TC does not start anymore

[mmd14]

Hi there,

I am a very happy user of TC for many many years now (from the early 2000s actually), never really had any trouble with it.

Unfortunately I'm having a severe problem as of yesterday in a desktop PC running Windows 7 Professional SP1, 32-bit. I searched this forum and googled the internet for possible solutions matching the relevant phenomena and evidence but none of the suggestions worked for me (there were few few reports of similar problems to begin with).

So: as of yesterday TC simply won't start. Upon using the link, or trying to execute it from the program directory, nothing happens apart from the Windows round icon spinning for a few seconds and that's it. Then nothing happens.
There was no installation of new TC plugins recently, or other installations in the machine which I'm aware of.

In the Event Viewer, 2 relevant events appear after each such unsuccessful execution:

Log Name: Application
Source: Application Error
Date: 25/04/2020 14:28:01
Event ID: 1000
Task Category: Application Crashing Events
Level: Error
Keywords: Classic
User: N/A
Computer: MMD14
Description:
Faulting application name: TOTALCMD.EXE, version: 9.5.1.0, time stamp: 0x2a425e19
Faulting module name: ntdll.dll, version: 6.1.7601.24545, time stamp: 0x5e0eb7a5
Exception code: 0xc0000005
Fault offset: 0x00031d3a
Faulting process id: 0xca8
Faulting application start time: 0x01d61af492fa9ed2
Faulting application path: C:\Program Files\WinUtils\Total Commander\TOTALCMD.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d1c73033-86e7-11ea-b5cf-74d435361320
Faulting package full name: %14
Faulting package-relative application ID: %15
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-04-25T11:28:01.000000000Z" />
<EventRecordID>132592</EventRecordID>
<Channel>Application</Channel>
<Computer>MMD14</Computer>
<Security />
</System>
<EventData>
<Data>TOTALCMD.EXE</Data>
<Data>9.5.1.0</Data>
<Data>2a425e19</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.24545</Data>
<Data>5e0eb7a5</Data>
<Data>c0000005</Data>
<Data>00031d3a</Data>
<Data>ca8</Data>
<Data>01d61af492fa9ed2</Data>
<Data>C:\Program Files\WinUtils\Total Commander\TOTALCMD.EXE</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d1c73033-86e7-11ea-b5cf-74d435361320</Data>
</EventData>
</Event>

and immediately after:

Log Name: Application
Source: Windows Error Reporting
Date: 25/04/2020 14:28:02
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MMD14
Description:
Fault bucket 2164027986, type 335401445
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: TOTALCMD.EXE
P2: 9.5.1.0
P3: 2a425e19
P4: ntdll.dll
P5: 6.1.7601.24545
P6: 5e0eb7a5
P7: c0000005
P8: 00031d3a
P9:
P10:

Attached files:
C:\Users\Mosh\AppData\Local\Temp\WERAF95.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_TOTALCMD.EXE_895eb6535849e19e6efffa4e17432d1b5db77c3_1a90b3c9

Analysis symbol:
Rechecking for solution: 0
Report Id: d1c73033-86e7-11ea-b5cf-74d435361320
Report Status: 0
Hashed bucket: %22
Cab Guid: %23
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-04-25T11:28:02.000000000Z" />
<EventRecordID>132593</EventRecordID>
<Channel>Application</Channel>
<Computer>MMD14</Computer>
<Security />
</System>
<EventData>
<Data>2164027986</Data>
<Data>335401445</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>TOTALCMD.EXE</Data>
<Data>9.5.1.0</Data>
<Data>2a425e19</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.24545</Data>
<Data>5e0eb7a5</Data>
<Data>c0000005</Data>
<Data>00031d3a</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
C:\Users\Mosh\AppData\Local\Temp\WERAF95.tmp.WERInternalMetadata.xml</Data>
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_TOTALCMD.EXE_895eb6535849e19e6efffa4e17432d1b5db77c3_1a90b3c9</Data>
<Data>
</Data>
<Data>0</Data>
<Data>d1c73033-86e7-11ea-b5cf-74d435361320</Data>
<Data>0</Data>
</EventData>
</Event>

This is what I tried so far to tackle the problem based on people's suggestions, but none of these steps made any change - TC still does not execute and generates the above error events:

• Restart the PC

• Try to execute the program from a different user

• Execute from program dir instead of link, including executing from a cmd shell (without and with admin rights)

• Turn off Windows UAC (reduce to minimum)

• Disable the installed Avast AV

• Execute SFC /SCANNOW from cmd (no issues were found)

• Execute TC from cmd using the FRESH ini flag

• Update to the latest 32-bit TC version (9.51; it was 8.x before upgrade)

• Completely remove TC including removal of ini files and manual deletion of the remainders of the TC program directory, then re-install it

• Tried re-installing the suspicious ntdll.dll as instructed by Microsoft. Could not complete this though as I am receiving an error message: The module "ntdll.dll" was loaded but the entry-point DLLRegisterServer was not found. Make sure that "ntdll.dll" is a valid DLL ir OCX file and then try again. Obviously the file ntdll.dll DOES exist in my SYSTEM32 directory.

