EXPLORER.EXE crashing in SHELL32.DLL

[JeanHT]

I have a brand new X1 Carbon 20A7 with Windows 8.1 Professional. EXPLORER.EXE is crashing constantly. I disabled non-Microsoft shell extensions, applied all updates, even restored back to the factory image, but nothing works. This is a very expensive new machine that is basically an unstable paperweight.

Can someone look at the following minidump analysis, and give me some ideas, please?

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

FAULTING_IP:
shell32!Microsoft::WRL::ComPtr<ISyncStatusCacheEntry>::As<IUnknown>+22
00007ffb`535771d2 488b01          mov     rax,qword ptr [rcx]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00007ffb535771d2 (shell32!Microsoft::WRL::ComPtr<ISyncStatusCacheEntry>::As<IUnknown>+0x0000000000000022)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
rax=00000000139b0000 rbx=0000000000000003 rcx=00000000139b0000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000003
rip=00007ffb54586b2a rsp=00000000194fbd58 rbp=00000000194ffa90
 r8=0000000000001000  r9=0000000000000000 r10=0000000000000040
r11=0000000000000286 r12=0000000000000010 r13=00000000194fc128
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0xa:
00007ffb`54586b2a c3              ret

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS:  0000000000000000

FOLLOWUP_IP:
shell32!Microsoft::WRL::ComPtr<ISyncStatusCacheEntry>::As<IUnknown>+22
00007ffb`535771d2 488b01          mov     rax,qword ptr [rcx]

