Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please Help Me With This Error, Its Driving Me Crazy


  • Please log in to reply
12 replies to this topic

#1 The Punisher

The Punisher

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 08 July 2008 - 02:18 AM

I have attached the screenshot of this error.

when I click dont sent, the window closes and after this all internet activity stops, i cant browse the internet after this and I have to restart my laptop.

here is what I get when I click on detailed report.

C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\svchost.exe.mdmp
C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\appcompat.txt

Attached File  error.JPG   29.66KB   34 downloads

BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:40 AM

Posted 08 July 2008 - 07:44 AM

Use this link to perform an analysis of the file located at C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\svchost.exe.mdmp
http://forums.majorgeeks.com/showthread.php?t=35246

The article was designed for a different kind of memory dump, but it will work with this file. Copy and paste the results into your next post and we'll see what we can figure out.

If the file no longer exists, wait until the next crash and copy the file to your Desktop before clicking on "Send Error Report".
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 09 July 2008 - 03:49 PM

thx for the reply usama.

but the guide you directed me to is for a BSOD error, I do not get a BSOD error, like the screenshot I attached, I get an application error.

k but I traced it in the event viewer and here is the additional details that I get.

Faulting application svchost.exe, version 5.1.2600.2180, faulting module netapi32.dll, version 5.1.2600.2180, fault address 0x0000a3c0.




0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6e 65 74 61 70 69 n netapi
0038: 33 32 2e 64 6c 6c 20 35 32.dll 5
0040: 2e 31 2e 32 36 30 30 2e .1.2600.
0048: 32 31 38 30 20 61 74 20 2180 at
0050: 6f 66 66 73 65 74 20 30 offset 0
0058: 30 30 30 61 33 63 30 000a3c0



now can anyone please help me..

#4 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 09 July 2008 - 03:52 PM

sorry for the double post but the location of the error file does not exist. this location does not exist :

C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\svchost.exe.mdmp


I checked it right after the error occured and there is nothing in the temp directory.

I had even enabled hidden files.

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:40 AM

Posted 09 July 2008 - 07:57 PM

As I stated in my post, the memory dump article was written for a different kind of error - but the results will still show up if you run the analysis as stated in the article. The Windows Debugging Tools will analyze any kind of memory dump - either a BSOD or an application error.

As for the actual svchost.exe.mdmp file, it'll be there until you press the key to send a report to Microsoft. Once the report has been sent, it'll be deleted - so you must get it before you click on Send or Don't Send.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 10 July 2008 - 01:04 PM

Finally.

it kept giving me the same error during symbols downloads, but i finally got it done.

here it is,

now would u guys plz help me out.

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Faraz Ahmed\Desktop\crap\svchost.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Thu Jul 10 22:02:08.000 2008 (GMT+5)
System Uptime: not available
Process Uptime: 0 days 1:05:26.000
......................................................................................................................................................
Loading unloaded module list
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(48c.95c): Access violation - code c0000005 (first/second chance not available)
eax=00000001 ebx=80070000 ecx=c0000005 edx=00000000 esi=00000c88 edi=00000000
eip=7c90eb94 esp=006d984c ebp=006d98b0 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
0:061> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_IP:
msvcrt!wcscpy+e
77c47ea2 668901 mov word ptr [ecx],ax

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77c47ea2 (msvcrt!wcscpy+0x0000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 064d6000
Attempt to write to address 064d6000

DEFAULT_BUCKET_ID: STATUS_ACCESS_VIOLATION

PROCESS_NAME: svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 064d6000

FAULTING_THREAD: 0000095c

PRIMARY_PROBLEM_CLASS: STATUS_ACCESS_VIOLATION

BUGCHECK_STR: APPLICATION_FAULT_STATUS_ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 5b86a3b1 to 77c47ea2

