New
#1
Explorer.exe crash when right click->New
Hi,
I have a windows 10 computer which crashes when I right click and open the "new" submenu.
I already tried to :
- disable all non microsoft shell extension with ShellExView
- try in safe mode (same issue)
- run sfc /scannow and dism repair
I found out that if I edit "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew \Classes" to remove DOCX or rename DOCX to docx it fixes the issue. BUT, this change is overwriten each time I open this "new" right click menu, so it only works one time.
A solution could be to make this change permanent but I don't know how...
Here is a crash dump analysis from osronline :
Code:*** WARNING: Unable to verify timestamp for sppc.dll *** ERROR: Module load completed but symbols could not be loaded for sppc.dll *** WARNING: Unable to verify timestamp for DropboxExt64.18.0.dll *** ERROR: Module load completed but symbols could not be loaded for DropboxExt64.18.0.dll *** WARNING: Unable to verify timestamp for ashShA64.dll *** ERROR: Module load completed but symbols could not be loaded for ashShA64.dll TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2 GetUrlPageData2 (WinHttp) failed: 12029. *** The OS name list needs to be updated! Unknown Windows version: 10.0 *** FAULTING_IP: shell32!CheckFileTypeForShellNew+32 00007ffe`a84b5616 488b03 mov rax,qword ptr [rbx] EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 00007ffea84b5616 (shell32!CheckFileTypeForShellNew+0x0000000000000032) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 PROCESS_NAME: explorer.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 READ_ADDRESS: 0000000000000000 FOLLOWUP_IP: shell32!CheckFileTypeForShellNew+32 00007ffe`a84b5616 488b03 mov rax,qword ptr [rbx] NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 0000000000002528 BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_READ_AFTER_CALL PRIMARY_PROBLEM_CLASS: NULL_POINTER_READ_AFTER_CALL DEFAULT_BUCKET_ID: NULL_POINTER_READ_AFTER_CALL LAST_CONTROL_TRANSFER: from 00007ffea84b65b8 to 00007ffea84b5616 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: shell32!CheckFileTypeForShellNew+32 FOLLOWUP_NAME: MachineOwner MODULE_NAME: shell32 IMAGE_NAME: shell32.dll DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: ~77s; .ecxr ; kb FAILURE_BUCKET_ID: NULL_POINTER_READ_AFTER_CALL_c0000005_shell32.dll!CheckFileTypeForShellNew BUCKET_ID: X64_APPLICATION_FAULT_NULL_POINTER_READ_AFTER_CALL_shell32!CheckFileTypeForShellNew+32 WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/10_0_15063_447/951324bb/shell32_dll/10_0_15063_502/944613c6/c0000005/00435616.htm?Retriage=1