Powertoys: PowerRename fails and crashes Explorer.exe

[Sloppyedwards]

Tried to rename five files using simple to replacement strings; no other options selected. Tried twice. Both times, Explorer crashed, and the files were not renamed.

[enricogior]

@Sloppyedwards
what version of PowerToys are you running?

[Sloppyedwards]

@Sloppyedwards
what version of PowerToys are you running?

v0.23.2

I just tried again with a single file, and it failed/crashed also.

[Jay-o-Way]

What were your search and replace strings? What were the files or folders? Maybe this file is a system file or protected file ?

[Sloppyedwards]

The files are not system, hidden, or read-only.

[enricogior]

@Sloppyedwards
we have a known bug in Windows ~https://github.com/microsoft/PowerToys/issues/1410~ https://github.com/microsoft/PowerToys/issues/1410#issuecomment-712334641

[Jay-o-Way]

@enricogior You are referring to an issue that is closed. Can't expect people to find that.

[enricogior]

@Jay-o-Way
I updated the link to the comment. A user reported a different crash on a fixed bug, we can't reopen that issue since it is fixed.
We can keep this open until Windows update fixes it.

[enricogior]

@Sloppyedwards
for completeness, can you please open the Event Viewer, go to Windows Logs - > Application and report the crash data here?
Thanks.

[Sloppyedwards]

@enricogior
Thanks; I'll try again after future Windows Updates are installed.

[Sloppyedwards]

There is a .NET Runtime error (Event ID 1026):

Application: explorer.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 00007FFAD7A03320

This is followed 1s later by an Application Error (Event ID 1000):

Faulting application name: explorer.exe, version: 10.0.19041.488, time stamp: 0xb1a44bf9
Faulting module name: OneCoreUAPCommonProxyStub.dll, version: 10.0.19041.508, time stamp: 0x2fc6edf7
Exception code: 0xc0000005
Fault offset: 0x00000000004d3320
Faulting process id: 0x11f4
Faulting application start time: 0x01d6a15be41dad66
Faulting application path: C:\Windows\explorer.exe
Faulting module path: C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
Report Id: a0679467-0ab0-4252-a7eb-f8ec31a228ad
Faulting package full name: 
Faulting package-relative application ID: 

This is followed by Windows Error Reporting (Event ID 1001):

Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.19041.488
P3: b1a44bf9
P4: OneCoreUAPCommonProxyStub.dll
P5: 10.0.19041.508
P6: 2fc6edf7
P7: 00000000004d3320
P8: c0000005
P9: 0000000000000008
P10: 

Attached files:

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_9c70db3c54b166484110cb6af28a74747b2563d_3591567a_8d2cc73d-2a79-42b2-81a8-20b1a06a20f8

Analysis symbol: 
Rechecking for solution: 0
Report Id: a0679467-0ab0-4252-a7eb-f8ec31a228ad
Report Status: 4
Hashed bucket: 
Cab Guid: 0

and

Fault bucket 1608387005341514680, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.19041.488
P3: b1a44bf9
P4: OneCoreUAPCommonProxyStub.dll
P5: 10.0.19041.508
P6: 2fc6edf7
P7: 00000000004d3320
P8: c0000005
P9: 0000000000000008
P10: 

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER376F.tmp.WERInternalMetadata.xml

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_9c70db3c54b166484110cb6af28a74747b2563d_3591567a_8d2cc73d-2a79-42b2-81a8-20b1a06a20f8

Analysis symbol: 
Rechecking for solution: 0
Report Id: a0679467-0ab0-4252-a7eb-f8ec31a228ad
Report Status: 268435456
Hashed bucket: 681fc737079cbe3bc6522375b2bc3bb8
Cab Guid: 0

[crutkas]

@chrdavis looking at the bucket in watson but it is a different DLL.

[chrdavis]

I requested watson to collect heap dumps for the bucket. Sounds similar to the issue I looked into for #1410. From that issue:

Do you have Kinggsoft antivirus or Norton antivirus/endpoint protection installed? These are typically installed at the below location.

c:kinggsoft
C:Program FilesManufacturerEndpoint Agent

I'm looking at crash reports coming in that are bucketed with @chrishas35's crash report and the underlying issue points to these products hooking the rename operation. Can you try disabling/uninstalling and see if this issues still repros?

[Sloppyedwards]

Antivirus is CrowdStrike Falcon Sensor.

Both Symantec EDPA/WDP and McAfee Endpoint Encryption are running. This is a corporate PC with managed components pushed out by Landesk, so I'm not sure why I have two competing endpoint protection products installed. Seems like they would conflict with each other, but I'll have to ask someone else in IT.

*Edit: I guess the Symantec processes are for Data Loss Prevention, and the McAfee processes are just drive encryption. I doubt I can (or should) disable either one, since this machine is in a corporate/enterprise environment.

[crutkas]

tracking against #1410