0
Windows 10's explorer is crashing on: Right-Click file > Send To > Mail Recipient
Here's the application error:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-10-04T11:40:02.739012900Z" />
<EventRecordID>3694</EventRecordID>
<Channel>Application</Channel>
<Computer>pc777.lucky7.local</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>10.0.15063.608</Data>
<Data>b00723ab</Data>
<Data>ntdll.dll</Data>
<Data>10.0.15063.608</Data>
<Data>8274fd8b</Data>
<Data>c0000409</Data>
<Data>000000000009626f</Data>
<Data>1404</Data>
<Data>01d33d0542be8faf</Data>
<Data>C:\WINDOWS\explorer.exe</Data>
<Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data>
<Data>a071ec0e-a54b-4141-814b-82b016c07833</Data>
<Data />
<Data />
</EventData>
</Event>
A crash dump can be downloaded here.
.....................
Loading unloaded module list
...................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(af0.2574): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29 int 29h
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
0:004> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for JitV.dll -
*** WARNING: Unable to verify timestamp for sppc.dll
*** ERROR: Module load completed but symbols could not be loaded for sppc.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MSMAPI32.DLL -
*** WARNING: Unable to verify timestamp for mapi32.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C2R64.dll -
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000000a
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffed7aa626f rsp=00000000031feab8 rbp=00000000031febf0
r8=00000000031ff200 r9=00000000031febb0 r10=00007ffed7b4f534
r11=00007ffed7a10000 r12=00007ffed7a10000 r13=00007ffed7aa632e
r14=00000000031ff7b8 r15=00000000031ff6f0
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrpICallHandler+0xf:
00007ffe`d7aa626f cd29 int 29h
Resetting default scope
FAULTING_IP:
ntdll!LdrpICallHandler+f
00007ffe`d7aa626f cd29 int 29h
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffed7aa626f (ntdll!LdrpICallHandler+0x000000000000000f)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000000a
Subcode: 0xa FAST_FAIL_GUARD_ICALL_CHECK_FAILURE
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000000a
WATSON_BKT_PROCSTAMP: b00723ab
WATSON_BKT_PROCVER: 10.0.15063.608
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: ntdll.dll
WATSON_BKT_MODSTAMP: 8274fd8b
WATSON_BKT_MODOFFSET: 9626f
WATSON_BKT_MODVER: 10.0.15063.608
MODULE_VER_PRODUCT: Microsoft® Windows® Operating System
BUILD_VERSION_STRING: 10.0.15063.246 (WinBuild.160101.0800)
MODLIST_WITH_TSCHKSUM_HASH: 1c63e1053be840a2d95fe7e35ee4cac3ecf6c9ed
MODLIST_SHA1_HASH: 5794374a82ea9aa65833b12c5743a8b6d471d369
NTGLOBALFLAG: 0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
DUMP_FLAGS: 94
DUMP_TYPE: 1
Things to note:
- On this workstation, both Windows 10 and Office 2016 are fully updated.
- It does this not matter what the Default Application for Email is (Mail, Outlook, and Thunderbird, have been set as default during testing --still crashes).
- The "Mail Recipient.MAPIMail" file on this workstation is identical to "Mail Recipient.MAPIMail" files on other workstations where this feature is working correctly.
- The registry at "Computer\HKEY_CLASSES_ROOT\mailto\shell\open\command" on this workstation is identical to other workstations where this feature is working.
- Each day, additional users are reporting this same issue. It seems like Windows 10 Auto-Updates are breaking this feature one workstation at a time as the auto-updates are getting auto-applied. It seems like the users who never reboot their computer are the ones not experiencing this issue (YET).
Things I've tried:
Background:
A couple of months ago I upgraded one of my user's Windows 10 workstation from Office 2010 Home and Business 32bit to Office Home and Business 2016 64bit. This Mail Recipient feature worked for a long while, then it started crashing Explorer around Thursday of last week.
Expected Behavior:
This user mails a lot of file attachments from Windows File Explorer, by:
- Right-Clicking on one or more files she has highlighted in Internet Explorer.
- Then goes to the sub-menu "Send To" and then clicks "Mail Recipient"
After this, she expect these things to happen:
- Outlook 2016 should compose a new email The new email will have all the attachments attached (that she highlighted earlier).
- The subject line of the new email should contain the list of file attachments that are attached to the email.
I appreciate any additional suggestions not included in the links above.
1
debug the crash by creating a dump file of explorer and analyzing it with windbg.exe
– magicandre1981 – 2017-10-03T06:25:35.503your edit is useless. generate a dump and analyze it. if you need help, share the zipped dmp – magicandre1981 – 2017-10-04T15:23:00.873
The dump is now included; please remove duplication status. – LonnieBest – 2017-10-06T00:52:23.397
1it is still a duplicate. you removed the important stack data. here you can see that the JitV.dll from office 2016 (C:\Program Files\Microsoft Office\root\Office16\JitV.dll) causes the crash. This means you run the the CLick & Run version of office. if possible use the normal installer based and not this app-v based version. if this is not possible contact Microsoft support. – magicandre1981 – 2017-10-06T15:07:57.420