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  explorer.exe

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

FAULTING_THREAD:  00000000000007fc

BUGCHECK_STR:  APPLICATION_FAULT_NULL_POINTER_READ_BEFORE_CALL

PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ_BEFORE_CALL

DEFAULT_BUCKET_ID:  NULL_POINTER_READ_BEFORE_CALL

LAST_CONTROL_TRANSFER:  from 00007ffb5313d131 to 00007ffb535771d2

STACK_TEXT: 
00000000`194fd630 00007ffb`5313d131 : 00000000`00000000 00007ffb`52ec9ce7 00000000`14a36180 00000000`00000000 : shell32!Microsoft::WRL::ComPtr<ISyncStatusCacheEntry>::As<IUnknown>+0x22
00000000`194fd660 00007ffb`5313c71a : 00000000`00000000 00000000`00000000 00000000`194fd700 00000000`194fd700 : shell32!`Microsoft::WRL::Module<1,Microsoft::WRL:etails:efaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x95b3d
00000000`194fd6a0 00007ffb`5301e455 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`2446ea40 : shell32!`Microsoft::WRL::Module<1,Microsoft::WRL:etails:efaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x9510b
00000000`194fd740 00007ffb`53020174 : 00000000`00000001 00000000`241e5998 00000000`241e5998 00000000`00000000 : shell32!CSyncIntegrationManager::_GetValueAndStateFromCache+0x85
00000000`194fd7e0 00007ffb`53018930 : 00000000`00000000 00000000`194ff680 00000000`00000000 00000000`00000000 : shell32!CSyncIntegrationManager::GetSyncStatusByIdList+0x88
00000000`194fd8b0 00007ffb`5301d0dc : 00000000`00000000 00000000`087e18d0 00000000`00000000 00000000`00000000 : shell32!CSyncStatusHandler::GetValue+0x70
00000000`194fd910 00007ffb`52d42a12 : 00000000`194ff698 00000000`00000000 00000000`00000000 00007ffb`52ec338d : shell32!CFSFolder::_GetSyncStatusProperties+0xc8
00000000`194fd990 00007ffb`4cea6656 : 00000000`14d82000 00007ffb`4cea2930 00000000`194ff690 00007ffb`4cea2930 : shell32!CFSFolderPropertyStore::GetValue+0x5e8
00000000`194fef10 00007ffb`4cea6656 : 00000000`14d82000 00000000`00000001 00000000`00000001 00007ffb`4cea2930 : propsys!CMultiplexPropertyStore::GetValue+0x186
00000000`194ff190 00007ffb`4cea32ff : 00007ffb`52f0b4f0 00000000`00514b80 00000000`24519398 00000000`194ff680 : propsys!CMultiplexPropertyStore::GetValue+0x186
00000000`194ff410 00007ffb`4cea56ca : 00000000`00000000 00000000`194ff680 00000000`194ff680 00000000`00000000 : propsys!PSGetValueAndPath+0x5f
00000000`194ff490 00007ffb`5301ca14 : 00000000`00000000 00000000`04e30000 00007ffb`53048050 00000000`194ff680 : propsys!CPropertyProvider::GetValue+0xca
00000000`194ff630 00007ffb`5301b7a5 : 00000000`00000000 00000000`242823e0 00000000`80004005 00007ffb`52fd93eb : shell32!CStatusBarPropertyStore::GetValue+0x78
00000000`194ff660 00007ffb`5301b623 : 00000000`242823e0 00000000`00000003 00000000`194ff720 00000000`1271cab0 : shell32!CGetPropertiesWorkItem::_CacheProperty+0x55
00000000`194ff6e0 00007ffb`530215d2 : 00000000`00000000 00007ff6`b23b9000 00000000`242823e0 00000000`00000002 : shell32!CGetPropertiesWorkItem::_CachePropertyList+0x77
00000000`194ff750 00007ffb`52fd90c7 : 00000000`12645b30 00000000`243122c0 00000000`00000000 00000000`087e0e30 : shell32!CGetPropertiesWorkItem:oWork+0x8e
00000000`194ff7a0 00007ffb`52ebb565 : 00000000`00000ca0 00000000`243122c0 00000000`0000000f 00000000`0000000b : shell32!CFrameTask::InternalResumeRT+0x17
00000000`194ff7d0 00007ffb`52efe6b0 : 00000000`00000000 00000000`00000000 ffffffff`fffffffe 00000000`00200000 : shell32!CRunnableTask::Run+0x95
00000000`194ff800 00007ffb`52efe887 : 00000000`2444ef80 00000000`2444ef80 00000000`00424270 00000000`00486d48 : shell32!CShellTaskThread::ThreadProc+0x284
00000000`194ff950 00007ffb`4e041637 : 00007ff6`b223c000 00000000`00000000 0000f3e1`90eaa829 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x2b
00000000`194ff980 00007ffb`5451a122 : 00000000`14cb0750 00000000`00486d48 00000000`00000000 00000000`00000017 : SHCore!ExecuteWorkItemThreadProc+0xf
00000000`194ff9b0 00007ffb`5452bddb : 00000001`00010004 00000000`1664ea50 00000000`00486d48 00000000`00424270 : ntdll!RtlpTpWorkCallback+0x11e
00000000`194ffa90 00007ffb`52bf15cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x81b
00000000`194ffe80 00007ffb`545643d1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`194ffeb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  shell32!Microsoft::WRL::ComPtr<ISyncStatusCacheEntry>::As<IUnknown>+22

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: shell32

IMAGE_NAME:  shell32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5279002b

STACK_COMMAND:  ~67s; .ecxr ; kb

FAILURE_BUCKET_ID:  NULL_POINTER_READ_BEFORE_CALL_c0000005_shell32.dll!Microsoft::WRL::ComPtr_ISyncStatusCacheEntry_::As_IUnknown_

BUCKET_ID:  APPLICATION_FAULT_NULL_POINTER_READ_BEFORE_CALL_shell32!Microsoft::WRL::ComPtr_ISyncStatusCacheEntry_::As_IUnknown_+22

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:null_pointer_read_before_call_c0000005_shell32.dll!microsoft::wrl::comptr_isyncstatuscacheentry_::as_iunknown_

FAILURE_ID_HASH:  {4b7ac51a-a918-f7d6-8b9f-6758c5666bf4}

Followup: MachineOwner
---------

[JeanHT]

How can I get technical support for this issue? It has persisted even after the April 8th updates.

[Mark_Lenovo Former Administrator]

Jean,

The forum is primarily peer to peer support,  but we can look into this ....

If this were a widespread problem with the X1 from a hardware standpoint, or an issue with the preload, I would expect to see a lot of people complaining about this issue in the forum.   

