How to Find Which Shell Extension Is Crashing Explorer.exe

Updated February 2026 — Windows 11 24H2

Your taskbar disappears and reappears. Your desktop goes black for a moment. You get the dreaded “Windows Explorer has stopped working” dialog. Something is crashing explorer.exe, and the most likely culprit is a faulty shell extension DLL.

This guide provides a systematic process for finding the exact extension responsible — from quick 2-minute checks to advanced debugging techniques.

Why Do Shell Extensions Crash Explorer?

Shell extensions run inside the explorer.exe process. When an extension DLL crashes (access violation, null pointer, buffer overflow), it takes explorer.exe down with it. Common causes include:

• Null pointer dereference — Extension tries to access memory that has been freed
• Buffer overflow — Extension writes beyond allocated memory bounds
• Unhandled exception — Extension throws a C++ exception that is not caught
• COM interface mismatch — Extension implements an older version of an interface that changed in a Windows update
• Missing dependency — Extension DLL depends on a runtime (VC++, .NET) that is not installed or is the wrong version
• Thread safety violation — Extension accesses shared data without proper synchronization

Method 1: Event Viewer (2 Minutes)

The fastest way to identify the crashing DLL:

1. Press Win + R, type eventvwr.msc, press Enter.
2. Navigate to Windows Logs → Application.
3. Look for entries with:
   • Source: Application Error or Windows Error Reporting
   • Event ID: 1000 (Application Error)
   • Level: Error
4. Click on the event and check the Faulting module name field.

What the Event Tells You

The Application Error event contains critical information:

Faulting application name: explorer.exe
Faulting module name: SomeBadExtension.dll
Faulting module path: C:\Program Files\SomeApp\SomeBadExtension.dll
Exception code: 0xc0000005 (Access Violation)

• Faulting module name — This is the shell extension DLL that crashed.
• Exception code — 0xc0000005 = Access Violation (most common), 0xc000001d = Illegal Instruction, 0x80000003 = Breakpoint.
• Faulting module path — Tells you which software installed this DLL.

Method 2: Binary Search with ShellExView (10 Minutes)

If Event Viewer does not show a clear faulting module (sometimes Explorer catches the exception and logs nothing useful):

The Binary Search Strategy

Instead of disabling extensions one by one (which could take hours with 50+ extensions), use a binary search approach:

1. Open ShellExView as Administrator.
2. Hide Microsoft extensions (Options → Hide All Microsoft Extensions).
3. Note the total number of non-Microsoft extensions (e.g., 40).
4. Disable the first half (extensions 1-20). Press F7.
5. Restart Explorer.
6. If the problem stops: The culprit is in the disabled half (1-20). Re-enable extensions 1-10, disable 11-20. Test again.
7. If the problem continues: The culprit is in the still-enabled half (21-40). Disable extensions 21-30. Test again.
8. Continue halving until you find the single culprit.

With 40 extensions, this takes at most 6 rounds instead of 40 individual tests.

Method 3: Process Monitor (Advanced)

For intermittent crashes that are hard to reproduce:

1. Download Process Monitor.
2. Run as Administrator.
3. Set filter: Process Name is explorer.exe.
4. Enable Boot Logging if the crash happens at startup:
   • Options → Enable Boot Logging → OK.
   • Restart your PC.
   • Open Process Monitor again — it will load the boot log.
5. Look for Load Image operations just before the crash timestamp.

Reading the Process Monitor Log

Right before a crash, you will typically see:

Load Image - C:\Program Files\SomeApp\SomeBadExtension.dll - SUCCESS
RegQueryValue - HKCR\CLSID\{...}\InprocServer32 - SUCCESS
Thread Create - SUCCESS
... (a few more operations)
Process Exit - explorer.exe

The last Load Image before the crash is usually the culprit.

Method 4: Windows Debug Tools (Expert)

For developers or IT professionals who need the exact crash stack:

Install WinDbg

winget install Microsoft.WinDbg

Enable Crash Dumps for Explorer

# Create dump directory
New-Item -Path "C:\CrashDumps" -ItemType Directory -Force

# Configure Windows Error Reporting to create full dumps
$dump = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe"
New-Item -Path $dump -Force
Set-ItemProperty -Path $dump -Name "DumpType" -Value 2 -Type DWord
Set-ItemProperty -Path $dump -Name "DumpFolder" -Value "C:\CrashDumps" -Type ExpandString
Set-ItemProperty -Path $dump -Name "DumpCount" -Value 5 -Type DWord

Analyze the Dump

After the next crash, open the dump in WinDbg:

!analyze -v

This will show the exact call stack, the faulting instruction, and the module responsible.

Common Crashing Extensions (2026 Reports)

Based on community reports and forums, these extensions frequently cause crashes:

After Finding the Culprit

1. Update the Software

Visit the vendor’s website and install the latest version. Most crashes are fixed in newer releases.

2. Report the Bug

If the software is actively maintained, report the crash with:

• Your Windows version (run winver)
• The Event Viewer error details
• The crash dump file (if you created one)

3. Disable Permanently

If no fix is available:

• Leave the extension disabled in ShellExView
• The parent application still works — you just lose Explorer integration

4. Clean Up with Revo Uninstaller

If the crashing extension belongs to software you no longer need, remove it completely with Revo Uninstaller Pro to catch all leftover files and registry entries.

Frequently Asked Questions

Q: Can a shell extension crash only when right-clicking specific file types? A: Yes! Extensions can register for specific file types (e.g., .psd files only). If you only crash when right-clicking PDFs or images, check extensions registered under HKCR\.pdf\shellex or the relevant file type key.

Q: My Explorer crashes on boot — how do I disable extensions without Explorer? A: Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Startup Settings → Safe Mode). In Safe Mode, third-party extensions are not loaded, and you can run ShellExView to disable them.

Q: Is it a shell extension or a driver causing the crash? A: If explorer.exe restarts (taskbar flickers), it is likely a shell extension. If the entire system blue screens (BSOD), it is more likely a kernel-mode driver.