• Still running Windows 7 or earlier? Support for Windows 7 ended on January 14th 2020. Please review the thread here for more details.

[SOLVED] Stackhash APPCRASH issue, Windows 7 SP1

G

Gecky

New member
Joined
Jan 2, 2016
Posts
3
Hello and thanks for taking the time to look at this thread.


Yesterday, my computer has become afflicted with a weird issue that causes most of my programs to simply crash on startup. stating stackhash as the issue. These programs include: Minecraft, Battle.net, Java update, a driver for my tablet pen, and even windows explorer, but specifically when entering control panel > system (weird, right??). They also seem to crash on startup MOST of the time, but not all the time. I downloaded a minecraft modpack and it wouldn't run, but after waiting ~20 minutes it decided to start.


I have run Memory checker and sfc /scannow but neither are showing any issues. Finally, I attempted to recover to a time before I ran the program (at least I think it was before), but I recieved conflicting messages from the recovery program saying it didn't work but my pc saying it did. Some recently installed programs seem to have disapeared but the windows 10 ad still doesn't show up.


Any help would really be appreciated.




1) what happened immediately prior to the problem surfacing?


I used a tool called Win10wiwi to get rid of the windows 10 update notification and some spyware-type updates.
When restarting my computer, it froze at the shudown screen with a message saying that it was configuring the system or something.
After a few hours I was pretty certain it froze so I manually shut down my computer.


2) Have you had any virus or malware infections lately?


None. I ran both malwarebytes and kaspersky and neither have found any malware.


3) Are you seeing any other problems with the machine (running slow, Blue Screens/reboots, etc.)


If anything, the pc is running slightly faster than it used to!


4) The EXACT wording of the notification (different causes can give different messages)


Here's two sample errors:


Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 6.1.7601.17567
Application Timestamp: 4d672ee4
Fault Module Name: StackHash_0c9c
Fault Module Version: 6.1.7601.19045
Fault Module Timestamp: 56259295
Exception Code: c0000374
Exception Offset: 00000000000bffc2
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 4105
Additional Information 1: 0c9c
Additional Information 2: 0c9ce90aa6b9d97599bc018ffae10aaf
Additional Information 3: 4563
Additional Information 4: 456345ca4d0caeb2db927626c33e64e9


Problem Event Name: APPCRASH
Application Name: Battle.net.exe
Application Version: 1.3.6.6526
Application Timestamp: 5670b2e8
Fault Module Name: StackHash_f78c
Fault Module Version: 6.1.7601.19045
Fault Module Timestamp: 56258e62
Exception Code: c0000374
Exception Offset: 000ced0b
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 4105
Additional Information 1: f78c
Additional Information 2: f78cc5fe4e25c27c6feb54a8cb82c9cb
Additional Information 3: a66c
Additional Information 4: a66cb6d8dab297a7d9ada97eeb1cc1b6




And here's my diagnostic report:




Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->


Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {44A91230-9710-43C8-932C-A391ED0B2C4B}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.151019-1254
TTS Error:
Validation Diagnostic:
Resolution Status: N/A


Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002


Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002


OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002


OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3


Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Gecky\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed


File Scan Data-->


Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{44A91230-9710-43C8-932C-A391ED0B2C4B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-296538366-3410531257-71118025</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p7-1141</Model></SYSTEM><BIOS><Manufacturer>AMI</Manufacturer><Version>7.07</Version><SMBIOSVersion major="2" minor="7"/><Date>20110816000000.000000+000</Date></BIOS><HWID>795A3407018400FC</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>


Spsys.log Content: 0x80070002


Licensing Data-->
Software licensing service version: 6.1.7601.17514


Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800010-02-1033-7601.0000-0422011
Installation ID: 003816077835269505876985476805423774234443875171355475
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: 3Q6C9
License Status: Licensed
Remaining Windows rearm count: 1
Trusted time: 02/01/2016 3:12:54 PM


Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:




HWID Data-->
HWID Hash Current: OgAAAAEAAQABAAEAAAADAAAABwABAAEAln0ehHqn7gjU9AAquuRHSd1Cwiq+cqwAsJTGKyhkOIsAag==


OEM Activation 1.0 Data-->
N/A


OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
DBGP HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
SLIC HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
 
Hello Gecky, and welcome to Sysnative!

