Why does svchost.exe keep crashing?!

[MDesigner]

Man, sometimes I hate Windows...

Almost every time I boot up, I get the usual WinXP style crash dialog where it says "Send Error Report" or "Don't Send". The details:

Generic Host Process for Win32 Services encountered a problem and needed to close.

szAppName : svchost.exe szAppVer : 0.0.0.0 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

What the HELL? This is a fresh install of WinXP, SP2.

Anyone have any ideas? I'd REALLY appreciate some info on this..

 

[oog]

i've started to see this as well. i think it happened around the time i upgraded to the new kerio personal firewall beta. do you have that installed?

 

[MDesigner]

Nope. No firewall software.

 

[MrChad]

Is there ANY third party software installed that runs as a service? svchost.exe is used by many services, not just Microsoft ones (AFAIK).

 

[MDesigner]

Well sure, there are a lot of services.. a lot of them 3rd party. It's hard to narrow it down though... but if I had to take a wild guess, I'd say Bitdefender is the culprit. I'll try disabling the service for a week or so and see what happens.

 

[oog]

we could try to each list the 3rd party services that we have on machines where this problem occurs. if it is because of a 3rd party service, we may find that we all have it in common.

here are the 3rd party services marked as "Automatic" startup:

• 
  AVG7 Alert Manager Server
  AVG7 Update Service
  Kerio Personal Firewall 4
  NVIDIA Display Driver Service
  SymWMI Service

 

[MDesigner]

NVIDIA Display Driver Service

I also noticed in my device manager, I have a "Multimedia Audio Device" that's got a question mark next to it. But my sound card works fine and is listed under the soundcards/multimedia area. Very odd.

 

[oog]

i guess we both have the NVIDIA Display Driver Service. that doesn't seem like it should be causing trouble because i doubt this has been modified any time recently. my problems only came up about a week or two ago.

i don't think it's related to your Multimedia Audio Device in the device manager. I don't think svchost is used there.

 

[kylef]

You probably have several svchost.exe containers running on your system, so the goal here is to narrow down WHICH one is experiencing the problems. Then figure out what services run inside that container.

Use "tasklist -svc" to see what services are running in what processes.

Look before and after you see the crash. See which services are gone.

That should help narrow down the culprit service.

 

[oog]

Thanks for the tip. The crash doesn't happen every time, but here are the services running under svchost.exe right now (I did not get a crash this time): DcomLaunch, TermService, RpcSs, AudioSrv, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, helpsvc, HidServ, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, srservice, TapiSrv, Themes, TrkWks, W32Time, winmgmt, wuauserv, WZCSVC, Dnscache, Alerter, LmHosts, RemoteRegistry, SSDPSRV, WebClient

 

[JackMDS]

This program tells you what is currently running (and even let you temporarily kill it).

Link to: Process Explorer.

:sun:

 

[kylef]

Originally posted by: JackMDS
This program tells you what is currently running (and even let you temporarily kill it).

Link to: Process Explorer.

:sun:

I agree with JackMDS: Process Explorer is a wonderful tool. You can diagnose just about any weird system behavior with that and WinDBG if you thoroughly understand how Windows works.

But tasklist is built-in to XP and happens to list services by process, which is why I mentioned it first.

 

[oog]

process explorer is a decent tool, but i'm not sure how it helps with a problem that occurs on boot. is there a way i should be using it to determine what is failing when i boot?

 

[JackMDS]

Originally posted by: oog
we could try to each list the 3rd party services that we have on machines where this problem occurs. if it is because of a 3rd party service, we may find that we all have it in common.

Process Explorer would not intercept boot, but neither is you suggestion.

However while Windows is actually running, Process Explorer is very good in giving you info. about what is running where it comes from, and what would happened if you Kill some thing.

Link to: Example of Processes Runing on a Computer.

:sun:

 

[oog]

Originally posted by: JackMDS

Originally posted by: oog
we could try to each list the 3rd party services that we have on machines where this problem occurs. if it is because of a 3rd party service, we may find that we all have it in common.

Process Explorer would not intercept boot, but neither is you suggestion.

However while Windows is actually running, Process Explorer is very good in giving you info. about what is running where it comes from, and what would happened if you Kill some thing.

Link to: Example of Proccesses Runing on a Computer.

:sun:

Yep. You're right. I was just trying to find a good way of determining which service may be causing a problem. I guess process explorer would be a good tool to use to determine what might be hosted within svchost.exe. My suggestion was to list the services that start automatically because one of them is likely the one that is failing while booting.

Either way, we need to find what is in common among the machines encountering this problem. The next time I see the problem, I'll dump what svchost is hosting and see if it differs from what I find when I don't get the same crash.

 

[JackMDS]

In Process Explorer, point to a svchost process, click on properties, choose the Services tab.

It will tell you which Services are associated with the specific svchost process.

:sun:

 

[MDesigner]

I did "tasklist -svc" right after the svchost crash.. and upon a clean boot that had no issues, I did another tasklist -svc..and compared the results. No items were missing from the list dumped after the crash.

No idea...