Case of the Windows 8 Explorer Hang – Part 1

Boarded the train and tried to connect to Wi-Fi, no luck, explorer mostly working but not the wi-fi button – I was teased networks are available  but clicking the little wireless icon nothing happened. Even if I clicked clicked clicked hundreds of times.

image

Now I could have connected to wi-fi via netsh command but though I’d take a quick look into what might cause this…

Launching Control Panel also resulted in a “blank” screen. Start Screen operation seemed fine.

In Task Manager, I expanded to advanced view and selected Details tab, then right clicked explorer.exe and chose Analyse Wait Chain

image

Analyse wait change revealed pages of data…

image

image

image

image

image

image

image

image

All of these were blocked by svchost.exe with process ID of 976 and thread 7348.

image

And we found:

image

I then resorted to Process Explorer (http://live.sysinternals.com/procexp.exe)  and selected Explorer.exe and chose Properties

image

Looking at the stack I notice netprofm

image

To then I did the save for svchost.exe and process ID 976 … and what do we have  in this list…none other then netprofm we saw earlier. We could also use this to translate the Thread ID we found into the service.

Note: IF this is not showing any details make sure you have symbols configured (http://support.microsoft.com/kb/311503), and you run ProcExp as admin (File -> Show Details for All Processes)

image

This matches up with our Network List Service

image

However I couldn’t stop the service.

image

 

image

I killed off Explorer

image

Then service immediately stopped. I restarted Explorer through File -> Run New Task -> Explorer

The Explorer hang was gone, and wi-fi could finally be connected!

image

Oh and now analyse wait chain on explorer.exe it looks happy:

image

If I see this re-occur frequently I might investigate further as to why netprofm is hanging up explorer…let me know if you see this issue yourself.

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in ProcExp, Windows 8 and tagged , , , , , , . Bookmark the permalink.

7 Responses to Case of the Windows 8 Explorer Hang – Part 1

  1. This shows why I hate Windows some times. I came to this post because this is absolutely killing me. I have set up dozens of computers and each time I set up an additional standard user after I’ve installed and set up the system, installed all applications as the pseudo-admin user that Windows Setup creates, if I log in as the normal user and want to perform any task that needs elevation, right after you enter the admin password that Windows prompts you for, the process hangs. PITA! Piece’o’sh!t!

  2. Tomasz says:

    Hi,
    “Looking at the stack I notice netprofm”
    how did You know that cause it was the netprofm ?
    – I have a problem with certainly explorer.exe (desktop) that hang in any mouse click – after login) I have only black screen with movable mouse pointer.

    Regards.

  3. Tomasz says:

    Please, help me – i struggle with that from 4 months

  4. Tomasz says:

    Hi, am trying resolve my problem of explorer.exe. I try to repair it but i don’t know which file/thread choose to repair. Can You help me with my problem ?

    Here is what I copied from windowses:

    Analyse Wait Chain
    —————————————————————————————————————————
    explorer.exe (PID: 332) W¹tek: 340    0x0000014C    0x00000074D53F5A30    0x00000000    0    
       explorer.exe (PID: 332) W¹tek: 328    0x0000014C    0x00000074D53F5370    0x00000074D53F5A30    1    
    explorer.exe (PID: 332) W¹tek: 1072    0x0000014C    0x00000074D53F5B50    0x00000000    0    
       svchost.exe (PID: 676) W¹tek: –    0x000002A4    0x00000074D53F5C10    0x00000074D53F5B50    1    
          explorer.exe (PID: 332) W¹tek: –    0x0000014C    0x00000074D53F5910    0x00000074D53F5C10    2    
     
