Windows SFC (System File Checker) Revived Explorer

On a computer running Microsoft Windows operating system, the executable application explorer.exe is very important. It handles the start bar and is the starting point for almost every activity on the system. Its core position means if Explorer breaks for any reason, it’s very hard to do anything else on that system! Yet its complexity and wide span of responsibilities also means having wide exposure to things that go wrong. Countering this risk, Explorer has recovery measures built-in as well. If it freezes up, there’s a watchdog time to restart the process. If it should crash, there are mechanisms to relaunch it. And if the relaunch immediately leads to a problem, it relaunches with gradually decreasing capability until it finds a configuration that is stable enough for the user to go in and figure out what went wrong.

This happened to my Windows machine. Something went wrong and Explorer went into a failing loop that restarted once every 10-15 seconds. This continued for several minutes (Explorer restarting a few dozen times) until it stabilized in a very reduced configuration that was unfortunately pretty difficult to use. The Start menu is missing, but at least Window+E shortcut key still worked to open File Explorer. That allowed me to launch diagnostics tools, though I had to use my phone to search for their paths on the system so I could find them in File Explorer.

The first stop to diagnose Windows problems is the Event Viewer, which I had to launch from File Explorer by double-clicking C:\Windows\System32\eventvwr.exe. Clicking the root node in the tree “Event Viewer (Local)” will show a summary of events. My system showed over four hundred “Error” events in the past hour, an obvious place to start looking. Expanding that tree took me to a list of those hundreds of Application Error logs, here is one example:

Unfortunately, the details of this Application Error were not scaled for high DPI displays and pretty unreadable in that screenshot, so here is a copy of the text shown inside that “General” tab:

Faulting application name: explorer.exe, version: 10.0.22000.832, time stamp: 0x8947d46c
Faulting module name: wintypes.dll, version: 10.0.22000.778, time stamp: 0xb903efeb
Exception code: 0xc0000005
Fault offset: 0x0000000000022b20
Faulting process id: 0x1f44
Faulting application start time: 0x01d8b13598ecfee1
Faulting application path: C:\Windows\explorer.exe
Faulting module path: C:\Windows\SYSTEM32\wintypes.dll
Report Id: d0fb6df2-0bad-45bd-aff3-dee9c438b3d2
Faulting package full name: 
Faulting package-relative application ID: 

Looks like explorer is pointing a finger at its dependency wintypes.dll. Unfortunately, there isn’t enough data here to tell us if the problem is in wintypes itself or a dependency in turn. But at least it is a narrower scope than explorer, whose scope covers damned near everything. A search for “wintypes corrupt” found many websites advertising “Download wintypes to fix your system!” But downloading replacements for Windows system executables off the internet is a recipe for security disaster and I’m not going to do that. There were a few promising diagnostics steps, the one that was eventually successful was this Microsoft community forums thread.

The repair procedure was to first run the Deployment Image Servicing and Management tool (DISM) to ensure my system has a valid copy of the system image. Followed by running the System File Checker tool (SFC) to scan through my Windows system files. SFC will compare what’s on my system against the system image archive. If a mismatch is found, SFC will replace the corrupted file with a clean copy from the system image. These are system-level administrative tools. In order to run them, I had to launch an administrator command prompt from File Explorer. (Right click on C:\Windows\System32\cmd.exe and select “Run as administrator”)

It took several minutes for those tools to complete. After SFC reported scan and repair was complete, I rebooted my system. And this time, Windows explorer started with full functionality. Success! I went back to take a look at the log file (C:\Windows\Logs\CBS\CBS.log) and searched for mentions of “repair”. I found these two lines:

2022-08-15 23:15:56, Info                  DEPLOY [Pnp] Corrupt file: C:\Windows\System32\drivers\bthmodem.sys
2022-08-15 23:15:56, Info                  DEPLOY [Pnp] Repaired file: C:\Windows\System32\drivers\bthmodem.sys

Huh. The Bluetooth communications driver caused me all this grief? It is indeed part of my Windows system, because I’ve been playing with Microsoft Phone Link and it connects to my Android phone over Bluetooth. I didn’t think a problem with this file would bring down Explorer, but now I know it can. I also don’t know how this file got corrupted to begin with, and that might be important to know if it should happen again. For now, I’m happy my computer is back up and running.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s