Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svchost.exe keeps crashing on startup


  • Please log in to reply
11 replies to this topic

#1 ixcuincle

ixcuincle

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 01 October 2010 - 06:55 AM

This forum has been really helpful in diagnosing and rectifying many of my computer problems...so thanks. Yet another computer problem here.

My computer starts up, I can log in. But when I do, sometimes svchost.exe crashes. This has been happening every day for the last 3 days. The computer locks up, and I have to turn the computer off. When the computer is turned back on, I can log in successfully, and resume using the computer.

There are usually three popups that appear during this time. One is the popup informing that svchost.exe has crashed. The box reads "svchost.exe - application error". "The instruction at "0x7c9100e8" referenced memory at "0x00000010" The memory could not be "read"."

"Click on OK to terminate the program. Click on CANCEL to debug the program."

Okay freezes up the computer, and cancel closes the window and allows startup to resume, but there is no sound.

The second is a white box that informs that Generic processes has crashed.

The third is a box that claims that settings have been changed, and there is a checkbox that says "Tell Windows not to show this box again", when this box is checked it directs me to the MSconfig box.

If anyone has any suggestions or solutions, it would be appreciated, thanks.

===============================

Alright, I rebooted the computer and re-logged in. SVchost is crashing again. Now I get a dialog box "Data Execution Prevention - Microsoft Windows"

"To help protect your computer, Windows has closed this program.

Name: Generic Host Process for Win32 Services
Publisher: Microsoft Corporation"

Here are a few images of the errors.

Posted Image

I said the error used to be intermittent, but now it appears to start up every time I boot up Windows, during startup. Every time, after I press cancel, the audio appears to be corrupted, and I can't access Volume mixer or any sound.

Edited by ixcuincle, 01 October 2010 - 07:13 AM.


BC AdBot (Login to Remove)

 


#2 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:12:05 PM

Posted 01 October 2010 - 12:03 PM

SVCHOST.EXE is responsible for launching a variety of system services when you start windows. I suspect your AudioSrv service is crashing.

If you could run the attatched batch file, it will produce a report on your svchost tasks that are running and a registry dump which can be analyzed to see what services SVCHOST is trying to launch on system startup. It will open a Report.txt file. Simply save the file to your desktop and attatch it in your next post.

Thanks.

The contents of Svchost_report.bat are:
@echo off
echo Tasklist: > "%TEMP%\Report.txt"
echo. >> "%TEMP%\Report.txt"
tasklist /SVC /FI "IMAGENAME eq SVCHOST.EXE" /FO CSV >> "%TEMP%\Report.txt"
echo. >> "%TEMP%\Report.txt"

regedit /e "%TEMP%\~svchost.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost"
echo Registry: >> "%TEMP%\Report.txt"
echo. >> "%TEMP%\Report.txt"

rem convert from unicode to ascii:
type "%TEMP%\~svchost.txt" >> "%TEMP%\Report.txt"
notepad "%TEMP%\Report.txt"

del "%TEMP%\~svchost.txt"
del "%TEMP%\Report.txt"

Attached Files


Edited by Gabrial, 01 October 2010 - 12:06 PM.


#3 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:05 PM

Posted 01 October 2010 - 12:28 PM

This could also be a sign of a malware infection that is causing you grief.

#4 ixcuincle

ixcuincle
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 01 October 2010 - 04:03 PM

Tasklist:


"Image Name","PID","Services"
"svchost.exe","1696","DcomLaunch,TermService"
"svchost.exe","1780","RpcSs"
"svchost.exe","1848","AudioSrv,Browser,CryptSvc,Dhcp,dmserver,ERSvc,EventSystem,helpsvc,HidServ,lanmanserver,lanmanworkstation,Netman,Nla,RasMan,RemoteAccess,Schedule,seclogon,SENS,SharedAccess,ShellHWDetection,srservice,TapiSrv,Themes,TrkWks,W32Time,winmgmt,wscsvc,wuauserv"
"svchost.exe","1992","WudfSvc"
"svchost.exe","184","Dnscache"
"svchost.exe","248","Alerter,LmHosts"
"svchost.exe","860","WebClient"
"svchost.exe","2064","SSDPSRV"
"svchost.exe","2528","HTTPFilter"

Registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"HTTPFilter"=hex(7):48,00,54,00,54,00,50,00,46,00,69,00,6c,00,74,00,65,00,72,\
00,00,00,00,00
"LocalService"=hex(7):41,00,6c,00,65,00,72,00,74,00,65,00,72,00,00,00,57,00,65,\
00,62,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4c,00,6d,00,48,00,6f,00,\
73,00,74,00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,\
00,69,00,73,00,74,00,72,00,79,00,00,00,75,00,70,00,6e,00,70,00,68,00,6f,00,\
73,00,74,00,00,00,53,00,53,00,44,00,50,00,53,00,52,00,56,00,00,00,00,00
"NetworkService"=hex(7):44,00,6e,00,73,00,43,00,61,00,63,00,68,00,65,00,00,00,\
00,00
"netsvcs"=hex(7):36,00,74,00,6f,00,34,00,00,00,41,00,70,00,70,00,4d,00,67,00,\
6d,00,74,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,\
00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,\
53,00,76,00,63,00,00,00,44,00,4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,\
00,44,00,48,00,43,00,50,00,00,00,45,00,52,00,53,00,76,00,63,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,46,00,61,\
00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
00,69,00,74,00,79,00,00,00,48,00,69,00,64,00,53,00,65,00,72,00,76,00,00,00,\
49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,00,72,00,6d,\
00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,\
76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,57,00,6f,00,72,\
00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,4d,00,65,00,73,00,\
73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,\
00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,\
00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,\
00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,\
74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,\
00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,\
63,00,65,00,73,00,73,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,\
00,00,00,53,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,\
4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,\
00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,54,00,68,00,65,00,6d,\
00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,00,73,00,00,00,57,00,33,00,\
32,00,54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,\
00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,\
00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,73,00,63,00,73,\
00,76,00,63,00,00,00,78,00,6d,00,6c,00,70,00,72,00,6f,00,76,00,00,00,4d,00,\
48,00,4e,00,00,00,42,00,49,00,54,00,53,00,00,00,77,00,75,00,61,00,75,00,73,\
00,65,00,72,00,76,00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,\
65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,00,68,00,65,00,6c,00,70,\
00,73,00,76,00,63,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,00,\
00,00,6e,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,68,00,6b,00,6d,\
00,73,00,76,00,63,00,00,00,00,00
"DcomLaunch"=hex(7):44,00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,\
00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"imgsvc"=hex(7):53,00,74,00,69,00,53,00,76,00,63,00,00,00,00,00
"termsvcs"=hex(7):54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,\
65,00,00,00,00,00
"WudfServiceGroup"=hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,\
00
"eapsvcs"=hex(7):65,00,61,00,70,00,68,00,6f,00,73,00,74,00,00,00,00,00
"dot3svc"=hex(7):64,00,6f,00,74,00,33,00,73,00,76,00,63,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\DComLaunch]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\dot3svc]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\eapsvcs]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\HTTPFilter]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\PCHealth]
"CoInitializeSecurityParam"=dword:00000002
"AuthenticationCapabilities"=dword:00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:00000008

#5 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:12:05 PM

Posted 01 October 2010 - 09:51 PM

Thankyou, this gives me information as to how your services are grouped in svchost.exe tasks. I also need to know how your system services are configured.

Please click Start -> Run

Type "services.msc" and hit Enter.

In the Services window that pops up, click Action -> Export List...

Please save the file on your desktop. Give it the name Services.csv. Under "Save as type" select Text "(Comma Deliminated) (*.csv)"

click OK.

There should now be a Services.csv file on your desktop. Please attatch it to your next post.

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:05 AM

Posted 01 October 2010 - 10:12 PM

This could also be a sign of a malware infection that is causing you grief.

+1
"Generic Host" and "memory could not be read" are pretty typical for some infections.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#7 ixcuincle

ixcuincle
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 03 October 2010 - 05:49 AM

When I try to upload services.csv, the forum says "Upload failed. You are not permitted to upload this type of file."

#8 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:12:05 PM

Posted 03 October 2010 - 06:00 PM

rename it to services.txt and try the uplaod again.

#9 ixcuincle

ixcuincle
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 04 October 2010 - 05:57 AM

Posted txt file

Attached Files



#10 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:12:05 PM

Posted 04 October 2010 - 06:44 PM

Ok, looking at your Services configuration, you have one service set to Automatic that isn't started. That is probably the one crashing on boot.

It is this one:

IPv6 Helper Service,Provides DDNS name registration and automatic IPv6 connectivity over an IPv4 network. If this service is stopped other computers may not be able to reach it by name and the machine will only have IPv6 connectivity if it is connected to a native IPv6 network. If this service is disabled any other services that explicitly depend on this service will fail to start.,,Automatic,Local System


To tell if this is the one that is crashing, go to Start -> Accessories -> Command Prompt and open a Command Prompt window.

In the Command Prompt window type the following commands:

net stop "IPv6 Helper Service"
net start "IPv6 Helper Service"

This will stop and start the service. If it crashes again, or fails to start, we probably need to reinstall your 6to4svc.dll file which is this services execuatable.

To do this go to a command prompt again and type the following:

netsh int ipv6 uninstall

This uninstalls the service from the system. It should tell you you need to reboot. Go ahead and do so.

Upon restarting windows, from a command prompt type the following:

ren %SystemRoot%\system32\6to4svc.dll 6to4svc.dll.old

This will rename the old dll file. System File Protection should copy a new copy of the dll file from your system dllcache. Reboot the system again.

When your system restarts again type the following from a command prompt:

ipv6 install

This will reinstall your IPv6 service and start it.

Reboot the system one final time to make sure the error has gone away.

Edited by Gabrial, 04 October 2010 - 07:06 PM.


#11 ixcuincle

ixcuincle
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 05 October 2010 - 05:34 AM

Thanks for the advice.

I did as you said, and the error appears to have subsided for now. There aren't even any popups of Generic Windows crashing. Everything is smooth for now.

I will let you all know if this problem returns, but so far, everything is going great. Thanks.

#12 Gabrial

Gabrial

  • Members
  • 468 posts
  • OFFLINE
  •  
  • Local time:12:05 PM

Posted 05 October 2010 - 02:12 PM

Glad to be of help, troubleshooting SVCHOST.EXE crashes is one of the more complicated things to do in Windows. :thumbsup: Happy Computing.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users