# Explorer.exe often hangs with error 1002



## ihstech (Oct 1, 2012)

Here's my situation. I recently installed a Windows Multipoint Server 2010 system in a career center lab. There are 17 user and 2 admin accounts. On the admin accounts only, Explorer.exe will hang and have to be closed and restarted. There is no BSOD, just the hang which eventually clears itself, or sometimes I have to log the user off from the server, then the thin client auto reconnects and logs into a fresh session.

Here is the info from the error report. A link to download the dump file is below.


```
Version=1
EventType=AppHangB1
EventTime=129931453573257938
ReportType=3
Consent=1
UploadTime=129931453603369660
ReportIdentifier=34fa0d7d-07eb-11e2-a49d-d4ae528e4990
IntegratorReportIdentifier=34fa0d7e-07eb-11e2-a49d-d4ae528e4990
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=explorer.exe
Sig[1].Name=Application Version
Sig[1].Value=6.1.7601.17567
Sig[2].Name=Application Timestamp
Sig[2].Value=4d672ee4
Sig[3].Name=Hang Signature
Sig[3].Value=3d36
Sig[4].Name=Hang Type
Sig[4].Value=513
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.16.56
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Hang Signature 1
DynamicSig[22].Value=3d36256c3f9397766e1165719128ac36
DynamicSig[23].Name=Additional Hang Signature 2
DynamicSig[23].Value=33c5
DynamicSig[24].Name=Additional Hang Signature 3
DynamicSig[24].Value=33c5ab16836cdc53ffc9694a2ac234f4
DynamicSig[25].Name=Additional Hang Signature 4
DynamicSig[25].Value=3d36
DynamicSig[26].Name=Additional Hang Signature 5
DynamicSig[26].Value=3d36256c3f9397766e1165719128ac36
DynamicSig[27].Name=Additional Hang Signature 6
DynamicSig[27].Value=33c5
DynamicSig[28].Name=Additional Hang Signature 7
DynamicSig[28].Value=33c5ab16836cdc53ffc9694a2ac234f4
UI[3]=Windows Explorer is not responding
UI[4]=If you restart or close the program, you might lose information.
UI[5]=Restart the program
UI[6]=Restart the program
UI[7]=Close the program
LoadedModule[0]=C:\Windows\explorer.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\system32\kernel32.dll
LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\System32\SYSFER.DLL
LoadedModule[5]=C:\Windows\system32\ADVAPI32.dll
LoadedModule[6]=C:\Windows\system32\msvcrt.dll
LoadedModule[7]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[8]=C:\Windows\system32\RPCRT4.dll
LoadedModule[9]=C:\Windows\system32\GDI32.dll
LoadedModule[10]=C:\Windows\system32\USER32.dll
LoadedModule[11]=C:\Windows\system32\LPK.dll
LoadedModule[12]=C:\Windows\system32\USP10.dll
LoadedModule[13]=C:\Windows\system32\SHLWAPI.dll
LoadedModule[14]=C:\Windows\system32\SHELL32.dll
LoadedModule[15]=C:\Windows\system32\ole32.dll
LoadedModule[16]=C:\Windows\system32\OLEAUT32.dll
LoadedModule[17]=C:\Windows\system32\EXPLORERFRAME.dll
LoadedModule[18]=C:\Windows\system32\DUser.dll
LoadedModule[19]=C:\Windows\system32\DUI70.dll
LoadedModule[20]=C:\Windows\system32\IMM32.dll
LoadedModule[21]=C:\Windows\system32\MSCTF.dll
LoadedModule[22]=C:\Windows\system32\UxTheme.dll
LoadedModule[23]=C:\Windows\system32\POWRPROF.dll
LoadedModule[24]=C:\Windows\system32\SETUPAPI.dll
LoadedModule[25]=C:\Windows\system32\CFGMGR32.dll
LoadedModule[26]=C:\Windows\system32\DEVOBJ.dll
LoadedModule[27]=C:\Windows\system32\dwmapi.dll
LoadedModule[28]=C:\Windows\system32\slc.dll