    Threads
    —————————————————————————————————————————
    244    19.13    1 831 912 244    ntdll.dll!RtlFreeUnicodeString+0x1370    
    328    18.71    1 791 988 156    Explorer.EXE+0x50cf0    
    1280    17.79    1 703 820 564    SHELL32.dll!SHCreateShellItemArrayFromIDLists+0x880    
    616    < 0.01    15 140    twinui.appcore.dll+0x637e0    
    1328            ntdll.dll!RtlFreeUnicodeString+0x1370    
    408            windows.immersiveshell.serviceprovider.dll!DllCanUnloadNow+0x4500    
    1028            SHCORE.dll!SHReleaseThreadRef+0x90    
    340            SHCORE.dll!SHReleaseThreadRef+0x90    
    656            ntdll.dll!RtlFreeUnicodeString+0x1370    
    396            ntdll.dll!RtlFreeUnicodeString+0x1370    
    1164            SHCORE.dll!SHReleaseThreadRef+0x90    
    392            msvcrt.dll!endthreadex+0x40    
    468            SHCORE.dll!SHReleaseThreadRef+0x90    
    560            Explorer.EXE+0x4ea70    
    612            sppc.dll!SLpVLActivateProduct+0x1444    
    660            SHCORE.dll!SHReleaseThreadRef+0x90    
    992            DUI70.dll!DirectUI::TouchSelect::OnHosted+0x260    
    884            ntdll.dll!RtlFreeUnicodeString+0x1370    
    880            UxTheme.dll!DllGetClassObject+0x4d20    
    976            wlidprov.dll!DllGetClassObject+0x750    
    1032            wlidprov.dll!DllGetClassObject+0x750    
    1064            SHCORE.dll!SHReleaseThreadRef+0x90    
    1068            SHCORE.dll!SHReleaseThreadRef+0x90    
    1072            ntdll.dll!RtlFreeUnicodeString+0x1370    
    1092            wlidprov.dll!DllGetClassObject+0x750    
    1096            SHCORE.dll!SHReleaseThreadRef+0x90    
    1100            SHCORE.dll!SHReleaseThreadRef+0x90    
    1104            SHCORE.dll!SHReleaseThreadRef+0x90    
    1108            SHCORE.dll!SHReleaseThreadRef+0x90    
    1148            SHCORE.dll!SHReleaseThreadRef+0x90    
    1152            SHCORE.dll!SHReleaseThreadRef+0x90    
    1196            ntdll.dll!RtlFreeUnicodeString+0x1370    
    1232            WININET.dll!UrlCacheSetGlobalLimit+0xf20    
    1288            Windows.UI.Xaml.dll!DllGetActivationFactory+0x71c90    
    1292            msiltcfg.dll!RestartMsi+0x3d0    
    1296            SHCORE.dll!SHReleaseThreadRef+0x90    
    1336            combase.dll!CoGetProcessIdentifier+0x3c0    
    1348            wlidprov.dll!DllGetClassObject+0x750    
    1352            SHCORE.dll!SHReleaseThreadRef+0x90    
    1872            ntdll.dll!RtlFreeUnicodeString+0x1370    
    1128            twinui.appcore.dll+0x21090    
     
     
     
    Stack
    —————————————————————————————————————————
    ntdll.dll!ZwAlpcSendWaitReceivePort+0xa
    RPCRT4.dll!NdrComplexArrayFree+0xa19
    RPCRT4.dll!I_RpcSendReceive+0x5d
    RPCRT4.dll!NdrSendReceive+0x2f
    RPCRT4.dll!RpcAsyncCompleteCall+0x6a0
    RPCRT4.dll!NdrClientCall2+0x1c
    sechost.dll!OpenServiceW+0x45
    sppc.dll+0xdacf
    sppc.dll+0xdb55
    sppc.dll+0x104b6
    sppc.dll!SLRegisterEvent+0x71
    SLC.dll!SLRegisterWindowsEvent+0x25
    explorer.exe+0x4fd32
    explorer.exe+0x68cf9
    explorer.exe+0x68b4f
    USER32.dll!DispatchMessageW+0x17d
    USER32.dll!EqualRect+0x11a
    USER32.dll!EqualRect+0x1ee
    ntdll.dll!KiUserCallbackDispatcher+0x24
    USER32.dll!PeekMessageW+0xfa
    USER32.dll!PeekMessageW+0x116
    SHELL32.dll!DllCanUnloadNow+0x9c
    SHELL32.dll!Ordinal201+0x3d
    explorer.exe+0x58498
    explorer.exe+0x38c21
    KERNEL32.DLL!BaseThreadInitThunk+0x22
    ntdll.dll!RtlUserThreadStart+0x34

    • IDontWantAName says:

      use DebugDiag2 Analyzer to analyze the explorer hang dump. this gives you a good overview of what happens

  5. Tomasz says:

    Can You help me with that problem – it is very important from me.

    Regards.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s