Notepad++ v8.7.1 (32-bit) NppShell.dll is intermittently crashing Windows Explorer.

Mark Colvin

I have had this issue with Windows 10 and Windows 11 on the same computer. I have tried a number of simple fixes to stop the Windows Explorer crashes, without any final solution. It occurs every day, one to 5 times a day, seems to be random.
Recently, I cleared the Windows events logs to help narrow down the last event that occurred during the time that Windows Explorer windows just vanish.

This is the first time I have been able to find something that points to a cause.
I have a .DOCX file with Application events log entries and the noted windows.wer file in one of entries.

Since I was not using NPP application at the time of the Windows Explorer crash, I included the ?/debug info as well.
Please advise on further steps to determine if this is a REAL NPP problems or not.

TIA,
Mark Colvin

Applications Events:
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/20/2025 1:00:14 PM
Event ID: 16384
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MAC-LAPTOP
Description:
Successfully scheduled Software Protection service for re-start at 2124-12-27T19:00:14Z. Reason: RulesEngine.
Event Xml:
<Event xmlns=“http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=“Microsoft-Windows-Security-SPP” Guid=“{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}” EventSourceName=“Software Protection Platform Service” />
<EventID Qualifiers=“16384”>16384</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=“2025-01-20T19:00:14.6231386Z” />
<EventRecordID>933591</EventRecordID>
<Correlation />
<Execution ProcessID=“11492” ThreadID=“0” />
<Channel>Application</Channel>
<Computer>MAC-LAPTOP</Computer>
<Security />
</System>
<EventData>
<Data>2124-12-27T19:00:14Z</Data>
<Data>RulesEngine</Data>
</EventData>
</Event>

Log Name: Application***********Win11 Explorer Crash – all windows are gone*******
Source: Application Error
Date: 1/20/2025 1:00:56 PM
Event ID: 1000
Task Category: Application Crashing Events
Level: Error
Keywords:
User: MAC-LAPTOP\mcolv
Computer: MAC-LAPTOP
Description:
Faulting application name: explorer.exe, version: 10.0.26100.2454, time stamp: 0xdc9c700e
Faulting module name: NppShell.dll, version: 1.5.0.0, time stamp: 0x66880559
Exception code: 0xc0000409
Fault offset: 0x000000000001fc25
Faulting process id: 0x4824
Faulting application start time: 0x1DB6B446A90FD36
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll
Report Id: 10985112-baaa-4f53-9f4e-9f3fedf967ce
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns=“http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=“Application Error” Guid=“{a0e9b465-b939-57d7-b27d-95d8e925ff57}” />
<EventID>1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime=“2025-01-20T19:00:56.5056321Z” />
<EventRecordID>933592</EventRecordID>
<Correlation />
<Execution ProcessID=“24492” ThreadID=“13172” />
<Channel>Application</Channel>
<Computer>MAC-LAPTOP</Computer>
<Security UserID=“S-1-5-21-2470100382-2049306416-2370556751-1001” />
</System>
<EventData>
<Data Name=“AppName”>explorer.exe</Data>
<Data Name=“AppVersion”>10.0.26100.2454</Data>
<Data Name=“AppTimeStamp”>dc9c700e</Data>
<Data Name=“ModuleName”>NppShell.dll</Data>
<Data Name=“ModuleVersion”>1.5.0.0</Data>
<Data Name=“ModuleTimeStamp”>66880559</Data>
<Data Name=“ExceptionCode”>c0000409</Data>
<Data Name=“FaultingOffset”>000000000001fc25</Data>
<Data Name=“ProcessId”>0x4824</Data>
<Data Name=“ProcessCreationTime”>0x1db6b446a90fd36</Data>
<Data Name=“AppPath”>C:\WINDOWS\explorer.exe</Data>
<Data Name=“ModulePath”>C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll</Data>
<Data Name=“IntegratorReportId”>10985112-baaa-4f53-9f4e-9f3fedf967ce</Data>
<Data Name=“PackageFullName”>
</Data>
<Data Name=“PackageRelativeAppId”>
</Data>
</EventData>
</Event>

Log Name: Applicationlast reported error******
Source: Windows Error Reporting
Date: 1/20/2025 1:01:00 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords:
User: MAC-LAPTOP\mcolv
Computer: MAC-LAPTOP
Description:
Fault bucket 2055285806913895911, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.26100.2454
P3: dc9c700e
P4: NppShell.dll
P5: 1.5.0.0
P6: 66880559
P7: 000000000001fc25
P8: c0000409
P9: 0000000000000007
P10:

