Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Thursday, October 5, 2017 6:51 PM
Windows 10's explorer is crashing on:
Right-Click file > Send To > Mail Recipient
Here's the application error:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-10-04T11:40:02.739012900Z" />
<EventRecordID>3694</EventRecordID>
<Channel>Application</Channel>
<Computer>pc777.lucky7.local</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>10.0.15063.608</Data>
<Data>b00723ab</Data>
<Data>ntdll.dll</Data>
<Data>10.0.15063.608</Data>
<Data>8274fd8b</Data>
<Data>c0000409</Data>
<Data>000000000009626f</Data>
<Data>1404</Data>
<Data>01d33d0542be8faf</Data>
<Data>C:\WINDOWS\explorer.exe</Data>
<Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data>
<Data>a071ec0e-a54b-4141-814b-82b016c07833</Data>
<Data />
<Data />
</EventData>
</Event>
Things to note:
- On this workstation, both Windows 10 and Office 2016 are fully updated.
- It does this not matter what the Default Application for Email is (Mail, Outlook, and Thunderbird, have been set as default during testing --still crashes).
- The "Mail Recipient.MAPIMail" file on this workstation is identical to "Mail Recipient.MAPIMail" files on other workstations where this feature is working correctly.
- The registry at "Computer\HKEY_CLASSES_ROOT\mailto\shell\open\command" on this workstation is identical to other workstations where this feature is working.
- Each day, additional users are reporting this same issue. It seems like Windows 10 Auto-Updates are breaking this feature one workstation at a time as the auto-updates are getting auto-applied. It seems like the users who never reboot their computer are the ones not experiencing this issue (YET).
Things I've tried:
Background:
A couple of months ago I upgraded one of my user's Windows 10 workstation from Office 2010 Home and Business 32bit to Office Home and Business 2016 64bit. This Mail Recipient feature worked for a long while, then it started crashing Explorer around Thursday of last week.
Expected Behavior:
This user mails a lot of file attachments from Windows File Explorer, by:
- Right-Clicking on one or more files she has highlighted in Internet Explorer.
- Then goes to the sub-menu "Send To" and then clicks "Mail Recipient"
After this, she expect these things to happen:
- Outlook 2016 should compose a new email
- The new email will have all the attachments attached (that she highlighted earlier).
- The subject line of the new email should contain the list of file attachments that are attached to the email.
I appreciate any additional suggestions not included in the links above.
All replies (10)
Thursday, October 5, 2017 7:26 PM | 1 vote
You could activate writing of user mode dumps for explorer by importing a registry file with the content:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe]
"DumpType"=dword:00000001
Then reproduce the problem and upload the dmp file from %LOCALAPPDATA%\CrashDumps to OneDrive, then post a link.
Thursday, October 5, 2017 11:27 PM
The crash dump can be downloaded from here:
explorer.exe.2800.dmp (16MB)
.....................
Loading unloaded module list
...................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(af0.2574): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29 int 29h
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
0:004> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for JitV.dll -
*** WARNING: Unable to verify timestamp for sppc.dll
*** ERROR: Module load completed but symbols could not be loaded for sppc.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MSMAPI32.DLL -
*** WARNING: Unable to verify timestamp for mapi32.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C2R64.dll -
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000000a
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffed7aa626f rsp=00000000031feab8 rbp=00000000031febf0
r8=00000000031ff200 r9=00000000031febb0 r10=00007ffed7b4f534
r11=00007ffed7a10000 r12=00007ffed7a10000 r13=00007ffed7aa632e
r14=00000000031ff7b8 r15=00000000031ff6f0
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29 int 29h
Resetting default scope
FAULTING_IP:
ntdll!LdrpICallHandler+f
00007ffe`d7aa626f cd29 int 29h
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffed7aa626f (ntdll!LdrpICallHandler+0x000000000000000f)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000000a
Subcode: 0xa FAST_FAIL_GUARD_ICALL_CHECK_FAILURE
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000000a
WATSON_BKT_PROCSTAMP: b00723ab
WATSON_BKT_PROCVER: 10.0.15063.608
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: ntdll.dll
WATSON_BKT_MODSTAMP: 8274fd8b
WATSON_BKT_MODOFFSET: 9626f
WATSON_BKT_MODVER: 10.0.15063.608
MODULE_VER_PRODUCT: Microsoft® Windows® Operating System
BUILD_VERSION_STRING: 10.0.15063.246 (WinBuild.160101.0800)
MODLIST_WITH_TSCHKSUM_HASH: 1c63e1053be840a2d95fe7e35ee4cac3ecf6c9ed
MODLIST_SHA1_HASH: 5794374a82ea9aa65833b12c5743a8b6d471d369
NTGLOBALFLAG: 0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
DUMP_FLAGS: 94
DUMP_TYPE: 1
Friday, October 6, 2017 4:36 AM | 1 vote
my version of Windbg (the one from the Store) blames JitV.dll.