LoadedModule[29]=C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_2b253c8271ec7765\gdiplus.dll
LoadedModule[30]=C:\Windows\system32\Secur32.dll
LoadedModule[31]=C:\Windows\system32\SSPICLI.DLL
LoadedModule[32]=C:\Windows\system32\PROPSYS.dll
LoadedModule[33]=C:\Windows\system32\CRYPTBASE.dll
LoadedModule[34]=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll
LoadedModule[35]=C:\Windows\system32\WindowsCodecs.dll
LoadedModule[36]=C:\Windows\system32\profapi.dll
LoadedModule[37]=C:\Windows\system32\apphelp.dll
LoadedModule[38]=C:\Windows\system32\CLBCatQ.DLL
LoadedModule[39]=C:\Windows\system32\EhStorShell.dll
LoadedModule[40]=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
LoadedModule[41]=C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
LoadedModule[42]=C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCP90.dll
LoadedModule[43]=C:\Windows\WinSxS\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_0a1d2fcba76b3f00\ATL90.DLL
LoadedModule[44]=C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
LoadedModule[45]=C:\PROGRA~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
LoadedModule[46]=C:\Windows\System32\cscui.dll
LoadedModule[47]=C:\Windows\System32\CSCDLL.dll
LoadedModule[48]=C:\Windows\system32\CSCAPI.dll
LoadedModule[49]=C:\Windows\system32\ntshrui.dll
LoadedModule[50]=C:\Windows\system32\srvcli.dll
LoadedModule[51]=C:\Windows\system32\IconCodecService.dll
LoadedModule[52]=C:\Windows\system32\CRYPTSP.dll
LoadedModule[53]=C:\Windows\system32\rsaenh.dll
LoadedModule[54]=C:\Windows\system32\RpcRtRemote.dll
LoadedModule[55]=C:\Windows\system32\SndVolSSO.DLL
LoadedModule[56]=C:\Windows\system32\HID.DLL
LoadedModule[57]=C:\Windows\System32\MMDevApi.dll
LoadedModule[58]=C:\Windows\system32\WINSTA.dll
LoadedModule[59]=C:\Windows\system32\rdpendp.dll
LoadedModule[60]=C:\Windows\system32\WINMM.dll
LoadedModule[61]=C:\Windows\system32\MSACM32.dll
LoadedModule[62]=C:\Windows\system32\WTSAPI32.dll
LoadedModule[63]=C:\Windows\system32\timedate.cpl
LoadedModule[64]=C:\Windows\system32\ATL.DLL
LoadedModule[65]=C:\Windows\System32\shdocvw.dll
LoadedModule[66]=C:\Windows\system32\msiltcfg.dll
LoadedModule[67]=C:\Windows\system32\VERSION.dll
LoadedModule[68]=C:\Windows\system32\msi.dll
LoadedModule[69]=C:\Windows\system32\LINKINFO.dll
LoadedModule[70]=C:\Windows\system32\USERENV.dll
LoadedModule[71]=C:\Windows\system32\ntmarta.dll
LoadedModule[72]=C:\Windows\system32\WLDAP32.dll
LoadedModule[73]=C:\Windows\System32\ieframe.dll
LoadedModule[74]=C:\Windows\system32\PSAPI.DLL
LoadedModule[75]=C:\Windows\System32\OLEACC.dll
LoadedModule[76]=C:\Windows\system32\iertutil.dll
LoadedModule[77]=C:\Windows\system32\urlmon.dll
LoadedModule[78]=C:\Windows\system32\WININET.dll
LoadedModule[79]=C:\Windows\system32\CRYPT32.dll
LoadedModule[80]=C:\Windows\system32\MSASN1.dll
LoadedModule[81]=C:\Windows\system32\SAMLIB.dll
LoadedModule[82]=C:\Windows\system32\samcli.dll
LoadedModule[83]=C:\Windows\system32\netutils.dll
LoadedModule[84]=C:\Windows\system32\MsftEdit.dll
LoadedModule[85]=C:\Windows\system32\msls31.dll
LoadedModule[86]=C:\Windows\system32\authui.dll
LoadedModule[87]=C:\Windows\system32\CRYPTUI.dll
LoadedModule[88]=C:\Windows\system32\NetworkExplorer.dll
LoadedModule[89]=C:\Windows\system32\msutb.dll
LoadedModule[90]=C:\Windows\system32\XmlLite.dll