Attached files:
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b7e9da55-425c-4334-ab3b-74c5a420e371.tmp.mdmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.20203e92-8fe2-41d5-ac29-367728e13626.tmp.WERInternalMetadata.xml
WPR_initiated_DiagTrackMiniLogger_OneTrace_User_Logger_20241008_1_EC_0_inject.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f32086fd-1fc9-4212-a7c2-465e271e24ee.tmp.etl
WPR_initiated_DiagTrackMiniLogger_WPR System Collector_inject.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.74ed2b09-b61e-445f-8c8a-ff15cf1b7c16.tmp.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b389a25f-72a3-4d73-853e-16c0b3f34b2a.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.61d12e62-49d2-4d5c-a5ba-7db1229c5ed1.tmp.txt
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.d45344fd-f051-4979-99f6-731764e9ed2b.tmp.xml

These files may be available here:
\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_75a7b1a2e2a87c6ffabace606d6bd8c9b7488325_83fa2685_813c2fee-6603-4a7e-bbda-e55df3128adf

*******got this file from the above folder: Report.wer ***************

Analysis symbol:
Rechecking for solution: 0
Report Id: 10985112-baaa-4f53-9f4e-9f3fedf967ce
Report Status: 268435456
Hashed bucket: 7b8ca4834f227c9a4c85d78d51013de7
Cab Guid: 0
Event Xml:
<Event xmlns=“http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=“Windows Error Reporting” Guid=“{0ead09bd-2157-539a-8d6d-c87f95b64d70}” />
<EventID>1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime=“2025-01-20T19:01:00.4010358Z” />
<EventRecordID>933593</EventRecordID>
<Correlation />
<Execution ProcessID=“24492” ThreadID=“13172” />
<Channel>Application</Channel>
<Computer>MAC-LAPTOP</Computer>
<Security UserID=“S-1-5-21-2470100382-2049306416-2370556751-1001” />
</System>
<EventData>
<Data Name=“Bucket”>2055285806913895911</Data>
<Data Name=“BucketType”>5</Data>
<Data Name=“EventName”>BEX64</Data>
<Data Name=“Response”>Not available</Data>
<Data Name=“CabId”>0</Data>
<Data Name=“P1”>explorer.exe</Data>
<Data Name=“P2”>10.0.26100.2454</Data>
<Data Name=“P3”>dc9c700e</Data>
<Data Name=“P4”>NppShell.dll</Data>
<Data Name=“P5”>1.5.0.0</Data>
<Data Name=“P6”>66880559</Data>
<Data Name=“P7”>000000000001fc25</Data>
<Data Name=“P8”>c0000409</Data>
<Data Name=“P9”>0000000000000007</Data>
<Data Name=“P10”>
</Data>
<Data Name=“AttachedFiles”>
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b7e9da55-425c-4334-ab3b-74c5a420e371.tmp.mdmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.20203e92-8fe2-41d5-ac29-367728e13626.tmp.WERInternalMetadata.xml
WPR_initiated_DiagTrackMiniLogger_OneTrace_User_Logger_20241008_1_EC_0_inject.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f32086fd-1fc9-4212-a7c2-465e271e24ee.tmp.etl
WPR_initiated_DiagTrackMiniLogger_WPR System Collector_inject.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.74ed2b09-b61e-445f-8c8a-ff15cf1b7c16.tmp.etl
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b389a25f-72a3-4d73-853e-16c0b3f34b2a.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.61d12e62-49d2-4d5c-a5ba-7db1229c5ed1.tmp.txt
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.d45344fd-f051-4979-99f6-731764e9ed2b.tmp.xml</Data>
<Data Name=“StorePath”>\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_75a7b1a2e2a87c6ffabace606d6bd8c9b7488325_83fa2685_813c2fee-6603-4a7e-bbda-e55df3128adf</Data>
<Data Name=“AnalysisSymbol”>
</Data>
<Data Name=“Rechecking”>0</Data>
<Data Name=“ReportId”>10985112-baaa-4f53-9f4e-9f3fedf967ce</Data>
<Data Name=“ReportStatus”>268435456</Data>
<Data Name=“HashedBucket”>7b8ca4834f227c9a4c85d78d51013de7</Data>
<Data Name=“CabGuid”>0</Data>
</EventData>
</Event>