First off I want to thank you for taking the time to write out what's been going on and what you've already tried so carefully. It's rare to get such a clear and concisely written summary and it saves us both a great deal of time. So thank you :)

Second, and to answer one small part of your query, the part with the System Restore. The conflict between "it didn't work"/"oh wait it did work" is a common bug. It usually means that it did work. In general, ignore what's said to you in the recovery environment and go on what's said to you when you next boot Windows.


Third... tricky problem. Those stackhash/0xc0000374 crashes are what we know as a "heap corruption exception". In essence, all running processes have little bits of RAM allocated to them. These processes use RAM for a whole variety of different things, so the RAM offered is not one huge blob of necessarily contiguous amorphous mass, but rather several separate allocations of different parts of the RAM, each designed to be put to use in different ways. The 'heap' is one part of that - one specific piece of RAM allocated for use in a few specific places [the 'stack' is another such part] (okay, so that's all very oversimplified and a bit handwavy in places but maybe you sort of understand!).

A 'heap' corruption occurs when a program mishandles the allocation of heap it is given and the operating system terminates it for abuse [again, all a bit handwavy]. Perhaps, for example, the operating system allocates explorer.exe 100MB of heap, then explorer.exe keeps using 10MB allocations, again and again and again, but for some reason it forgets to free these allocations after use. So eventually it runs out of its 100MB quota and the operating system terminates the process (if it didn't it could potentially eat up all the free memory on the entire system and crash the whole computer...)

What's curious here is that this is usually a software bug - explorer.exe coded incorrectly so as not to free allocations properly, or even freeing allocations before they've been allocated! In essence, the problem lies in a software bug in explorer.exe. So we contact the developers, they fixed their code and the problem is fixed.

Except that isn't the case here, because what's usually a home and dry case of a software bug in one particular piece of software is instead affecting many. This problem is clearly coming from some sort of system level component. Which is a much rarer and more challenging problem.


In fact, I was in two minds about taking on this case at all. This is going to have no easy resolution - if we're able to find one at all. I've been tossing up possibilities and scenarios in my head already, and I must say that it's going most likely to be a case more of instinct than hard procedure. You might like to consider an In-Place Upgrade: https://www.sysnative.com/forums/wi...-upgrade-install-windows-windows-7-vista.html

Alternatively, we target the explorer.exe crash (it must be explorer.exe - as a Microsoft component I have access to symbols and the like I do not have for non-Microsoft programs). Wait until explorer.exe specifically crashes then leave the Close Program prompt on screen. You must not yet close the program!

Open Task Manager (Ctrl-Shift-Esc or Ctrl-Alt-Delete > Task Manager), go to the Processes tab, find explorer.exe, right click on it > Create Dump File. Wait for it to be generated and look at where it's placed (usually C:\Users\{username}\AppData\Local\Temp\explorer.dmp. (You can now close explorer.exe)

Go fetch this file (it will be big.....), right click on it > Send to > Compressed (zipped) file. [alternatively use .7z or .rar if you prefer]. Either way, upload the compressed file to a file sharing website, e.g. OneDrive, GoogleDrive, Dropbox, etc., create a public link and link it to me here.

Whether or not this will help is uncertain, but it's the best shot we've got of a clear diagnosis. It's just not a fantastically great shot.

Finally, please be careful in future of using any program to remove Windows Updates. They're so deeply embedded into the system that as one of the Windows Update team here I see nothing but disaster and tears with their use. They're forever going wrong and breaking systems. Usually there's no resolution in sight and only a reinstall will fix it :( I'll do my best but the prospect isn't fantastically positive. Do consider a Repair Install/In-Place Upgrade if you can. Otherwise I'll try my best but can offer very few promises of success.

