Windows Update KB4579311 causing explorer to crash repeatedly when logging in.

Anonymous

Hi, I've been having an issue with Windows Update KB4579311. When it gets installed it causes the Explorer to crash repeatedly until it eventually logs me in, at which point I can use it as normal. BUT, the crashing increases time it takes to log in and load everything up. It's very annoying.

What I mean by crash is that the start bar flickers on and off, over and over and over. The desktop is black the mouse curser is visible. when you press ctrl alt del that screen stops flickering, when you return back to the desktop, flicker ahoy! you can see in the task manager that the explorer is stopping and starting over and over. You cant manually end the process becuase it's starting and stopping so fast that by the time you click the end process button it's already restarted and the instance of the explorer you tried to end no longer exists.

Uninstalling KB4579311 stops the issue but when it installs it's self again the issue returns.

I'm getting tired of repeating the same steps over and over to use my computer as intended.

This is shown in the event viewer:

Faulting application name: explorer.exe, version: 10.0.19041.546, time stamp: 0x89ce2e55

Faulting module name: ucrtbase.dll, version: 10.0.19041.546, time stamp: 0x43cbc11d

Exception code: 0xc0000409

Fault offset: 0x000000000007287e

Faulting process ID: 0x21e8

Faulting application start time: 0x01d6a45d9c54ed23

Faulting application path: C:\Windows\explorer.exe

Faulting module path: C:\Windows\System32\ucrtbase.dll

Report ID: 0fa45953-9e3f-4a5f-bafc-ee4c5229c9ca

Faulting package full name:

Faulting package-relative application ID:

What I'm looking for is a fix. Not a workaround.

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

76 answers

Anonymous

2020-12-11T17:52:40+00:00
I have the same crashes. The patch that is causing it is another one by now. I found out, that I could prevent the crashes by disabling the Microsoft Storageservice during startup. However the Storageservice is needed by Windows for Microsoft Storeapps (xBox Game Pass) and Windows Updates. So permanently disabling it is not a good idea.

Here is my current workaround:
1. Create a Windows Task that is triggered by user login:
Program to start: Powershell.exe

Arguments:

-command "Set-Service -Name 'StorSvc' -StartupType Manual"

Execute with highest privileges (aka as Admin)
1. Create a Shortcut on your desktop:
The target program is:

powershell.exe -command "Set-Service -Name 'StorSvc' -StartupType Disabled ; Stop-Computer"

(one line)

Name it like "Shutdown" coz that is what it will do.

Once you created the shortcut open it's properties and make it be executed "as Admin"

What this will do: You click the shortcut. It will disable the Storageservice (StorSvc) and shutdown your computer.

When you start the computer it will enable the StorSvc.

If you don't understand my instruction then it's not for you. It's for ppl that are at least a little tech savvy. I don't belong to Microsoft in anyway and what I wrote could download a virus right?

I'm just an annoyed user...
Was this answer helpful?

4 people found this answer helpful.

0 comments No comments

Anonymous

Since I was on an Education version I had delayed updating to 2004 until recently, but ever since I had, I've been experiencing this same issue.

I reviewed my update history and found that KB4579311 had been installed, but it did not appear on the Windows Updates. The 2020-11 Cumulative Update (either KB4586781 or KB4594440, in my case it was the former which was installed on my system) showed as installed and I used wusa to uninstall.

After reboot, KB4579311 now appeared, but I'm unable to remove it from the system, even tried to use DISM to remove it, but what unable to identify a package that matched the description. For now I have disabled the Storage Service and will see if that helps.

If you are also having this issue, please add your feedback to the following problem on Feedback Hub: https://aka.ms/AAaipuw

Explorer.exe minidump pasted below.


    Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\skeve\AppData\Local\CrashDumps\explorer.exe.1548.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Version 19041 MP (12 procs) Free x64
    Product: WinNt, suite: SingleUserTS
    Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
    Machine Name:
    Debug session time: Sun Dec  6 21:28:50.000 2020 (UTC - 5:00)
    System Uptime: 0 days 0:03:19.861
    Process Uptime: 0 days 0:00:01.000
    ................................................................
    ...................................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (60c.29e8): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
    Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 
    For analysis of this file, run !analyze -v
    ucrtbase!abort+0x4e:
    00007ff8`5aca287e cd29            int     29h
    0:021> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.mSec
        Value: 905
    
        Key  : Analysis.DebugAnalysisProvider.CPP
        Value: Create: 8007007e on GAMERIG
    
        Key  : Analysis.DebugData
        Value: CreateObject
    
        Key  : Analysis.DebugModel
        Value: CreateObject
    
        Key  : Analysis.Elapsed.mSec
        Value: 897
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 333
    
        Key  : Analysis.System
        Value: CreateObject
    
        Key  : Timeline.OS.Boot.DeltaSec
        Value: 199
    
        Key  : Timeline.Process.Start.DeltaSec
        Value: 1
    
        Key  : WER.OS.Branch
        Value: vb_release
    
        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z
    
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    
        Key  : WER.Process.Version
        Value: 10.0.19041.610

    ADDITIONAL_XML: 1
    
    OS_BUILD_LAYERS: 1
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    CONTEXT:  (.ecxr)
    rax=0000000000000001 rbx=000000000551dba0 rcx=0000000000000007
    rdx=000000000000000f rsi=000000000551d210 rdi=0000000000000000
    rip=00007ff85aca287e rsp=000000000551c8e0 rbp=000000000551ca40
     r8=0000000000000001  r9=000000000551c888 r10=0000000000000012
    r11=0088000002002080 r12=0000000000000001 r13=00007ff84f6b6500
    r14=000000000551cbf0 r15=000000000551ca30
    iopl=0         nv up ei pl nz na pe nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    ucrtbase!abort+0x4e:
    00007ff8`5aca287e cd29            int     29h
    Resetting default scope
    
    EXCEPTION_RECORD:  (.exr -1)
    ExceptionAddress: 00007ff85aca287e (ucrtbase!abort+0x000000000000004e)
       ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
      ExceptionFlags: 00000001
    NumberParameters: 1
       Parameter[0]: 0000000000000007
    Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 
    
