After I installed the Fall Creators Update my Explorer.exe
will not start, hence I get the "black screen of death with mouse cursor" problem.
I am able to start Task Manager (by pressing Ctrl+Shift+Esc), and start programs from it. Explorer.exe
is missing from Task Manager. So when I try to start it, it crashes after a short while. Also Control Panel is crashing.
I am able to open Device Manager, but I don't really think this has anything to do with HW.
Starting the Event Viewer from the Task Manager (File > Run new task > eventvwr
) I can see some failures in the Event Log:
Log Name: Application
Source: Windows Error Reporting
Date: 26.10.2017 10.18.44
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: DESKTOP-QP1FPFL
Description:
Fault bucket 120861076035, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: explorer.exe
P2: 10.0.16299.15
P3: 66e02565
P4: CoreMessaging.dll
P5: 10.0.15063.502
P6: e1f2364b
P7: c0000602
P8: 0000000000068506
P9:
P10:
Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD11C.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D9.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1E8.tmp.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_90a3ade54355fd46ebc1543e438fdd5fa6dd8c0_e2eb9052_2048d679
Analysis symbol:
Rechecking for solution: 0
Report Id: 94cd5e58-7e3e-44fe-8dd7-18d988772983
Report Status: 268435456
Hashed bucket: 2bc4e6d801925b9d642ad3f0dd40015c
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-10-26T08:18:44.967344400Z" />
<EventRecordID>3276</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-QP1FPFL</Computer>
<Security />
</System>
<EventData>
<Data>120861076035</Data>
<Data>4</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>explorer.exe</Data>
<Data>10.0.16299.15</Data>
<Data>66e02565</Data>
<Data>CoreMessaging.dll</Data>
<Data>10.0.15063.502</Data>
<Data>e1f2364b</Data>
<Data>c0000602</Data>
<Data>0000000000068506</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD11C.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D9.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1E8.tmp.txt</Data>
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_90a3ade54355fd46ebc1543e438fdd5fa6dd8c0_e2eb9052_2048d679</Data>
<Data>
</Data>
<Data>0</Data>
<Data>94cd5e58-7e3e-44fe-8dd7-18d988772983</Data>
<Data>268435456</Data>
<Data>2bc4e6d801925b9d642ad3f0dd40015c</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 26.10.2017 10.18.43
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: DESKTOP-QP1FPFL
Description:
Faulting application name: explorer.exe, version: 10.0.16299.15, time stamp: 0x66e02565
Faulting module name: CoreMessaging.dll, version: 10.0.15063.502, time stamp: 0xe1f2364b
Exception code: 0xc0000602
Fault offset: 0x0000000000068506
Faulting process id: 0x1c18
Faulting application start time: 0x01d34e330813f394
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\CoreMessaging.dll
Report Id: 94cd5e58-7e3e-44fe-8dd7-18d988772983
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-10-26T08:18:43.467347000Z" />
<EventRecordID>3275</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-QP1FPFL</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>10.0.16299.15</Data>
<Data>66e02565</Data>
<Data>CoreMessaging.dll</Data>
<Data>10.0.15063.502</Data>
<Data>e1f2364b</Data>
<Data>c0000602</Data>
<Data>0000000000068506</Data>
<Data>1c18</Data>
<Data>01d34e330813f394</Data>
<Data>C:\WINDOWS\explorer.exe</Data>
<Data>C:\WINDOWS\CoreMessaging.dll</Data>
<Data>94cd5e58-7e3e-44fe-8dd7-18d988772983</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
It looks like it's the CoreMessaging.dll
component is the culprit.
So far I have tried the following:
- Verified that in the registry,
explorer.exe
is run without any parameters, by using theREG QUERY
command line tool. - Disabled the AppReadiness service.
- Ran
chkdsk
to check the disk, which was fine. - Ran
sfc /scannow
which said no problems found.
I guess I could roll back to some previous version of Windows, but I don't really want to do that. It doesn't seem to be a permanent solution.
The "Attached files" from the event log seem to be non-existent btw.
This question is not the same as Windows Explorer is crashing when I access USB drive, although they both involve Windows Explorer crashing, since this happened in a different context (that of upgrading to a new edition of Windows 10). The other question has a very good reply though, which may be used for debugging, which shows how to generate dump files.
This could also be relevant, since I am using Check Point VPN: Failed to update to Windows 10 Fall Creators Update (version 1709) from ver 1703
How can I fix this problem?