• Checked the c:\ drive for errors using the Win7 built-in utility (C: properties -> Tools -> Error Checking, scanned with "automatically scan file system errors). I missed the moment when the long scan finished, anyhow the PC rebooted normally with no messages about errors that were fixed.

• I'm running a full virus scan using Avast. It's running for a few hours now, nearly half way through but so far nothing was found.

I'm out of ideas at this stage. Except for re-installing Windows on the PC, which I would highly prefer not to get into for obvious reasons.
I am no expert but have some technical abilities and have solved PC problems in the past, but this one beats me.

Your help will be greatly appreciated!

[Dalai]

Check the totalcmd.exe for compatibility settings, and disable any that are present. Also, reboot the system in safe mode and try to start TC there. If it works in safe mode, some background program or service may be preventing TC from starting correctly.

Regards
Dalai

[petermad]

2mmd14
What is the date and version of your ntdll.dll? It seems that there was an update issued January 3rd 2020, version no: 6.1.7601.24545

[mmd14]

Thanks for the tips

@Dalai
- As for compatibility settings I forgot to mention that this was one of the first things I tried to debug, although I never made any change to these settings for TC. Found nothing special there.
- I did try to start TC from safe mode and it DOES work there. Question is how to nail down the conflicting program. As said the problem started just yesterday, I made no installations whatsoever (except perhaps for semi-automatic Windows Updates installs that took place this week I think).

@petermad
The ntdll.dll file is dated and version is exactly as you mentioned Jan 3rd etc. What does this mean? Can it be that this (new?) version is the one causing problems? If so is there a safe way to revert to an older one?

[Dalai]

- I did try to start TC from safe mode and it DOES work there. Question is how to nail down the conflicting program.

Start with the usual startups/autoruns via msconfig.exe. Also exit any programs that leave/have an icon in the TNA (tray notification area).

As said the problem started just yesterday, I made no installations whatsoever (except perhaps for semi-automatic Windows Updates installs that took place this week I think).

Yes, well, Windows Updates are a hot candidate, but updates for Avast as well. Uninstalling Avast might also help. Yes, I know you already disabled it temporarily, but disabling might not disable every component. Depending on your Avast edition, it might also include a sandbox feature.

If so is there a safe way to revert to an older one?

Only by uninstalling the corresponding Windows Update. Since you're on Win7, it could be a security-only update (which can only be downloaded from the Windows Update Catalog and installed manually) or a monthly rollup (which are offered via Windows Update automatically). Check Control Panel > Windows Update > List installed updates; usually this list is automatically sorted by date, so it should be easy to spot the recently installed update(s).

Regards
Dalai

[petermad]

2mmd14

Can it be that this (new?) version is the one causing problems?

Well I am running TC with that version, so I doubt it, unless other system files also has to be updated for this to new version to work (I have 61 other updated files from that date).

[ghisler(Author)]

Maybe a stack trace will help me see in which function it crashes.
Could you use the tool Procdump to create one for me, please:
https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx

1. Create new directory, e.g. c:\dumps
2. Open cmd.exe as administrator
3. Run the command
c:\path\procdump.exe -ma -i c:\dumps
4. Make Total Commander crash
5. Send me the dump from c:\dumps.

[mmd14]

Thanks for your help Christian

I followed your instructions, interestingly Procdump generated TWO dump files rather than one for only a single execution of TCMD
I just uploaded the two files (65MB each) to:
https://we.tl/t-5j8AviuD7P

[ghisler(Author)]

It seems to be a problem with Avast antivirus. Here is the top of the stack from the first crash:

STACK_TEXT:
000ccf48 758d845d kernelbase!RaiseException+0x58
000ccfa0 69402bdc ashshell!on_avast_dll_unload+0x2f40c
000ccfd0 693ac5f1 ashshell!DllCanUnloadNow+0x580e1
000ccff8 693abdf0 ashshell!DllCanUnloadNow+0x578e0
000cd010 69353bcb ashshell+0x3bcb
000cd018 69357cb4 ashshell!DllCanUnloadNow+0x37a4
000cd834 693d485f ashshell!on_avast_dll_unload+0x108f
000cd87c 693d491c ashshell!on_avast_dll_unload+0x114c
[...]
000cf57c 76d0e346 shell32!SHGetFileInfoW+0x18f
000cf7b8 76d0e3eb shell32!SHGetFileInfoA+0x6c
000cfca0 00603f67 totalcmd+0x203f67

and here from the second crash:

