Re: Explorer.exe Crashes - The memory could not be written - Update! Still Need Help!

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 12/27/03 

Date: Sat, 27 Dec 2003 08:00:27 -0700

Given all the applications listed that are know to hook in at
a relatively low level there is certainly room for a conflict.

What you did not say is whether the information you are getting
when this happens is or is not consistently indicating the same
load module. Does the address always point into the same piece
of software ? If so, that is your culprit or it may be that it is not the
root cause (gets handed bad info from its predecessor in the then
current run sequence) but ones just before it in execution order are
to be suspected.

While you are not getting a dump, but rather only Explorer is
being killed and userinit (within Winlogon process) is catching
this and restarting Explorer for you, the info in the following
KB of pstat will be of use in finding what software is at fault,
assuming the address provided is not random.
http://support.microsoft.com/?id=314084

If you find that one time it indicates one and another time a
different software, then suspect hardware, such as memory.

(PS: Have you tried running with cacheman uninstalled ?) 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"John Corson" <john@corson.org> wrote in message
news:Zu7Hb.28063$F22.20460@lakeread02...
> From my research the following problem is experienced by a vast number of
> people and the only common denominator is the use of WinXP SP1 and
possibly
> a number of patches however, I have utilized system restore to the point
of
> ten days before I noticed the problem begin.
>
> At random times when trying to open a folder (directory), I receive the
> following popup: "Application Error:  The instruction at "0x77f57ec4"
> referenced memory at "0x00000067". The memory could not be "written".  A
> similar popup appears reading: "Application Error: The exception unknown
> software exception (0xc015000f) occurred in the application at location
> 0x77f6fca7."
>
> When going to the event properties in the Administrative Tools, I see
under
> application events that the following notation appears: "The shell stopped
> unexpectedly and explorer.exe was restarted."  It is a winlogon event with
> event number 1002.
>
> When this error occurs I have to click as many as three popup notices.
> Following that, all icons on the desktop disappear for a few seconds, the
> screen is refreshed, icons re-appear and most applications running in the
> background (anti-virus, etc) do not appear in the toolbar until logging
off
> and back on.
>
> I am suspecting one major area that I haven't tried -- Changing out
memory.
> Six weeks before I started having this issue I upgraded to ABIT KD-7 RAID
> m/b with Athlon XP2700+ CPU; 2048 mb DDR PC2700 ECC non buffered RAM.
Would
> adding an extra wait from the cycle between memory and CPU help?  I.e
using
> Registered ECC RAM?  Before I go to the added EXPENSE of getting
registered
> RAM I would like to have confirmation.
>
> Other things I have done to try to correct the issue:
> 1) Running sfc/scannow to restore original .dll's, etc.
> 2) Re-installed SP1 (to restore possible corrupt explorer.exe file)
> 3) Flashed BIOS
> 4) Dropped down to 1024 mb and checked each memory module;
> 5) Tried various RAM settings withn the BIOS; and enabled Shadowing and
> Caching;
> 6) Gone back to several system restore points (even before the last four
> critical updates from Microsoft);
> 7) Uninstalled the various pieces of software that I added since the time
> this issue started to occur;
> 8) Tested RAM with both MEMtest86 and Windows Memory Diagnostic;
> 9) SiSoft Sandra 2003 indicates no warnings or applicable suggestions for
> changes or modifications;
> 10) Swapped out CPU's (one Athlon XP-2700+ with another of the same
specs);
> and
> 11) Checked the system board temperature (averaging 35 to 38 degrees C)
and
> CPU (averaging between 36 and 39 degrees C)
> _____
>
> Only one hardware update since this issue started and that is going from a
> 2mb cache harddrive to an 8 -- same disc size, RPM, ATA-133, etc.  Old
drive
> was imaged over to the new.
> _____
> For those techies needing a rundown of programs running when the crash
