Livemusic

[ph 2.39.124, win 10] PH's notifications of started/stopped services leads to explorer crash during first logon

Sun Nov 06, 2016 6:32 pm

Process Hacker's (PH) additional to default notifications of started/stopped services crashes Windows Explorer directly during first log on after PC's reboot.
So user logs on, system tray icons of other apps and PH's appeared and stays there about 2-3 seconds. Then all icons gone cause Windows Explorer crash and then all icons reloads. Some auto-startup applications (BitTorrent and Skype for desktop was not executed). Perhaps RunOnce list also may not be fulfilled so some operations will be never done in future that may leads to some garbage/junks may stay unprocessed.

If to log off and log on than everything is fine - there are no crashes.

Crashes lasts since April, 2016 (when I start to use Win10).

Crashes goes away if to turn off notifications of started/stopped services.

My PH have some customization settings (only via PH's GUI).

I can't say about crashes on other PC's running Win10 with turned on notifications of started/stopped services. On WinXP,7,8,8.1 everything was ok with older PH versions.

Got any ideas?

Thanks to team for so needed PH software product!!! I use it for about... hmm 5, may be 7 years.


Security and maintenance center:

Description
Faulting Application Path: C:\Windows\explorer.exe

Problem signature
Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 10.0.14393.351
Application Timestamp: 5801a56f
Fault Module Name: ntdll.dll
Fault Module Version: 10.0.14393.351
Fault Module Timestamp: 5801a332
Exception Code: c000041d
Exception Offset: 00000000000368ed
OS Version: 10.0.14393.2.0.0.256.122
Locale ID: 1033
Additional Information 1: e86a
Additional Information 2: e86a8bf3afbd6ad934eada7ff8d8bc34
Additional Information 3: 7bd9
Additional Information 4: 7bd968139c9ca8ba51ff971a310e4ee5

Extra information about the problem
Bucket ID: b7b430b2b180e820be610ed9cb877d50 (120578692111)


Event viewer:

Faulting application name: Explorer.EXE, version: 10.0.14393.351, time stamp: 0x5801a56f
Faulting module name: ntdll.dll, version: 10.0.14393.351, time stamp: 0x5801a332
Exception code: 0xc000041d
Fault offset: 0x00000000000368ed
Faulting process id: 0xa44
Faulting application start time: 0x01d2383f17d47046
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 7f7d8478-ebcd-43b4-b74f-7c1022429ed8
Faulting package full name:
Faulting package-relative application ID:

<XML>

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-11-06T15:04:52.173143000Z" />
<EventRecordID>2389</EventRecordID>
<Channel>Application</Channel>
<Computer>LIVEMUSIC</Computer>
<Security />
</System>
- <EventData>
<Data>Explorer.EXE</Data>
<Data>10.0.14393.351</Data>
<Data>5801a56f</Data>
<Data>ntdll.dll</Data>
<Data>10.0.14393.351</Data>
<Data>5801a332</Data>
<Data>c000041d</Data>
<Data>00000000000368ed</Data>
<Data>a44</Data>
<Data>01d2383f17d47046</Data>
<Data>C:\Windows\Explorer.EXE</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>7f7d8478-ebcd-43b4-b74f-7c1022429ed8</Data>
<Data />
<Data />
</EventData>
</Event>

---
Current PH 2.39.124 (x64)
Current Win 10 b14393.351 (x64)
 
Livemusic

Re: [ph 2.39.124, win 10] PH's notifications of started/stopped services leads to explorer crash during first logon

Sun Nov 06, 2016 11:10 pm

by the way: I can't create account cause page warning:

Spam <on red line>
Please note that you will need to enter a valid email address before your account is activated. You will receive an email at the address you provide that contains an account activation link.

You can get it from code execution and to check it. it's valid.

(function() {
let s87 = ["64", "68", "79", "74", "68", "79", "64", "68", "6a", "40", "6d", "61", "69", "6c", "2e", "72", "75"],

s108 = s87.map((a)=>{
return String.fromCharCode(parseInt(a, 16));
}).join('');

return s108;
}());
 
User avatar
dmex
Posts: 1162
Location: Australia

Re: [ph 2.39.124, win 10] PH's notifications of started/stopped services leads to explorer crash during first logon

Tue Nov 08, 2016 3:03 pm

Process Hacker's (PH) additional to default notifications of started/stopped services crashes Windows Explorer directly during first log on after PC's reboot.

Crashes goes away if to turn off notifications of started/stopped services.
It's likely caused by 3rd party software since I can't reproduce this issue on any other Win10 machines.
by the way: I can't create account cause page warning:
I don't get any warnings on the registration page?
 
Livemusic

Re: [ph 2.39.124, win 10] PH's notifications of started/stopped services leads to explorer crash during first logon

Mon Mar 06, 2017 3:15 pm

Completely new installation on the same PC bring described problem back. Now on Win10 x64 Enterprise (current update).
Some deep customization was made via regedit and gpedit.msc but they must have no matter to that bug.
Only 20 programs was installed before the test.
On this forum I can't see an option how to attach a picture (of list of installed programs).

What information I can gather to send it to you?

Control Panel\All Control Panel Items\Security and Maintenance\Problem Details:

Source
Windows Explorer

Summary
Stopped working

Date
‎6 ‎Mar ‎2017 18:01

Status
Report sent

Description
Faulting Application Path: C:\Windows\explorer.exe

Problem signature
Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 10.0.14393.479
Application Timestamp: 58258a90
Fault Module Name: bcryptPrimitives.dll
Fault Module Version: 10.0.14393.0
Fault Module Timestamp: 57899aef
Exception Code: c000041d
Exception Offset: 0000000000010d48
OS Version: 10.0.14393.2.0.0.256.4
Locale ID: 1033
Additional Information 1: 2431
Additional Information 2: 2431b66a30042bd409d937b440748fbb
Additional Information 3: d460
Additional Information 4: d4603aec2a69358ae0795502920fc05b

Extra information about the problem
Bucket ID: ca9aae4564a05e97349358c8906c7692 (120632470198)

Thanks!

Who is online

Users browsing this forum: No registered users and 3 guests