0s; .ecxr ; kb FOLLOWUP_IP: shell32!CDesktopBrowser::_MessageLoop+61 00007ff8`8ce65fb5 ebd2 jmp shell32!CDesktopBrowser::_MessageLoop+0x35 (00007ff8`8ce65f89) SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: shell32!CDesktopBrowser::_MessageLoop+61 FOLLOWUP_NAME: MachineOwner MODULE_NAME: shell32 IMAGE_NAME: shell32.dll DEBUG_FLR_IMAGE_TIMESTAMP: 54740818 FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_shell32.dll!CDesktopBrowser::_MessageLoop BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_shell32!CDesktopBrowser::_MessageLoop+61 ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_shell32.dll!cdesktopbrowser::_messageloop FAILURE_ID_HASH: {b4729fe5-4bd8-cefc-0fc2-c7f1764c9f16} Followup: MachineOwner --------- 0:000> .cxr 0x0;r rax=0000000080004001 rbx=00000000028c4100 rcx=00000000028bc750 rdx=5555555555555555 rsi=00007ff88ccdccb0 rdi=00000000028bc750 rip=00007ff88e6f058a rsp=000000000035fa28 rbp=000000000035faa0 r8=00007ff88d53a620 r9=000000000035f078 r10=0000000000000003 r11=0000000080004001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 user32!NtUserWaitMessage+0xa: 00007ff8`8e6f058a c3 ret 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** The OS name list needs to be updated! Unknown Windows version: 6.4 *** FAULTING_IP: +7ed089d130 00000000`00000000 ?? ??? EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 0000000000000000 ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0 CONTEXT: 0000000000000000 -- (.cxr 0x0;r) rax=0000000080004001 rbx=00000000028c4100 rcx=00000000028bc750 rdx=5555555555555555 rsi=00007ff88ccdccb0 rdi=00000000028bc750 rip=00007ff88e6f058a rsp=000000000035fa28 rbp=000000000035faa0 r8=00007ff88d53a620 r9=000000000035f078 r10=0000000000000003 r11=0000000080004001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 user32!NtUserWaitMessage+0xa: 00007ff8`8e6f058a c3 ret FAULTING_THREAD: 0000000000001e68 DEFAULT_BUCKET_ID: STATUS_BREAKPOINT PROCESS_NAME: explorer.exe ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached. EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: explorer.exe ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT LAST_CONTROL_TRANSFER: from 00007ff88ce65fb5 to 00007ff88e6f058a STACK_TEXT: 00000000`0035fa28 00007ff8`8ce65fb5 : 00000000`028c4100 00000000`0035faa0 00007ff8`8ccdccb0 00000000`00000210 : user32!NtUserWaitMessage+0xa 00000000`0035fa30 00007ff8`8ce652f9 : 00000000`00000000 00000000`028bc750 00000000`028bc750 00000000`00000001 : shell32!CDesktopBrowser::_MessageLoop+0x61 00000000`0035fac0 00007ff6`11612e7c : 00000000`00002000 00000000`0000063e 00007ff8`7bd872d0 00000000`028bc750 : shell32!SHDesktopMessageLoop+0x39 00000000`0035faf0 00007ff6`1166b614 : 00007ff6`11795710 00007ff6`11795710 00000000`0000001f 00000000`00000001 : explorer!wWinMain+0x6ec 00000000`0035fe10 00007ff8`8ca4a6e2 : 00007ff6`1166b6c0 00007ff6`1142f000 00007ff6`1142f000 00000000`00000000 : explorer!Microsoft::WRL::ComPtr<CMarshaledInterface::CMarshalStream>::~ComPtr<CMarshaledInterface::CMarshalStream>+0x318 00000000`0035fee0 00007ff8`8f1cc9a4 : 00007ff8`8ca4a6c0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22 00000000`0035ff10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34 STACK_COMMAND: ~0s; .ecxr ; kb FOLLOWUP_IP: shell32!CDesktopBrowser::_MessageLoop+61 00007ff8`8ce65fb5 ebd2 jmp shell32!CDesktopBrowser::_MessageLoop+0x35 (00007ff8`8ce65f89) SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: shell32!CDesktopBrowser::_MessageLoop+61 FOLLOWUP_NAME: MachineOwner MODULE_NAME: shell32 IMAGE_NAME: shell32.dll DEBUG_FLR_IMAGE_TIMESTAMP: 54740818 FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_shell32.dll!CDesktopBrowser::_MessageLoop BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_shell32!CDesktopBrowser::_MessageLoop+61 ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_shell32.dll!cdesktopbrowser::_messageloop FAILURE_ID_HASH: {b4729fe5-4bd8-cefc-0fc2-c7f1764c9f16} Followup: MachineOwner ---------[/quote]

 

So you folks have determined KB3020114 does not help in this area?

http://support.microsoft.com/kb/3020114

There is even a workaround out now for KB3020114 since some folks were having problems installing it, if you check the insiders site.

Edit: I also notice you have a bonjour driver from 2011, mdnsNSP.dll. If you are running Apple stuff, are there any updates?

I had to try doing a clean install since 9879 would Blue Screen my system, and although it did not help, you can do that now.

 

this update was already installed on my system.

 

[/quote] i installed the nvidia drivers from toshiba and got bluescreened. my last chance will be to try to get these new bios updates from toshiba to work.

 

Did you uninstall the older drivers (from Windows Update) first?