LoadedModule[91]=C:\Windows\system32\stobject.dll
LoadedModule[92]=C:\Windows\system32\BatMeter.dll
LoadedModule[93]=C:\Windows\system32\WINTRUST.dll
LoadedModule[94]=C:\Windows\system32\prnfldr.dll
LoadedModule[95]=C:\Windows\system32\WINSPOOL.DRV
LoadedModule[96]=C:\Windows\system32\AUDIOSES.DLL
LoadedModule[97]=C:\Windows\system32\dxp.dll
LoadedModule[98]=C:\Windows\system32\Syncreg.dll
LoadedModule[99]=C:\Windows\System32\netshell.dll
LoadedModule[100]=C:\Windows\System32\IPHLPAPI.DLL
LoadedModule[101]=C:\Windows\system32\NSI.dll
LoadedModule[102]=C:\Windows\System32\WINNSI.DLL
LoadedModule[103]=C:\Windows\System32\nlaapi.dll
LoadedModule[104]=C:\Windows\System32\AltTab.dll
LoadedModule[105]=C:\Windows\system32\wpdshserviceobj.dll
LoadedModule[106]=C:\Windows\system32\PortableDeviceTypes.dll
LoadedModule[107]=C:\Windows\system32\PortableDeviceApi.dll
LoadedModule[108]=C:\Windows\system32\mssprxy.dll
LoadedModule[109]=C:\Windows\System32\pnidui.dll
LoadedModule[110]=C:\Windows\System32\QUtil.dll
LoadedModule[111]=C:\Windows\System32\wevtapi.dll
LoadedModule[112]=C:\Windows\system32\dhcpcsvc6.DLL
LoadedModule[113]=C:\Windows\system32\WS2_32.dll
LoadedModule[114]=C:\Windows\system32\dhcpcsvc.DLL
LoadedModule[115]=C:\Windows\System32\npmproxy.dll
LoadedModule[116]=C:\Windows\System32\QAgent.dll
LoadedModule[117]=C:\Windows\System32\srchadmin.dll
LoadedModule[118]=C:\Windows\system32\SXS.DLL
LoadedModule[119]=C:\Windows\System32\SyncCenter.dll
LoadedModule[120]=C:\Windows\System32\Actioncenter.dll
LoadedModule[121]=C:\Windows\system32\imapi2.dll
LoadedModule[122]=C:\Windows\System32\hgcpl.dll
LoadedModule[123]=C:\Windows\System32\werconcpl.dll
LoadedModule[124]=C:\Windows\System32\wer.dll
LoadedModule[125]=C:\Windows\System32\framedynos.dll
LoadedModule[126]=C:\Windows\System32\wercplsupport.dll
LoadedModule[127]=C:\Windows\System32\msxml6.dll
LoadedModule[128]=C:\Windows\System32\hcproviders.dll
LoadedModule[129]=C:\Program Files\Internet Explorer\ieproxy.dll
LoadedModule[130]=C:\Windows\system32\MPR.dll
LoadedModule[131]=C:\Windows\system32\snacnp.dll
LoadedModule[132]=C:\Windows\System32\drprov.dll
LoadedModule[133]=C:\Windows\System32\ntlanman.dll
LoadedModule[134]=C:\Windows\System32\davclnt.dll
LoadedModule[135]=C:\Windows\System32\DAVHLPR.dll
LoadedModule[136]=C:\Windows\system32\LMIRfsClientNP.dll
LoadedModule[137]=C:\Windows\system32\wkscli.dll
LoadedModule[138]=C:\Windows\system32\actxprxy.dll
LoadedModule[139]=C:\Windows\system32\dsrole.dll
LoadedModule[140]=C:\Windows\System32\StructuredQuery.dll
LoadedModule[141]=C:\Windows\system32\wdmaud.drv
LoadedModule[142]=C:\Windows\system32\ksuser.dll
LoadedModule[143]=C:\Windows\system32\AVRT.dll
LoadedModule[144]=C:\Windows\system32\msacm32.drv
LoadedModule[145]=C:\Windows\system32\rasadhlp.dll
LoadedModule[146]=C:\Windows\system32\SFC.DLL
LoadedModule[147]=C:\Windows\system32\sfc_os.DLL
LoadedModule[148]=C:\Windows\system32\DEVRTL.dll
LoadedModule[149]=C:\Windows\system32\MLANG.dll
FriendlyEventName=Stopped responding and was closed
ConsentKey=AppHangXProcB1
AppName=Windows Explorer
AppPath=C:\Windows\explorer.exe
ReportDescription=A problem caused this program to stop interacting with Windows.
```
I managed to create a dump file on a hang I experienced. It is too big to attach so here is a link to download.

