Surface Pro 2017, Win 10 Pro x64: Explorer crash (Windows.UI.XamlHost.dll)

Anonymous
2018-01-04T03:56:25+00:00

Hi:

I have periodic explorer crashes on my Surface Pro 2017, Win Pro x64 (it is fully updated). The crash seems to occur periodically after a Hello Windows log-in (this occurs after the computer was sleeping rather than on a fresh boot). It seems to involve Windows.UI.XamlHost.dll based on the below.

When I look in the Event viewer I see errors like this:

Event ID 1000

Faulting application name: explorer.exe, version: 10.0.16299.125, time stamp: 0xfeba44fb

Faulting module name: Windows.UI.XamlHost.dll, version: 10.0.16299.15, time stamp: 0x00f27b8f

Exception code: 0xc0000409

Fault offset: 0x0000000000001db1

Faulting process id: 0x1880

Faulting application start time: 0x01d38282e4131af4

Faulting application path: C:\WINDOWS\explorer.exe

Faulting module path: C:\Windows\System32\Windows.UI.XamlHost.dll

Report Id: 6e835576-b35e-4d24-b6ce-331b05fa2c55

Faulting package full name:

Faulting package-relative application ID:

If I click on Start > type "view all" then click on "View all problem reports Control panel" the "Windows Explorer" "Stopped working" errors and then double click on one I would get something like this:

Source

Windows Explorer

Summary

Stopped working

Date

‎11/‎26/‎2017 10:53 AM

Status

Report sent

Description

Faulting Application Path: C:\Windows\explorer.exe

Problem signature

Problem Event Name: BEX64

Application Name: Explorer.EXE

Application Version: 10.0.16299.15

Application Timestamp: 66e02565

Fault Module Name: Windows.UI.XamlHost.dll

Fault Module Version: 10.0.16299.15

Fault Module Timestamp: 00f27b8f

Exception Offset: 0000000000001db1

Exception Code: c0000409

Exception Data: 0000000000000007

OS Version: 10.0.16299.2.0.0.256.48

Locale ID: 1033

Additional Information 1: 2eb9

Additional Information 2: 2eb9591f0e04c7cfea277e3f34d3348f

Additional Information 3: 9333

Additional Information 4: 9333781589f3ec46cd357f0fda06eea0

Extra information about the problem

Bucket ID: 15f01e3e317a50b7b6bb92d1b9fc4f7c (116455065336)

I am at a loss to understand what the problem is here. I am glad to disable Hello Windows if this would end the problem. Thanks in advance for any help on this!

[Moved from: Windows / Windows 10 / Windows Hello, lock screen & sign-in]

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

68 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2018-02-04T14:00:33+00:00

    Nope. I put a screenshot below of the remaining DropBox folder: the Update folder is empty.

    I have not rebooted since uninstalling so maybe somehow Dropbox is lingering.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-02-04T01:03:44+00:00

    Check the location and see if the DropboxExt64.19.0.dll is there:

    00007ffe82790000 00007ffe827e4000   DropboxExt64_19_0 T (no symbols)

    Loaded symbol image file: DropboxExt64.19.0.dll

    Image path*: C:\Program Files (x86)\Dropbox\Client**\DropboxExt64.19.0.dll*

    Image name: DropboxExt64.19.0.dll

    Browse all global symbols  functions  data

    Timestamp:        Mon Jan 22 06:13:16 2018 (5A65C74C)

    CheckSum:         00054D9B

    ImageSize:        00054000

    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

    Was this answer helpful?

    0 comments
  3. Anonymous
    2018-02-01T21:43:03+00:00

    And wait! I am listing what I can see from the crash dump below and it notes DropBox but I uninstalled it!!! How is this possible. I am really starting to dislike Windows 10 (and perhaps the Surface).

    *******************************************************************************

    *                                                                             *

    *                        Exception Analysis                                   *

    *                                                                             *

    *******************************************************************************

    TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\guids.ini, error 2

    *** WARNING: Unable to verify timestamp for sppc.dll

    *** ERROR: Module load completed but symbols could not be loaded for sppc.dll

    *** WARNING: Unable to verify timestamp for inputhost.dll

    *** WARNING: Unable to verify timestamp for DropboxExt64.19.0.dll

    *** ERROR: Module load completed but symbols could not be loaded for DropboxExt64.19.0.dll

    TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

    GetUrlPageData2 (WinHttp) failed: 12029.