    PROCESS_NAME:  explorer.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
    
    EXCEPTION_CODE_STR:  c0000409
    
    EXCEPTION_PARAMETER1:  0000000000000007
    
    STACK_TEXT:  
    00000000`0551c8e0 00007ff8`5aca1faf     : 00000000`00000003 00000000`00000003 00000000`0551d3d0 00000000`0551cbf0 : ucrtbase!abort+0x4e
    00000000`0551c910 00007ff8`5ac6e5d6     : 00000000`0551dba0 00000000`0551ca40 00000000`0551d210 00000000`00000000 : ucrtbase!terminate+0x1f
    00000000`0551c940 00007ff8`5ac6f254     : 00000000`00000000 00007ff8`5b0883cb 00000000`00000001 00000000`0551dba0 : ucrtbase!FindHandler<__FrameHandler4>+0x50a
    00000000`0551cb10 00007ff8`5ac6d0c0     : 00007ff8`4f660000 00000000`0551dba0 00000000`0551d3d0 00000000`0551d210 : ucrtbase!__InternalCxxFrameHandler<__FrameHandler4>+0x278
    00000000`0551cbb0 00007ff8`26d03f34     : 00000000`0551f2f0 00007ff8`271a1b68 00000000`0551dba0 00000000`0551f2f0 : ucrtbase!_CxxFrameHandler4+0xa0
    00000000`0551cc20 00007ff8`5d4310ff     : 00000000`00000000 00000000`0551d1c0 00000000`0551dba0 00000000`00000001 : twinui_pcshell!_GSHandlerCheck_EH4+0x64
    00000000`0551cc50 00007ff8`5d3db474     : 00000000`0551dba0 00000000`00000001 00000000`00000000 00000000`0551ccc0 : ntdll!RtlpExecuteHandlerForException+0xf
    00000000`0551cc80 00007ff8`5d3db1c5     : 80000000`00000007 00000000`0551da40 00000000`00000000 00007ff8`5d3db131 : ntdll!RtlDispatchException+0x244
    00000000`0551d390 00007ff8`5b063e49     : 00000000`05c3cee8 00007ff8`4f6b6638 00000000`030bc148 00007ff8`4f6669e8 : ntdll!RtlRaiseException+0x185
    00000000`0551db80 00007ff8`5ac6d18d     : 00000000`05c3d8b0 00007ff8`4f6b6638 ffffffff`fffffffe 00000000`05bb3820 : KERNELBASE!RaiseException+0x69
    00000000`0551dc60 00007ff8`26f08eee     : 00007ff8`4f660000 00000000`0551dd80 00000000`05bfff01 00000000`05c3d8b0 : ucrtbase!CxxThrowException+0xad
    00000000`0551dcd0 00007ff8`26d41d10     : 00000000`05c3d8b0 00000000`00000000 00000000`05bf1cd0 00000000`05c3d8b0 : twinui_pcshell!wil::details::ThrowPlatformException+0x4e
    00000000`0551dd00 00007ff8`26ca25b0     : 00000000`00000000 00000000`00000000 00000000`00000001 00005528`fcc84820 : twinui_pcshell!wil::details::ReportFailure+0x9f754
    00000000`0551f240 00007ff8`26d5599e     : 00007ff8`27140e10 00000000`05bfff98 00000000`030bc148 00000000`05bffee0 : twinui_pcshell!wil::details::ReportFailure_Hr+0x44
    00000000`0551f2a0 00007ff8`26ef59dd     : 00000000`05bffee0 00000000`05bffee0 00000000`030bc148 00007f00`00000000 : twinui_pcshell!wil::details::in1diag3::Throw_Hr+0x26
    00000000`0551f2f0 00007ff8`26ecc378     : 00000000`0551f3e0 00007ff8`26cca32b 00000000`0551f3e0 00000000`030bc148 : twinui_pcshell!WindowManagerBridge::RuntimeClassInitialize+0x175
    00000000`0551f370 00007ff8`26ed5437     : 00000000`030bc010 00000000`0551f448 00000000`0551f448 00000000`0551f448 : twinui_pcshell!Microsoft::WRL::Details::MakeAndInitialize<WindowManagerBridge,IWindowManagerBridge,WindowEventDispatcher * __ptr64>+0x5c
    00000000`0551f3a0 00007ff8`26ecc28d     : 00000000`030bc010 00007ff8`26d51140 00007ff8`271c9908 00007ff8`2713fd88 : twinui_pcshell!WindowEventDispatcher::RuntimeClassInitialize+0x16b
    00000000`0551f3e0 00007ff8`26ed1bb5     : 00000000`00000000 00007fff`feeecfc8 00000000`0551f550 00007ff8`27104010 : twinui_pcshell!Microsoft::WRL::Details::MakeAndInitialize<WindowEventDispatcher,IUnknown>+0x49
    00000000`0551f410 00007ff8`26d529e7     : 00000000`00000000 00000000`00000000 00000000`0551f550 00000000`02f0ba60 : twinui_pcshell!Microsoft::WRL::SimpleClassFactory<WindowEventDispatcher,0>::CreateInstance+0x45
    00000000`0551f440 00007ff8`26e2f302     : 00000000`05c0b3b0 00007fff`feeecfc8 00007ff8`271d4320 00000000`00000004 : twinui_pcshell!ImmersiveShellComponentCreator::CreateComponent+0x77
    00000000`0551f490 00007ff8`26e2f1e7     : 00000000`00000000 00000000`05bb3800 00000000`0551f550 00000000`00000008 : twinui_pcshell!CImmersiveShellCreationBehavior::CreateComponentWithSxs+0xb2
    00000000`0551f4d0 00007fff`fee6a4e2     : 00000000`02f0ba60 00000000`0551f5d9 00000000`00000008 00000000`00000000 : twinui_pcshell!CImmersiveShellCreationBehavior::CreateComponent+0x87
    00000000`0551f510 00007fff`fee6c6d3     : 00000000`02f0d1a8 00000000`02f0ba60 00000000`02f0ba60 00000000`02f0ba58 : windows_immersiveshell_serviceprovider!CImmersiveShellController::CreateComponents+0x1a2
    00000000`0551f640 00007fff`fee6f423     : 00000000`02f0ba01 00000000`00000000 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveShellController::ComponentsThreadProc+0x17b
    00000000`0551f6d0 00007fff`fee6f482     : 00000000`02f0ba00 00000000`00000000 00007fff`fee60000 00000000`00000000 : windows_immersiveshell_serviceprovider!<lambda_c7cc3815f5835f6576e01d1e973b846e>::operator()+0x83
    00000000`0551f730 00007ff8`5c8d7034     : 00000000`02f0ba00 00000000`0551f770 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!<lambda_83b4adb8b1f66e82d5773e4fa18ceb2a>::<lambda_invoker_cdecl>+0x42
    00000000`0551f770 00007ff8`5d3dcec1     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
    00000000`0551f7a0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21