If this winds up as an isolated case, then perhaps it is either a hardware issue with your system - drive, memory, system board are potential culprits and service could try to repair, or the image is corrupt.

I would have suggested backing up your data and doing the factory reset, but sounds like you have already done this at least once with the same results.   Can you confirm that it crashes after resetting to factory, but before you add in other updates or applications?

Best regards,

Mark

I would agree this is more of a hardware support case (could be software root cause) rather than a usability issue with Windows.  I agree our technical support should provide assistance to you, perhaps even via remote connection session.

Have you also tried diagnostics?  Could you try to download and run the Lenovo Solution Center and run HDD, memory and system board tests?

[JeanHT]

Mark,

The steps to reproduce this problem are concrete and reliable, but are not likely to be something that many people do on a widespread basis. That's why you aren't hearing about this particular flavor of EXPLORER.EXE crash from other people.

The crash occurs after reimaging back to factory, yes.

I believe that I have found a true bug in Windows itself or a conflict between Lenovo and Windows.

[someotherguy]

---

JeanHT wrote:

The steps to reproduce this problem are concrete and reliable, 

---

Can you please tell us what the concrete and reliable steps are?

Also, can you please upload the .dmp or .mdmp file to dropbox/skydrive/etc and post a link here so I can download it?

[JeanHT]

The minidump is located at:

https://drive.google.com/file/d/0B6rGZlHtOqk7LW94Z2l3V2JvMDg/edit?usp=sharing

Open up what I called File Explorer in Windows 7 and earlier version. Find a nice, deep, complex folder structure like C:\Windows. Left click on the folder name to ensure that the contents of that folder are selected.

Now this is a little hard to explain, but the idea is that you traverse the folder structure, displaying the contents of every subfolder. I do this with the keyboard by pressing IN THIS ORDER: Enter, Right Arrow, Down Arrow, and repeating the sequence. This steps you into every level of the folder structure, displaying the contents of each folder.

It can take up to a minute, but no more than two minutes, of doing this over and over until EXPLORER.EXE dies, taking the desktop with it.

[someotherguy]

Can you please try uninstalling Lenovo Solution Center (from Control Panel -> Programs and Features), reboot, and then see if the problem still happens?

You can always reinstall Lenovo Solution Center again later (if you want to) from the below link:

http://support.lenovo.com/en_US/downloads/detail.page?&LegacyDocID=MIGR-73784

While I can't be sure, there is something in the dmp file you posted that makes me suspicious about Deskband64.dll which is a component of Lenovo Solution Center.  This is the reason why I ask you to try uninstalling it.

[JeanHT]

Thank you for the suggestion, but uninstalling Lenovo Solution Center had no effect whatsoever.

[someotherguy]

I was able to repro the crash which happens after approx 120 iterations of "Enter - right arrow - down arrow" in File Explorer.

First I reproduced the crash using a Lenovo Win8.1 factory preload.

Then I reproduced the crash using a clean install of Win8.1 without any Lenovo software at all.

Finally I downloaded and install the Windows 8.1 update from Microsoft (released yesterday) but the crash can still be reproduced.

So in my opinion you have found a Win8.1 bug.  Could you try to report it to a Microsoft forum to see if you could get help that way?  

Anyway, I don't have any other suggestions or ideas about how to help.

[JeanHT]

Dear someotherguy,

Thank you so very much for taking the time to try to reproduce the problem!

I have posted this in the Microsoft Windows 8.1 Community Forums in the FIles, Folders, and Online Storage section. So far, one Microsoft representative has responded, asking me to disable the DLNA shell extension, which I have already tried. We'll see if he comes up with anything that I haven't tried already, which is doubtful. But at least I believe I'm in the right area for reporting the problem.

If anyone is interested in following Microsoft's response, you can follow it this thread:

http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/traversing-folder-structure-crashe...

Sadly, I think I am going to have to return this X1 Carbon with touch screen. Windows 8.1 isn't able to handle the high resolution video well, the touchpad is flaky, and the problems are more than I am willing to deal with. The Macbook Air killer is close, but not quite there yet. I hope it will be soon.