> occurs let's just say it varies, but here is a list of those running at
> start up:
>
> System Idle Process
> System
> smss.exe            \SystemRoot\System32\smss.exe
> csrss.exe
> winlogon.exe        winlogon.exe
> services.exe        C:\WINDOWS\system32\services.exe
> lsass.exe           C:\WINDOWS\system32\lsass.exe
> svchost.exe         C:\WINDOWS\system32\svchost -k rpcss
> svchost.exe         C:\WINDOWS\System32\svchost.exe -k netsvcs
> svchost.exe
> svchost.exe
> spoolsv.exe         C:\WINDOWS\system32\spoolsv.exe
> CCEVTMGR.EXE        "C:\Program Files\Common Files\Symantec
> Shared\ccEvtMgr.exe"
> CTSVCCDA.EXE        C:\WINDOWS\System32\CTsvcCDA.exe
> DKService.exe       "C:\Program Files\Executive
> Software\DiskeeperWorkstation\DKService.exe"
> inetinfo.exe        C:\WINDOWS\System32\inetsrv\inetinfo.exe
> "C:\PROGRA~1\Iomega\System32\ActivityDisk.exe"
> mdm.exe             "C:\Program Files\Common Files\Microsoft
> Shared\VS7Debug\mdm.exe"
> NAVAPSVC.EXE        "C:\Program Files\Norton SystemWorks\Norton
> AntiVirus\navapsvc.exe"
> PDSched.exe         "C:\Program Files\Raxco\PerfectDisk\PDSched.exe"
> NOPDB.EXE           C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
> svchost.exe         C:\WINDOWS\System32\svchost.exe -k imgsvc
> ups.exe             C:\WINDOWS\System32\ups.exe
> vsmon.exe           C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service
> MsPMSPSv.exe        C:\WINDOWS\System32\MsPMSPSv.exe
> explorer.exe        C:\WINDOWS\Explorer.EXE
> iTouch.exe          "C:\Program Files\Logitech\iTouch\iTouch.exe"
> Imgicon.exe         "C:\Program Files\Iomega\DriveIcons\ImgIcon.exe"
> ccApp.exe           "C:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
> zlclient.exe        "C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe"
> ctfmon.exe          "C:\WINDOWS\System32\ctfmon.exe"
> EM_EXEC.EXE         "C:\Program
Files\Logitech\MouseWare\system\em_exec.exe"
> AD2KClient.exe      "C:\Program Files\Iomega\AutoDisk\AD2KClient.exe"
> SecCopy.exe         "C:\Program Files\SecCopy\SecCopy.exe"
> rundll32.exe        C:\WINDOWS\System32\rundll32.exe
> C:\PROGRA~1\ATIMUL~1\RemCtrl\x10net.dll,EntryPoint -Embedding
> WCESCOMM.EXE        "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
> Cacheman.exe        "C:\PROGRA~1\Cacheman\Cacheman.exe"
> msmsgs.exe          "C:\Program Files\Messenger\msmsgs.exe" -Embedding
> ____
>
> If you notice something is this missive that may sound an alarm to you,
then
> please let me know.  I have published this to various help groups like
> Extreme Tech, Annoyances.org, WinXPNews.com, Computing.net and Hardware
> Analysis.com (also the Abit and AMD support grounps too)!  Others are
having
> this or a similair issue and I would like to get all our heads together in
> nip this thing once and for all!
>
> ---John Corson---
>
>

Relevant Pages

  • Re: Slow to open files
    ... If you already have 1GB of RAM, ... applications, ... If you are currently using the page file significantly, more memory ... "Mike" wrote: ...
    (microsoft.public.windowsxp.general)
  • Explorer.exe Crashes - The memory could not be written - Update! Still Need Help!
    ... people and the only common denominator is the use of WinXP SP1 and possibly ... The memory could not be "written". ... Registered ECC RAM? ... Gone back to several system restore points (even before the last four ...
    (microsoft.public.windowsxp.security_admin)
  • memory management bug
    ... although I still have plenty of RAM ... of memory management (i.e: "unsuficient memory to ... >I usually open a lot of applications simultaneously ... Tool, many "IEXPLORE windows" opened, Paint Shop Pro 8, ...
    (microsoft.public.windowsxp.general)
  • Re: Can I remove some pgms @ startup?
    ... applications don't use RAM, please disregard that part. ... *All* applications use memory, and unless that memory hasn't been ... recently used it's RAM. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Slow to open files
    ... great deal of audio file work I get the re size page file warning. ... applications, it's *highly* uinlikely that any more RAM ... not using the page file significantly, more memory will do nothing for you. ...
    (microsoft.public.windowsxp.general)