Explorer.exe crashes

[Gizmokid2005]

Guys, I'm at my wits' end so I figured I'd start here. Windows Explorer will randomly crash on me...sometimes with a memory error, other times with a DEP error, other times just the standard "app has crashed" windows error....I've done some googling and I can't really pinpoint where the issue is coming from. So I'm going to start here, maybe you guys have some ideas, or can find something that I may be missing on my system.

Starting with!!!

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:43 AM, on 6/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\F@H\Console 1\Folding@home-Win32-x86.exe
D:\F@H\Console 2\Folding@home-Win32-x86.exe
D:\F@H\Console 1\FahCore_78.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\F@H\Console 3\Folding@home-Win32-x86.exe
D:\F@H\Console 2\FahCore_78.exe
D:\F@H\Console 3\FahCore_78.exe
D:\Program Files\LogMeIn\x86\RaMaint.exe
D:\Program Files\LogMeIn\x86\LogMeIn.exe
D:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\lxdjcoms.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Lexmark 1400\lxdjamon.exe
D:\Program Files\LogMeIn\x86\LogMeInSystray.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\LogMeIn\x86\LMIGuardian.exe
D:\program files\steam\steam.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\My Documents\Programs\CoreTemp\Core Temp.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\My Documents\Programs\Process Explorer\procexp.exe
D:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\iPod\bin\iPodService.exe
T:\TrueCrypt\TrueCrypt.exe
D:\F@H\GPU_Console\Folding@home-Win32-GPU.exe
I:\PortableApps\PortableApps.com\PortableAppsPlatf orm.exe
I:\PortableApps\KVIrcPortableTest\App\KVIrc\kvirc4 .exe
I:\PortableApps\ThunderbirdPortable\ThunderbirdPor table.exe
I:\PortableApps\ThunderbirdPortable\App\thunderbir d\thunderbird.exe
C:\WINDOWS\system32\cmd.exe
I:\PortableApps\PidginPortable\App\Pidgin\pidgin-portable.exe
D:\My Documents\Programs\FreeMeter\FreeMeter.exe
C:\WINDOWS\system32\dllhost.exe
D:\F@H\GPU_Console\FahCore_11.exe
D:\Program Files\AVG\AVG8\avgscanx.exe
D:\Program Files\AVG\AVG8\avgcsrvx.exe
I:\PortableApps\FirefoxPortable\FirefoxPortable.ex e
I:\PortableApps\FirefoxPortable\App\firefox\firefo x.exe
C:\WINDOWS\explorer.exe
D:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [lxdjamon] "D:\Program Files\Lexmark 1400\lxdjamon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "D:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Core Temp] "D:\My Documents\Programs\CoreTemp\Core Temp.exe"
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Shortcut to procexp.lnk = D:\My Documents\Programs\Process Explorer\procexp.exe
O4 - Global Startup: APC UPS Status.lnk = D:\Program Files\APC\APC PowerChute Personal Edition\Display.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1234495968078
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Folding@home-CPU-[1] - Unknown owner - D:\F@H\Console 1\Folding@home-Win32-x86.exe
O23 - Service: Folding@home-CPU-[2] - Unknown owner - D:\F@H\Console 2\Folding@home-Win32-x86.exe
O23 - Service: Folding@home-CPU-[3] - Unknown owner - D:\F@H\Console 3\Folding@home-Win32-x86.exe
O23 - Service: Folding@home-GPU-[4] - Unknown owner - D:\F@H\GPU_Console\Folding@home-Win32-GPU.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - D:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - D:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdjse rv.exe
O23 - Service: lxdj_device - - C:\WINDOWS\system32\lxdjcoms.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe

--
End of file - 8443 bytes

[jholland1964]

Other than the fact I see "LOTS" of things running during the scan I don't see anything bad there. Have you checked the Event Viewer to see what the errors actually say? That should tell you what application caused the problems.

[Gizmokid2005]

Yeah, this PC runs a lot...but I've checked and nothing is really concrete in Event Viewer.

Typically it's a DLL that's an issue but it varies from time to time, here's a list of faults:

Faulting application explorer.exe, version 6.0.2900.5512, faulting module comctl32.dll, version 6.0.2900.5512, fault address 0x0004c5c9.

Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x00011766.

Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Faulting application explorer.exe, version 6.0.2900.5512, faulting module mscomctl.ocx, version 6.1.97.82, fault address 0x00030662.

Faulting application explorer.exe, version 6.0.2900.5512, faulting module shell32.dll, version 6.0.2900.5622, fault address 0x000ef921.


ntdll.dll seems to be a more frequent one.

[jholland1964]

Third party software programs that have been installed on your computer are almost always the cause of ntdll.dll errors. Can you pin down what you are doing specifically when these errors happen?

[Gizmokid2005]

Typically, renaming/deleting files. But sometimes just browsing through files it'll crash, sometimes opening up the quicklaunch menu to get to something...it really varies. Sometimes it won't crash for days, other times it'll crash multiple times in a minute.

[jholland1964]

Gee, I am not sure then...couple things, do you have the PAID version of AdAware? Also AVG 8 is known to cause lots of problems for some people. Has a LOT of bloat added. Are you running the free or paid version? If the free version honestly I would think of getting rid of it and going with either Avira Free, what I use and like a lot or Avast Free.
Avast Free is a "bit bigger". The newest AdAware just isn't what the old version used to be and adds all this stuff running in the background which is...????
Have you run MBA-M as noted in PP"s Sticky?

[Gizmokid2005]

Hmmm.

Free version of Ad-Aware and AVG. And I have noticed that on some machines AVG isn't the happiest...and honestly, the fact that I"m getting DEP errors too, really makes me wonder if that isnt the culprit.

I'll try MBA-M.

[jholland1964]

http://www.free-av.com/ AVIRA Antivirus (Windows 2000/XP,Vista)

The Avira Free has a "nag screen" which pops up when updating, urging you to purchase the program. It can be "x"ed out easily. There is also a fix to remove it all together if one prefers"
Windows 2000/XP: (2000 & XP Pro do not require you to boot into safe mode)
These directions work for Vista also
1. Boot into Safe Mode (tap F8 repeatedly after you restart the computer)
2. Log in using the Administrator account
3. Go to C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.exe
4. Right-click avnotify.exe-> properties-> security-> advanced
5. Under the Permissions tab click on SYSTEM under Permission entries:
6. Edit-> Traverse Folder / Execute File-> deny-> ok ->apply-> yes -> ok-> ok
7. Reboot the computer into Normal Mode (start-> shutdown-> restart)

AVG ANTIVIRUS REMOVAL TOOL

[Gizmokid2005]

Thanks Judy.

According to these links: http://www.av-comparatives.org/image...c_report21.pdf

http://www.av-comparatives.org/image...c_report22.pdf

Avira is a nice one. I'll let MBA-M finish and remove AVG and try that.

[jholland1964]

If the MBA-M shows anything be sure to have it remove whatever it finds and then REBOOT. Post the log here if anything shows.