STACK_TEXT:
006df470 5b86a3b1 064d5ca0 006df494 00000000 msvcrt!wcscpy+0xe
006df8ac 90909090 90909090 90909090 90909090 netapi32!CanonicalizePathName+0x144
WARNING: Frame IP not in any known module. Following frames may be wrong.
006df924 77ef321a 7509da52 006df938 00000007 0x90909090
006dfd3c 77ef36ee 00000000 00000000 000fc6a4 rpcrt4!NdrStubCall2+0x297
006dfd58 77e7988c 000fc6a4 0011a558 000fc6a4 rpcrt4!NdrServerCall2+0x19
006dfd8c 77e797f1 750933bb 000fc6a4 006dfe2c rpcrt4!DispatchToStubInC+0x38
006dfde0 77e7971d 0000001f 00000000 750a3f0c rpcrt4!RPC_INTERFACE::DispatchToStubWorker+0x113
006dfe04 77e81930 000fc6a4 00000000 750a3f0c rpcrt4!RPC_INTERFACE::DispatchToStub+0x84
006dfe34 77e8185d 000fc668 00000000 000fc630 rpcrt4!OSF_SCALL::DispatchHelper+0x115
006dfe48 77e817e1 00000000 0000001f 000fd6e0 rpcrt4!OSF_SCALL::DispatchRPCCall+0xfe
006dfe78 77e816ec 000fd6e0 0300031c 0000001f rpcrt4!OSF_SCALL::ProcessReceivedPDU+0x58a
006dfea0 77e7dd5e 000fd6e0 0000031c 7c809794 rpcrt4!OSF_SCALL::BeginRpcCall+0x1f4
006dff00 77e7dc99 00000000 000fd6e0 0000031c rpcrt4!OSF_SCONNECTION::ProcessReceiveComplete+0x3fb
006dff14 77e7728a 0009f6e0 0000000c 00000000 rpcrt4!ProcessConnectionServerReceivedEvent+0x21
006dff80 77e773a9 006dffa8 77e76a3b 0009f6e0 rpcrt4!LOADABLE_TRANSPORT::ProcessIOEvents+0x16f
006dff88 77e76a3b 0009f6e0 00090778 00090000 rpcrt4!ProcessIOEventsWrapper+0xd
006dffa8 77e76c0a 0009df00 006dffec 7c80b50b rpcrt4!BaseCachedThreadRoutine+0x79
006dffb4 7c80b50b 000cb230 00090778 00090000 rpcrt4!ThreadStartRoutine+0x1a
006dffec 00000000 77e76bf0 000cb230 00000000 kernel32!BaseThreadStart+0x37


FOLLOWUP_IP:
msvcrt!wcscpy+e
77c47ea2 668901 mov word ptr [ecx],ax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: msvcrt!wcscpy+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msvcrt

IMAGE_NAME: msvcrt.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 41109752

STACK_COMMAND: ~61s; .ecxr ; kb

FAILURE_BUCKET_ID: STATUS_ACCESS_VIOLATION_c0000005_msvcrt.dll!wcscpy

BUCKET_ID: APPLICATION_FAULT_STATUS_ACCESS_VIOLATION_msvcrt!wcscpy+e

Followup: MachineOwner
---------



#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:40 AM

Posted 10 July 2008 - 04:02 PM

I'm just guessing here, but there seems to be an error in accessing memory by one of your .NET applications. I'd first suggest uninstalling/reinstalling the .NET frameworks to see if that fixes it.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#8 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 11 July 2008 - 01:29 AM

thx usama.

how did u find out that its a .net issue?

i did reinstall the .net framework, has no effect.

what now?

i am also using paint.net

#9 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 11 July 2008 - 05:07 AM

k so here is what i did.

I un installed paint.net and I uninstalled Microsoft .NET framework, b ut even after that I got the error twice.

so we can say that it definitely is not .net.

what else can be causing this?

#10 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 11 July 2008 - 11:17 PM

can this be malware?

Edited by The Punisher, 11 July 2008 - 11:17 PM.


#11 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:40 AM

Posted 12 July 2008 - 07:35 AM

This: ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". was part of the reason for my guess. The other part was that it involved (at some level) mscvrt.dll I recalled a similar problem that was fixed by updating the .NET framework. I guess it wasn't similar enough tho!

This error is (it appears) caused by mscvrt.dll accessing memory at a location that doesn't exist. I'd suggest having a look at processes that are using mscvrt.dll in this free program: http://www.microsoft.com/technet/sysintern...ssExplorer.mspx Use the find window to search for things that are using that DLL file. Also, I'd suggest hovering your mouse over the svchost.exe process that's using it. That will show you what processes are running inside of the svchost.exe process (and will give us more info about where the problem may be coming from).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#12 The Punisher

The Punisher
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 12 July 2008 - 06:43 PM

thx for the reply usama.

searching for msvcrt comesup with a lot of results, it is being used a lot, I cant add the list here as I cant copy and paste it.

as for the mouse over, svchost.exe is being used 5 times here is what the mouse over gives on each one.

-DCOM server process launcher.[DCOM launch]
-Terminal services.

-Remote procedure call [RPC]

-DNS client [DNS cache]

-Remote registry.
-SSDP discovery service.
-TCP/IP netbios helper.
-webclient.





I hope you can make sense of all this.

#13 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:40 AM

Posted 13 July 2008 - 07:01 AM

Look for the mcrvt.dll that's being used by svchost.exe. In particular you're trying to isolate which one of the svchost.exe processes is causing the problem. Sometimes a Process ID (or PID) will be notated - that's one way of identifying which svchost.exe process is which.

Also, it appears that you're missing one of the svchost.exe processes. It's the one with the real long list of stuff running underneath it. It's not necessary (at this point) to post the info, but ensure that it's there. On my system it's the one that starts with:
-Automatic Updates
-Background Intelligent Transfer Service
-COM+ Event System
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users