Richard
 
Hey Richard,

I really appreciate you taking the time to try and help me. If you ever feel like my case is hopeless and I need to resort to the In-Place upgrade, just let me know. But for now, I'd rather at least give a try to maintaining my computer.

Between my last post and this one, I have tried rerunning the tool the other way around and also uninstalling and reinstalling service pack 1. Neither of those worked, but my windows explorer wouldn't crash when I uninstalled SP1 (everything else still would though).

Here is the file you asked for: https://www.dropbox.com/s/djtlvcv5lzq45s4/explorer.rar?dl=0

Thanks again.

Edit:
Oh, and as an afterthought, here's a list of programs that don't seem to crash:
-Skype
-Google Chrome
-Mozilla Firefox
-Windows Explorer (well, most of the time anyway)
-Hamachi
-Kasperski
-Malwarebyte
-Paint.net

That's it... I can't figure out what all these programs have in common, but this could help you!
 
Hello again!

Well, I've done a bit of digging into that dump file and to my pleasant surprise actually turned up a positive result. Hopefully it's as simple as it looks (it is ever? ;))

There's a dodgy HeapFree() call from atiumd64.dll seemingly at the heart of the crash. This, it would seem, is a common and well known problem (you're not alone!) https://www.google.co.uk/#q=atiumd64.dll+crashing+explorer.exe. Plus ATI software and drivers don't exactly have a reputation for stability :r1:

What's happened is that during the Windows Update restore operation, your system has flicked back over to ATI drivers dating from 2011 - and, it would seem, they're full of bugs.

Download the latest ones and hopefully they'll crash your system in different ways: Download Drivers
[I'm not really joking - ATI drivers have such a (justifiably) bad reputation that the latest ones are rarely much better than the old ones, they just crash differently. The beta drivers tend to be even worse]

*If* your system doesn't fully stabilise on ATI drivers (in general, not just in relation to this problem), here are the steps:

1) Perform a driver only install (https://www.sysnative.com/forums/wi...cards-driver-only-installation-procedure.html) so that you are running only the critical driver components, not all the other addin feature and goodness only knows what else. The less you have running, the fewer bugs you'll hit.
2) Start going back version by version until you find a stable one. Then never update it again ;)
3) Try the beta drivers.

Anyway, I do hope it's this simple. Fingers crossed. If it's not, repeat the same procedure and upload a new crash dump for me to look at.

Richard
 
Hello!

Wow, looks like the solution was to simply update my driver, who knew! Everything seems to be running perfectly.

You were a big help and very clear about every step I would have to take, so here's a final thank you! :thumbsup2:

If anything, I learned some valuable lessons from this issue about messing with updates and trying to update my drivers if something isn't working. (I also don't have that annoying ad any more, so that's a win!)

But yeah, thanks again, and I wish you luck with... pretty much anything really.
 
Hello Richard,

I have just joined to thank you for your help and fix on this issue.

I have been down for 3 days trying to fix this StackHash problem on one of my development machines. It has drained me ...

Basically a lot of apps suddenly started throwing this error. Crazy stuff for example simply trying to open System from the Control Panel, trying to load Visual Studio, trying to install app and in some cases even trying to uninstall apps. Just random occurrences as as far as I could tell.

Tried a good number of suggestions from around the place, uninstalled all the .Net stuff, I have run all manner of scans and repair apps, sfc, etc etc.

I think you get the picture.

And then I found this post. Disabled the AMD Radeon driver so I am just running the native Intel Graphics Driver and bingo, everything is working.

I can't believe it was the video driver but there you go.

Anyway thanks, much appreciate you taking the time to help out the OP and thus me.

My meagre Donation is heading your way.

Cheers
Mark
(Australia)
 
@krp please create a new thread and explain your problem.
 
Back
Top