For IE Crashes and Hangs, the first thing to do is disable Add-Ons.
On IE6, you use inetcpl.cpl, Manage Add-Ons from the Program Tab and disable all Add-Ons one by one.
On IE7, you can use the iexplore -extoff mode or go to Program Files – Accessories – System – Internet Explore – No Add-Ons.
Try and repro the issue after disabling the add-ons. If it is reproducible, install the latest cumulative update for IE which can be found in the Microsoft Knowledge Base, http://support.microsoft.com
Most times installing the GDR version is sufficient but at times it is also good to test with the QFE version. To this you have to the following:
This command installs the SP2QFE version of the Windows XP files.
Windows Server 2003
This command installs the RTMQFE version of the Windows Server 2003 files.
Windows Server 2003 Service Pack 1
This command installs the SP1QFE version of the Windows Server 2003 files.
Windows Server 2003 Service Pack 2
The above is explained in http://support.microsoft.com/kb/897225
For more details on GDR and QFE please visit
Try and repro the issue after installing the latest cumulative update. If you can repro the issue after that you need to get a dump.
The kind of dump depends on whether it is a crash or a hang.
The best tool for gathering a dump is ADPlus. We can also Userdump or DrWtsn32.
For ADPlus, you will need to install the debugging tools, which you can get it from
Once you install the debugging tools, please gather the dump for a hang or a crash with the following command:
ADPlus -hang -p 1896
This command runs ADPlus in hang mode and produces a full memory dump file of a process that has the PID 1896.
ADPlus -hang -pn myapp.exe
This command runs ADPlus in hang mode and produces full memory dump files of all processes that are named Myapp.exe.
ADPlus -crash -p 1896
This command runs ADPlus in crash mode for a process that has the PID 1896. ADPlus waits for an exception to occur, or for a user to press CTRL+C in the minimized debugger window, to generate a memory dump file and to detach the debugger.
ADPlus -crash -pn myapp.exe
This command runs ADPlus in crash mode for the process named Myapp.exe. ADPlus waits for an exception to occur, or for a user to press CTRL+C in the minimized debugger window, to generate a memory dump file and to detach the debugger.
You can also use the -sc switch with the adplus command to spawn an application. This is particularly useful when IE crashes on startup.
Usage of Adplus is documented at http://support.microsoft.com/kb/286350
Once you have dump, there are some basics you can do before getting help from an expert.
First start Windbg from the folder you installed the debugging tools.
The next step is to configure a symbol server. For this go to File -Symbol Server Path.
You will get a dialog box, configure it to srv*http://msdl.microsoft.com/download/symbols
The next thing to do is open the crash or hang dump. You can either drag and drop the .dmp file which you gathered using the adplus command or open it through file -open crash dump.
Once you load the dump, run the !analyze -v command. Wait for the command to complete and then look at the stack, see for any NON-Microsoftmodules and/or
look at the faulting instruction and module.
If you find one on the stack then use the lmvm <module name> command to find the details of the file.
Check for an update for that file on the vendor site. Update the file if there is an update.
Try reproducing the issue. If still reproducible then get rid of that Non-Microsoft file by either uninstalling the app that owns the file or by renaming the file.
Try reproducing the issue. If you can still reproduce the issue, repeat the process and get another dump and till you reach a situation where you get a only Microsoft Modules on the stack.
Once you reach this situation, you may need the assistance of a Microsoft Support Engineer. The Engineer will be able to look at the faulting stack and see if there is a fix already available or reproduce the issue to try and see if Microsoft can provide a fix or a work around.
You may also want to search Microsoft Knowledge Base for any known issues with the faulting instruction or module.
You may also want to test with Safe Mode with Networking to see if the issue is caused by a driver.
For Hangs, you need to load the dump as mentioned before. Since we don’t have a crash and we are inspecting a hang dump, i.e a snapshot of the process in memory at the time of hang to find out what the process is doing we should run the following commands.
!runway – this will tell us if any thread in that process has run for a long time. If we do find a thread that has run for a long time then we need to find what that thread is doing. We do that by running
~<thread ID>, where thread id is the id of the thread we want to investigate from the !runway output.
Once we get into that thread’s context, we need to find the stack of that thread. We do this by running
kvn 100, once we get the stack, look at the stack and check for the usual culprits. Third party modules and try and fix them as we did in a crash dump.
At times you will find hang dumps where you will see all the threads are behaving. In that case, we dump out the stacks of all the threads. This we do by running
~*kvn 100, once you get all the stacks, do a quick run down and see if we have the usual third party modules on the stack and try fixing them.
There are times that you will find nothing wrong at all. All threads are behaving. No third parties on the stack and you will find most of the threads waiting on an user input or some other stuff.
In those cases we might need to take a complete memory dump because it might be something in the kernel or another process that is causing IE to hang.
If that is the case it will help having an expert from Microsoft to look at the case!