    *** The OS name list needs to be updated! Unknown Windows version: 10.0 ***

    FAULTING_IP:

    Windows_UI_XamlHost!wil::details::ReportFailure+e5

    00007ffe`8bd61db1 cd29            int     29h

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)

    ExceptionAddress: 00007ffe8bd61db1 (Windows_UI_XamlHost!wil::details::ReportFailure+0x00000000000000e5)

       ExceptionCode: c0000409 (Stack buffer overflow)

      ExceptionFlags: 00000001

    NumberParameters: 1

       Parameter[0]: 0000000000000007

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application.  This  overrun could potentially allow a malicious user to gain control of this application.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application.  This  overrun could potentially allow a malicious user to gain control of this application.

    EXCEPTION_PARAMETER1:  0000000000000007

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    FAULTING_THREAD:  0000000000007b00

    BUGCHECK_STR:  APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_SEHOP

    PRIMARY_PROBLEM_CLASS:  STACK_BUFFER_OVERRUN_SEHOP

    DEFAULT_BUCKET_ID:  STACK_BUFFER_OVERRUN_SEHOP

    LAST_CONTROL_TRANSFER:  from 00007ffe8bd61e09 to 00007ffe8bd61db1

    STACK_TEXT: 

    000000007dc1e740 00007ffe8bd61e09 : 00001f9b8af0e253 0000000000000000 0000000000000000 00007ffe8bd69fd8 : Windows_UI_XamlHost!wil::details::ReportFailure+0xe5

    000000007dc1fc80 00007ffe8bd78d59 : 000000002aa7fea0 000000001e1d9310 0000003700000011 000000001e0f45b0 : Windows_UI_XamlHost!wil::details::ReportFailure_Hr+0x39

    000000007dc1fce0 00007ffe8bd728fb : 0000000000000000 000000001e1d8dd0 000000001e0c7f30 000000000000c000 : Windows_UI_XamlHost!wil::details::in1diag3::_FailFast_Hr+0x29

    000000007dc1fd30 00007ffe8bd7946c : 000000001e0f4000 0000000000000000 0000000000000000 0000000000000000 : Windows_UI_XamlHost!Microsoft::WRL::SimpleActivationFactory::ActivateInstance+0x34b

    000000007dc1fd60 00007ffe9728d544 : 0000000000000000 0000000000000001 0000000000000000 0000000000000000 : Windows_UI_XamlHost!ASTAThreadHost::s_ASTAThreadHostStartThreadProc+0x6c

    000000007dc1fd90 00007ffe97fe1fe4 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : SHCore!_WrapperThreadProc+0xc4

    000000007dc1fe70 00007ffe9817efb1 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : kernel32!BaseThreadInitThunk+0x14

    000000007dc1fea0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x21

    FOLLOWUP_IP:

    Windows_UI_XamlHost!wil::details::ReportFailure+e5

    00007ffe`8bd61db1 cd29            int     29h

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  Windows_UI_XamlHost!wil::details::ReportFailure+e5

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Windows_UI_XamlHost

    IMAGE_NAME:  Windows.UI.XamlHost.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  f27b8f

    STACK_COMMAND:  ~244s ; kb

    FAILURE_BUCKET_ID:  STACK_BUFFER_OVERRUN_SEHOP_c0000409_Windows.UI.XamlHost.dll!wil::details::ReportFailure

    BUCKET_ID:  X64_APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_SEHOP_MISSING_GSFRAME_Windows_UI_XamlHost!wil::details::ReportFailure+e5

    WATSON_STAGEONE_URL:  http://watson.microsoft.com/00001db1.htm?Retriage=1

    Followup: MachineOwner

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-02-01T21:36:40+00:00

    Sigh no dice. Another explorer crash. They seem to be more frequent now too. Here is the crash dump:

    https://1drv.ms/u/s!AoMjGh2ERllBaylgKp0\_uCiMPI8

    Let me note again that Edge is totally frozen after this happens: cannot close it, switch tabs, etc. I have to manually close Edge via Task Manager. So either this is due to Edge (which I think is the source of all of this) or the explorer crash is at least temporarily disabling Edge

    One other note:

    the timestamp on the crashdump is from when the surface was in sleep mode. I had thought this happened when I exit sleep mode but this happened during sleep mode itself.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2018-02-01T16:28:37+00:00

    Thanks auggy. I am going to start with DropBox and see if that helps. Interestingly it has been stealthily installing updates (I was rather sure I had turned that off, and I almost ever use the app). I do not think that is the source of my issues (the last update was on 23 Jan and my most recent explorer crashes were on 25 Jan and 29 Jan), but definitely not going to miss it for now.

    Was this answer helpful?

    0 comments