https://docs.google.com/open?id=0B696ZxtbfvhdTnZsMW9kdjloY1k

If anyone is able to pull any information from this dump file, I'd be greatly appreciated.

It would seem that it is caused by a program that requires user interaction because I never see the hangs on weekends when the lab is closed, even though the accounts stay logged in.


----------



## VirGnarus (Jun 28, 2010)

What is this program? It may be conflicting with Symantec CMC Firewall because the Explorer.exe threads involved here just reek of Symantec hooks. The issue is that a couple of critical sections are being contested between some threads which results in a deadlock of the application. I would love to explore further but I'm not sure my expertise are quite at that level yet. However, I can see that Symantec Firewall driver (sysfer.dll) has its grummy paws all over these threads, so I figure that'd be the first place to go right now.

The driver itself is dated April 17. Try to see if there's any patches, updates, etc., for your Symantec software. Make sure the application you're referring too also has any updates.

I will try to explore this further, but don't place any bets.


----------



## ihstech (Oct 1, 2012)

VirGnarus said:


> What is this program?


I am not sure what you are referring to?

I may have fixed the problem here. I haven't posted about it yet because I have been monitoring it throughout the week. There was a software on the server that allowed me to monitor and manage the HP thin clients the lab is using. That software was only allowed to run on admin accounds so I figured I would start there since only admins are having the issue. I uninstalled it and I haven't seen any explorer.exe error reports since.

You are probably right though, it was probably conflicting with the firewall on Symantec Endpoint Protection.

Did you get the information you mentioned from the dump file?


----------



## VirGnarus (Jun 28, 2010)

Yes, I was asking what program it was that you were referring to that required user interaction. 

I personally don't see (yet) any other application modules outside of the Symantec one in these threads, but I have at least seen something that may hint to the deadlock, that being one of the threads in explorer.exe holding the resource ran into a c0000022 (access denied) error. Again, I'm curious how this happened exactly, so I may peruse around it some more, even if the problem has been resolved.

Anyways, good to hear things are fixed, and thanks for the challenge!


----------



## ihstech (Oct 1, 2012)

When I mentioned a program, I was speaking in a general sense, not about a specific program.

Removing the HP software stopped the freezing but it was probably just a piece of what was causing it. Since it didn't happen on weekends, and that software was still on and functioning on weekends, there has to be more to it.

It would seem that the lockups usually involved IE8 as well. The users were usually on IE8 when the hang occured. IE8 is still showing up as having non-critical errors every day, and on every user account not just admins. I can't update from IE8 because the 2 admins need it for a New York State website that requires it.

BTW, i just noticed that I put Multipoint Server 2010, when this is 2011. I'm looking forward to 2012 because apparently I can make user accounts that are able to run the Multipoint Manager without being server admins.


----------