(you would have seen this on the callstack, which you did not post).
Image path: C:\Program Files\Microsoft Office\root\Office16\JitV.dll
Timestamp: Sun Aug 20 09:54:55 2017
When you uninstall office: do the crashes stop?
Or perhaps JitV.dll is a shell extension, then you could disable it with ShellExView
and don't need to uninstall Office 16.
Friday, October 6, 2017 3:06 PM
No, after uninstalling office, the crashes continued. Also, after reinstalling Office, the crashes continued.
With ShellExView, I've already tried disabling all non-micrsoft items it lists, but after this the crash-behavior in Explorer continued during Send To > Mail Recipient.
Using ShellExView, I do not see C:\Program Files\Microsoft Office\root\Office16\JitV.dll explicitly referenced:
I'm not sure how to provide the call stack you mentioned. Another user (3 total now), is also reporting the same issue. Here's the Event from the 2nd user:
CrashDumps.zip 4MB
Faulting application name: explorer.exe, version: 10.0.15063.608, time stamp: 0xb00723ab
Faulting module name: ntdll.dll, version: 10.0.15063.608, time stamp: 0x8274fd8b
Exception code: 0xc0000409
Fault offset: 0x000000000009626f
Faulting process id: 0x1e54
Faulting application start time: 0x01d33e308d09e9dc
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 85791bb6-bb58-4523-8010-d5ad18477913
Faulting package full name:
Faulting package-relative application ID:
Log Name: Application
Source: Application Error
Date: 10/5/2017 8:03:01 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: user2.domain.local
Description:
Faulting application name: explorer.exe, version: 10.0.15063.608, time stamp: 0xb00723ab
Faulting module name: ntdll.dll, version: 10.0.15063.608, time stamp: 0x8274fd8b
Exception code: 0xc0000409
Fault offset: 0x000000000009626f
Faulting process id: 0x1e54
Faulting application start time: 0x01d33e308d09e9dc
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 85791bb6-bb58-4523-8010-d5ad18477913
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-10-06T01:03:01.840697300Z" />
<EventRecordID>8312</EventRecordID>
<Channel>Application</Channel>
<Computer>user2.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>10.0.15063.608</Data>
<Data>b00723ab</Data>
<Data>ntdll.dll</Data>
<Data>10.0.15063.608</Data>
<Data>8274fd8b</Data>
<Data>c0000409</Data>
<Data>000000000009626f</Data>
<Data>1e54</Data>
<Data>01d33e308d09e9dc</Data>
<Data>C:\WINDOWS\explorer.exe</Data>
<Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data>
<Data>85791bb6-bb58-4523-8010-d5ad18477913</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
Microsoft asks if it can send this crash info to get help with the issue, but it only leads to a "Page Not Found" page:
http://neartalk.com/ss/2017-10-06_003_1218x911.png
Friday, October 6, 2017 3:20 PM | 1 vote
then post the new dump file
Friday, October 6, 2017 3:40 PM
CrashDumps.zip 4MB
Friday, October 6, 2017 4:05 PM
both new dump files (explorer.exe.7764.dmp and explorer.exe.2420.dmp) were the same
Security check failure or stack buffer overrun in JitV.dll.