STACK_TEXT:
000ccf48 758d845d kernelbase!RaiseException+0x58
000ccfa0 69402bdc ashshell!on_avast_dll_unload+0x2f40c
000ccfd0 693ac5f1 ashshell!DllCanUnloadNow+0x580e1
000ccff8 693abdf0 ashshell!DllCanUnloadNow+0x578e0
000cd010 69353bcb ashshell+0x3bcb
000cd018 69357cb4 ashshell!DllCanUnloadNow+0x37a4
000cd834 693d485f ashshell!on_avast_dll_unload+0x108f
000cd87c 693d491c ashshell!on_avast_dll_unload+0x114c
000cd888 77ac87bc ntdll!LdrpCallInitRoutine+0x14
[...]
000cf57c 76d0e346 shell32!SHGetFileInfoW+0x18f
000cf7b8 76d0e3eb shell32!SHGetFileInfoA+0x6c
000cfca0 00603f67 totalcmd+0x203f67

So the function Total Commander calls is SHGetFileInfo.

I would try to reinstall Avast. Other people don't seem to have this problem, so it may be a problem with your Avast installation.

[mmd14]

Sorry for the delayed response -
I was able to proceed with the debugging attempts today.

The situation is as follows:

1) After completely uninstalling Avast AV, I was indeed able to execute TC with no problem, as if no issue ever existed.

2) I downloaded the Avast setup program for my Win7 machine in advance (a small ~200k exe file).
Having TC open now, I tried to execute this program from within TC as I'm used to - to no avail, the setup process would not start. Instead a couple of dump files were generated by procdump. Tried this twice, same result.

3) I closed TC and executed the Avast setup exe from within Windows Explorer - now Avast was able to start and complete the installation process.

4) At this point there was again no way to execute TC. Same crashing result as before with dump files generated by procdump.

The dump files from steps #2 and #4 are in: https://we.tl/t-r23zUMd0f3

Question now is how to proceed from here... I could always try to go for a different AV program but I've been with Avast for quite a few years now and would like to continue with it if possible.
If no choice I'll sadly switch to another AV (any suggestions?..) as TC is absolutely indispensable

TIA

[Horst.Epp]

Sorry for the delayed response -
I was able to proceed with the debugging attempts today.

The situation is as follows:

1) After completely uninstalling Avast AV, I was indeed able to execute TC with no problem, as if no issue ever existed.

2) I downloaded the Avast setup program for my Win7 machine in advance (a small ~200k exe file).
Having TC open now, I tried to execute this program from within TC as I'm used to - to no avail, the setup process would not start. Instead a couple of dump files were generated by procdump. Tried this twice, same result.

3) I closed TC and executed the Avast setup exe from within Windows Explorer - now Avast was able to start and complete the installation process.

4) At this point there was again no way to execute TC. Same crashing result as before with dump files generated by procdump.

The dump files from steps #2 and #4 are in: https://we.tl/t-r23zUMd0f3

Question now is how to proceed from here... I could always try to go for a different AV program but I've been with Avast for quite a few years now and would like to continue with it if possible.
If no choice I'll sadly switch to another AV (any suggestions?..) as TC is absolutely indispensable

TIA

If you have a paid version of Avast you should make a support call with them
but I would not expect much help for such problems.
Since many years I always suggested to use Kaspersky as I had no major problems ever.
Got it thru Web.de membership for 10€ a year.

[petermad]

2mmd14

1) After completely uninstalling Avast AV

Are you sure it was a complete ininstall. Often programs leave behind data-files, which are used again after a reinstallation. This could in this case be quarantine lists, that for some reason makes Avast prevent TC from being executed.

Try and search for "AVAST Software" in your Users folder after you have uninstalled Avast, and delete it before reinstalling.

You might also consider deleting everything that has to do with "Avast" in your registry, before reinstalling.

[siealex]

This could in this case be quarantine lists, that for some reason makes Avast prevent TC from being executed.

But why does a running TC prevent running the Avast installation???

[mmd14]

FWIW:

After leaving this thing aside for a long while (and using an interim alternative file manager..), not reinstalling or replacing Avast AV as Christian suggested (due to plain laziness), today it came to my mind to give TC a shot once again and try to execute it from the taskbar shortcut. And... voila! TC came back to life and opened normally as if no problem ever existed.

I don't know what happened in between and at which point in time the problem got fixed. If Avast was the cause of the conflict then it may be that one of Avast's automatic updates took care of getting rid of the problem - I did not follow the update process closely.

Thanks all again for the help you gave me here.