*****I was not using NPP at the time of the Windows Explorer windows crashed… but here it is:

Notepad++ v8.7.1 (32-bit)
Build time : Oct 31 2024 - 00:41:42
Path : C:\Program Files (x86)\Notepad++\notepad++.exe
Command Line : “C:\Users\mcolv\OneDrive\Desktop\WindowsCrash all windows gone\Report.wer”
Admin mode : OFF
Local Conf mode : OFF
Cloud Config : OFF
Periodic Backup : ON
OS Name : Windows 8 Pro (64-bit)
OS Version : 24H2
OS Build : 9200.2894
Current ANSI codepage : 1252
Plugins :
AnalysePlugin (1.12.47)
BigFiles (0.1.1.1)
CodeAlignmentNpp (14.1.107)
ComparePlugin (2.0.1)
GitSCM (1.4.8.2)
HexEditor (0.9.12)
LocationNavigate (0.4.7.7)
MarkdownViewerPlusPlus (0.8.2)
mimeTools (3.1)
NavigateTo (1.12.3)
NppAutoIndent (1.2)
NppCalc (1.5)
NppConverter (4.6)
NppExport (0.4)
NppTextFX (0.2.6)
NppToolBucket (1.10.6622.41336)
SourceCookifier (0.7.3)
WindowManager (1.2.2)
_CustomizeToolbar (4.2)

there is more available, ran out of the 16K char limit…
=========END OF DEBUG INFO=============

Terry R

@Mark-Colvin

There are a number of queries I have.

Your PC is called MAC-LAPTOP, so is it an Apple Mac with virtualized Windows running?
You have a very long list of plugins. Have you checked that all of them are up to date with versioning?
Again to do with plugins, there is a FAQ post that refers to plugins possibly being the cause of abnormal issues. Have a read of Notepad++ Crashes/Freezes/Unresponsive after Update. See if you can apply some of the steps there.
Although you say you weren’t running Notepad++, had it been running at any time during the current Windows session prior to the crash occuring? Possibly some remnant was left in memory causing the crash at a later stage.

Terry

Nicholas

NppShell.dll is used to put the “Edit with Notepad++” into the file explorer context menu.

Since you are using 64bit Windows I would recommend using the 64bit version of Notepad++. Try the portable version first to check all your extensions work. You will need to use the plugin admin to download the 64bit versions or manually get the correct version.

If you don’t want to change versions, then you could try using the installer to disable the “Context Menu Entry”.

Nicholas

@Mark-Colvin said in Notepad++ v8.7.1 (32-bit) NppShell.dll is intermittently crashing Windows Explorer.:

OS Name : Windows 8 Pro (64-bit)
OS Version : 24H2

This doesn’t look right. 24H2 is a Windows 11 version. There could be a bug where they are detecting the wrong version and trying to do something with the new Windows 11 context menu.

Mark Colvin

@Terry-R ,

This laptop computer is running a complete Win11 Pro OS. - MAC is named related identification.
Not recently checked plugin versioning. I will do that soon. [edit] performed plug-in updates, still crashed Explorer.
I assume that you suggested read my help with Windows Explorer random crashes when no directly using NPP?
That may be possible, but how can I tell this action is related to Explorer crashes?

Thanks.

Mark Colvin

@Nicholas
There were reasons during Win10 x64 usage of staying with NPP x32 instead of NPP x64. I don’t remember that reason at the moment. I think it had to do with another Windows apps running at the same time as NPP and there were problems. I will try to find the details on this decision.

But I will try disable the Content Menu feature on NPP to see if the Explorer crashes go away.
I can also try switching back to NPP x64 to see if I can find the reason for staying with NPP x32.

Thanks.

xomx

@Mark-Colvin

It is a buffer overflow caused somehow by the NppShell.dll in the Windows Explorer process. As a temporary workaround, you can disable this shell extension by going to your C:\Program Files (x86)\Notepad++\contextMenu\ folder and run there this command in cmd (with admin rights): regsvr32 /u NppShell.dll

This is a known problem for some users (they reported it for x64 too) but unfortunately I was not able to reproduce it, so I cannot say if it is a problem of NppShell shell extension, Notepad++ app or some other SW. It can also be a conflict with some other shell extension installed in your system (otherwise I cannot explain why most Notepad++ users do not have this problem).

If you switch to x64 Notepad++ with its x64 NppShell and you still get these Explorer crashes, you can try to follow these instructions to help me with debugging of the issue:
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/15683#issuecomment-2492113826

@Mark-Colvin said in Notepad++ v8.7.1 (32-bit) NppShell.dll is intermittently crashing Windows Explorer.:

OS Name : Windows 8 Pro (64-bit)

I am also surprised to see this info when according to your post it should be reported as Win10 or Win11.

xomx

@Mark-Colvin

Could you please report your Windows Registry relevant info:

Save the following to a file (named e.g. WinVerRegKeys-export.cmd) somewhere writable on your disk:

PowerShell "$Key='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; Get-ItemProperty -Path $Key -Name *" > WinVerRegKeys64.txt
PowerShell "$Key='HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion'; Get-ItemProperty -Path $Key -Name *" > WinVerRegKeys32.txt

Run the WinVerRegKeys-export.cmd batch file by e.g. doubleclicking on it in Explorer.
Take the contents of the created WinVerRegKeys32.txt and WinVerRegKeys64.txt files and post them please here.