I thought you uninstalled office?
The following office dlls are loaded in the process:
C:\Program Files\Microsoft Office\root\Office16\JitV.dll
C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll
C:\Program Files\Microsoft Office\root\Office16\C2R64.dll
and you did not disable all shell extensions:
C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
You are wasting my time.
Friday, October 6, 2017 6:06 PM
I'm sorry, I was sending you yesterday's crash dumps located in the Administrator's crash dump folder.
I should have sent the recent crashed dumps located in the user's crash dump folder linked below:
CrashDumps2.zip 4MB
Also, I've just made a video of me disabling listings in ShellExView:
Do you have to reboot after doing that? Let me know if so.
I did indeed uninstalled Office on the first computer that was having this issue (and also reinstalled it -- I did this twice actually on that computer).
I cannot provide additional crash dumps for that first user, because after uninstalling and reinstalling Office for that computer, I reformatted that computers hard drive and reinstalled Windows 10 and Office to finally resolve the issue on that machine.
I'm trying to avoid having to do that for additional computers having this same issue. Additionally, Office became completely corrupted after uninstalling it and reinstalling it, to the point that I had to redo the entire machine to get Office working again.
Office 2016 Home and Business does not play nice with uninstall and reinstall. I want to avoid going through that again if I can.
If at all possible, I'd like to fix this without completely breaking the another Office install.
Friday, October 6, 2017 9:51 PM
Reinstalling office fixed this issue on one of the computers. But I had to use a special secret method to uninstall cleanly.
The normal uninstall doesn't uninstall cleanly. On another computer I had to Reinstall Windows 10 to ultimately get Office going again.
Thursday, November 29, 2018 3:06 PM
I spent an annoying amount of time today fixing this problem on my Windows 10 64-bit PC. Given that I had only just done a clean full re-installation of Windows 10 two days ago to fix another issue, seeing this symptom straight afterwards was especially irritating!
According to posts elsewhere, the issue seems to be with the 64-bit version of Microsoft Office not communicating with the 64-bit version of Windows correctly - and the fix offered is to simply uninstall MS Office 64-bit and install MS Office 32-bit instead.
However, this fix did not work for me - it just changed File Explorer crashing completely to instead cause File Explorer to do NOTHING AT ALL whenever I right-clicked a file and selected 'Send to', 'Mail Recipient'! Changing and then changing back the default app for Email in 'Settings', 'Apps', 'Default apps' of Windows did not fix things either (as also suggested elsewhere) - and neither did the suggestion to delete Outlook's registry key at 'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook' (and recreate this via yet another re-installation of MS Office 32-bit/64-bit) (I tried reinstalling both 32-bit and 64-bit, but neither worked - even with rebooting at each uninstall/re-install step, and even with running the 'FIXMAPI' command after the re-install completed, as also suggested elsewhere).
The fix that I eventually found was to manually recreate the 'Mail recipient' shortcut in 'C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo' - but not as a plain text file called 'MailRecipient.MAPIMail' (but without the TXT file extension) that simply contains just the word 'Mail' (as recommended in other posts), as this didn't work for me either. Instead I created a normal shortcut file (initially called 'Send to Outlook', but renamed to 'Mail Recipient' once I'd tested it worked and deleted the existing shortcut of this name that was already in this folder). This shortcut had to contain the full path to OUTLOOK.EXE - but with the '/a' command line parameter suffixed to it, as follows:
"C:\Program Files\Microsoft Office 15\root\office15\outlook.exe" -c IPM.Note /a
This fixed the symptom whether 32-bit or 64-bit MS Office is used (I have tested both).
Hopefully this post will save someone the pain that I had today!!