Oct 082012
 

I was given a laptop to troubleshoot last week.  The user reported that Explorer.exe would crash and restart continually while he was logged in.  Applications would continue to run after the crash, but all Explorer windows would close and his desktop was only accessible for a few seconds between each crash.

I started with the basics. I tried disabling all non-MS services and startup items, and restarted through MSconfig. No change.  I tried safe mode, and the problem repeated.  I checked Event Viewer for additional details, but all I saw in there was a fairly vague “Event 1000, Application Error. Faulting application name: explorer.exe. Faulting Module name: OPENGL32.dll”. With the virus scanner disabled, and a few other suspicious programs removed, the problem persisted. I even gave Windows System File Checker (sfc /scannow from an elevated command prompt) a shot (it came up clean) as well as Windows Defender Offline to check for rootkits or other viral issues (nothing malicious was found). Lastly, I tried logging in as a different admin user. The problem did not repeat; interesting.

At this point, I was running short on time. The user needed his laptop back, and I needed to make progress. I decided that since it was just affecting the single user account, it was likely a problem with their profile. I decided to back up his data and delete the profile.  During the backup, Explorer crashed multiple times as admin- but NOT continually. It only crashed occasionally. Now, I was certain I was dealing with bad data in his account. I finished backing up only the data that was essential for him, deleted the profile, recreated it, and copied his data into the new profile. Crash.

Now, I started looking closely at individual files. This is when I noticed that it was whenever I attempted to copy the contents of his desktop that the crashes occurred.  A 500MB .JT file (CAD related format containing 3D CAD data) caused the crash whenever I accessed it via copy, mouse click, etc. A-ha!  I deleted this file via the command prompt (it could not be deleted via Windows’ GUI as it would crash as soon as you selected the file) and the problem went away!

I’m still not certain what about that file caused the crashes, but the short story was that since the file was on his desktop, each time Windows reinstated explorer.exe and redrew his desktop, it had to access this file and explorer would crash again.  Once the file was removed, the problem was solved!  If you run into this issue, look closely for bad data, and explore the contents of the user’s heavily accessed directories closely. It could be as simple as a bad bit of user created data. The profile deletion ended up being unnecessary, and ultimately would have been futile if the bad data was backed up and replaced to his desktop.

Reddit<-- Share/Bookmark

Sorry, the comment form is closed at this time.