Issues with "Game Mode" crashing explorer.exe

[REDACTED]

After a recent update my explorer.exe has been freezing and "not responding" on a regular basis so I tracked down the culprit in the event viewer and determined it was Avast's "Game Mode" "gaming_spy.dll" that was causing my "explorer.exe" to crash on a regular basis as seen below. Since uninstalling the "Game Mode" I have not had any freezes and I confirmed via a file search that "gaming_spy.dll" had indeed been removed by uninstalling the "Gaming Mode" component.

Here are the results of the error in question from my event viewer log, if you require any more info please let me know

Faulting application name: explorer.exe, version: 6.1.7601.23537, time stamp: 0x57c44efe
Faulting module name: gaming_spy.dll, version: 18.3.3860.0, time stamp: 0x5abba51c
Exception code: 0xc0000005
Fault offset: 0x00000000000045be
Faulting process id: 0x19a4
Faulting application start time: 0x01d3d1881500cc3f
Faulting application path: C:\Windows\explorer.exe
Faulting module path: C:\Program Files\AVAST Software\Avast\x64\gaming_spy.dll
Report Id: 56abd125-3d8a-11e8-9879-005056c00008

- System

  - Provider

   [ Name]  Application Error
 
  - EventID 1000

   [ Qualifiers]  0
 
   Level 2
 
   Task 100
 
   Keywords 0x80000000000000
 
  - TimeCreated

   [ SystemTime]  2018-04-11T13:15:01.000000000Z
 
   EventRecordID 19626348
 
   Channel Application
 
   Computer SPEC
 
   Security
 

- EventData

   explorer.exe
   6.1.7601.23537
   57c44efe
   gaming_spy.dll
   18.3.3860.0
   5abba51c
   c0000005
   00000000000045be
   19a4
   01d3d1881500cc3f
   C:\Windows\explorer.exe
   C:\Program Files\AVAST Software\Avast\x64\gaming_spy.dll
   56abd125-3d8a-11e8-9879-005056c00008

[bob3160]

Have you tried the following: Repair Avast:
Control Panel> Program and Features (Add/remove program)>Select Avast> Select Repair. Reboot when completed
https://www.avast.com/faq.php?article=AVKB204

If Repair doesn't fix the problem, try the following:
Clean Install of Avast:
https://goo.gl/4Ptzkf
If you need additional help with the Clean Install, watch this:
https://youtu.be/p-h3myRD51A

[REDACTED]

Yes I did and the issue persisted until I uninstalled the "Game Mode" module

[kwiq]

Hello can you try to search for dump files of explorer.exe ?
If you will not be able to find any dump files :

1) download procdump ms utility
https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
2) Set is as default post mortem debugger - dumper via command :
C:\>procdump -ma -i c:\dumps

3) Upload the dump file into avast.

Thank you

[REDACTED]

What would an explorer.exe dump file look like and where would I find it?   

[kwiq]

Dump files have usually .dmp extension and dump file would look like : explorer.exe.11.exe
Try search for: *.dmp or *.mdmp or .hdmp on whole C: drive. 

In case you set procdump as post mortem debugger all dumps should be located in folder which you have passed as parameter (c:\dumps) !

[REDACTED]

I have had the same experience with explorer either freezing or crashing entirely for the last week, ran procdump and analysed with windbg - same culprit gaming_spy.dll!  Since uninstalling the Game Mode component, no issues.  Please see Windbg dump below.

Code: [Select]

THREAD_SHA1_HASH_MOD_FUNC:  387c0ae622e64eda1fadfab4a280114d125e4f90
THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  6fd617f4085c776e8d4fa74333ad645b5258c294
THREAD_SHA1_HASH_MOD:  e0f41d87844c92262fb902fbee068fb00bafb0b8
FAULT_INSTR_CODE:  2394466
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  gaming_spy+45be
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: gaming_spy
IMAGE_NAME:  gaming_spy.dll
DEBUG_FLR_IMAGE_TIMESTAMP:  5abba51c
STACK_COMMAND:  ~52s ; .ecxr ; kb
FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_gaming_spy.dll!Unknown
BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_gaming_spy+45be
FAILURE_EXCEPTION_CODE:  c0000005
FAILURE_IMAGE_NAME:  gaming_spy.dll
BUCKET_ID_IMAGE_STR:  gaming_spy.dll
FAILURE_MODULE_NAME:  gaming_spy
BUCKET_ID_MODULE_STR:  gaming_spy
FAILURE_FUNCTION_NAME:  Unknown
BUCKET_ID_FUNCTION_STR:  Unknown
BUCKET_ID_OFFSET:  45be
BUCKET_ID_MODTIMEDATESTAMP:  5abba51c
BUCKET_ID_MODCHECKSUM:  9a458
BUCKET_ID_MODVER_STR:  0.0.0.0
BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_
FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT
FAILURE_SYMBOL_NAME:  gaming_spy.dll!Unknown
WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer.exe/6.2.16299.248/18ee648b/gaming_spy.dll/18.3.3860.0/5abba51c/c0000005/000045be.htm?Retriage=1
TARGET_TIME:  2018-04-25T10:29:11.000Z
OSBUILD:  16299
OSSERVICEPACK:  15
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
OSEDITION:  Windows 10 WinNt SingleUserTS
USER_LCID:  0
OSBUILD_TIMESTAMP:  1976-06-22 16:45:20
BUILDDATESTAMP_STR:  160101.0800
BUILDLAB_STR:  WinBuild
BUILDOSVER_STR:  10.0.16299.15
ANALYSIS_SESSION_ELAPSED_TIME:  e495
ANALYSIS_SOURCE:  UM
FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_c0000005_gaming_spy.dll!unknown
FAILURE_ID_HASH:  {4cc2bd6f-0e6d-f455-fc54-fb2dec8a1042}

[kwiq]

Hi Rumbles,
can you zip and upload the dump file as (rumbles_gaming_spy.dll.zip) to avast ftp so we can get callstack ?
Thank you

[REDACTED]

Hi Rumbles,
can you zip and upload the dump file as (rumbles_gaming_spy.dll.zip) to avast ftp so we can get callstack ?
Thank you

No worries, uploading to the incoming folder now...

[kwiq]

Bug reported to developers ! Thank you  Rumbles !