    SYMBOL_NAME:  ucrtbase!abort+4e
    
    MODULE_NAME: ucrtbase
    
    IMAGE_NAME:  ucrtbase.dll
    
    STACK_COMMAND:  ~21s ; .ecxr ; kb
    
    FAILURE_BUCKET_ID:  FAIL_FAST_FATAL_APP_EXIT_c0000409_ucrtbase.dll!abort
    
    OS_VERSION:  10.0.19041.1
    
    BUILDLAB_STR:  vb_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    IMAGE_VERSION:  10.0.19041.546
    
    FAILURE_ID_HASH:  {e31753ac-c98a-8055-3663-47e707543d20}
    
    Followup:     MachineOwner
    ---------

0 comments

Anonymous

2020-11-19T19:11:58+00:00

I am having a similar problem as OP. I'd say it was the same, but I am unsure which KB is causing it. I have tried deleting WebCache, and that did not fix it. Safe Mode works though. I have had to System Restore before the most recent round of updates, and along with pausing updates, this fixes the issue. I'm on 2004.

Each week I try to install the updates again to see if there's a fix. Yesterday (the 18th) I tried this and still had to system restore to fix it. Again, keeping updates paused until this issue is fixed.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Anonymous

2020-11-17T03:20:45+00:00

I turned updates back on and installed KB458678 but the same problem occurred as with KB4579311. I had to once again uninstall the update to remedy the problem. Perhaps I should try KB4586864? I'm honestly just getting sick of having to do this process so unless Microsoft gives us a definitive fix then I'll probably just leave updates paused for the foreseeable future until I feel like rolling the dice and trying these updates again.
Was this answer helpful?

2 people found this answer helpful.

0 comments No comments
Anonymous

2020-11-16T16:24:19+00:00

Any update on this issue? Keeping this thread alive while waiting for a fix. Regards

I had a similar problem as everyone else with Window update KB4579311. Having exporer.exe crash a couple minutes after boot where I couldn't do anything on the start menu and file explorer would not load. I was able to uninstall the update and I paused updates and that stopped the issue.

Once patch Tuesday came around a couple days ago, I resumed updates. I let it install and it looks like KB4586781 and KB4586864 installed. The updates installed just fine and the exporer.exe crashing issue does not happen anymore at all for me. For me at least, the issue is resolved.
Was this answer helpful?

0 comments No comments