Prev: Sudden Shutdown of XP Home
Next: Help!! I am stuck in the reboot loop.
From: Carlos on 15 Feb 2005 08:39
Malke - are you still here?

Well, I tried someting I saw in another forum to no avail - that is,
disabling DEP for svchost. Didn't fix it.

Here are some of the errors from the event viewer that occur durig the
Windows boot - about the same time this error comes up - I've been getting
two errors - one is a svchost about a memory that could not be "read", the
other is the Generic Host Process for Win32 Services has encountered a
Problem and Needs to Close. It includes this:
szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
szModVer : 5.1.2600.2180 offset : 000105f8

From the event viewer at the time in reboot the errors occur, some examples
(all seem to be the Service Control Manager):

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 2/15/2005
Time: 7:07:38 AM
User: N/A
Computer: DBZXXZ11
Description:
The Application Management service terminated with the following error:
The specified module could not be found.

Description:
The Human Interface Device Access service terminated with the following
error:
The specified module could not be found.

Description:
Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA)
service to connect.

Description:
The Windows Image Acquisition (WIA) service failed to start due to the
following error:
The service did not respond to the start or control request in a timely
fashion.

Description:
The Routing and Remote Access service terminated with service-specific error
2147483720 (0x80000048).

Description:
The IPv6 Helper Service service terminated unexpectedly. It has done this 1
time(s).

Description:
The Windows Audio service terminated unexpectedly. It has done this 1
time(s).

Description:
The Background Intelligent Transfer Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken
in 60000 milliseconds: Restart the service.

Description:
The Computer Browser service terminated unexpectedly. It has done this 1
time(s).

Description:
The Cryptographic Services service terminated unexpectedly. It has done
this 1 time(s).

Description:
The Automatic Updates service terminated unexpectedly. It has done this 1
time(s).

There are at least a dozen or so more of these in the event viewer sys log,
and this in the application log:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 30 35 66 38 05f8

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.















> http://support.microsoft.com/?kbid=314056
>
> Carlos, you haven't given us enough information about your system to
> troubleshoot in more detail. What changed between the time things
> worked and the time they didn't? What makes you think "something is
> trying to communicate..."? Do you have a firewall installed? If so,
> what do the logs say?
>
> You can also do some clean boot troubleshooting:
>
> http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
> Clean Boot in Windows XP
>
> Give us some information about your physical system. There is always the
> possibility that this is not a software issue, but there is no way to
> tell from your two posts so far.
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"


From: Ellie on 15 Feb 2005 09:57
HI Carlos, I'm new on this thread...but I have the same problem you do. I
have a new notebook, and have had this problem almost since the beginning. I
didn't note
exactly when it started (dumb, I know!) but it was in the same session when
I installed Norton. This morning I booted up and didn't get the error until
I noticed that the Norton icon in the tray had "Auto Protect Disabled". When
I enabled it, the SVCHOST.EXE Application Error showed up.

"Carlos" wrote:

> Malke - are you still here?
>
> Well, I tried someting I saw in another forum to no avail - that is,
> disabling DEP for svchost. Didn't fix it.
>
> Here are some of the errors from the event viewer that occur durig the
> Windows boot - about the same time this error comes up - I've been getting
> two errors - one is a svchost about a memory that could not be "read", the
> other is the Generic Host Process for Win32 Services has encountered a
> Problem and Needs to Close. It includes this:
> szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
> szModVer : 5.1.2600.2180 offset : 000105f8
>
> From the event viewer at the time in reboot the errors occur, some examples
> (all seem to be the Service Control Manager):
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7023
> Date: 2/15/2005
> Time: 7:07:38 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> The Application Management service terminated with the following error:
> The specified module could not be found.
>
> Description:
> The Human Interface Device Access service terminated with the following
> error:
> The specified module could not be found.
>
> Description:
> Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA)
> service to connect.
>
> Description:
> The Windows Image Acquisition (WIA) service failed to start due to the
> following error:
> The service did not respond to the start or control request in a timely
> fashion.
>
> Description:
> The Routing and Remote Access service terminated with service-specific error
> 2147483720 (0x80000048).
>
> Description:
> The IPv6 Helper Service service terminated unexpectedly. It has done this 1
> time(s).
>
> Description:
> The Windows Audio service terminated unexpectedly. It has done this 1
> time(s).
>
> Description:
> The Background Intelligent Transfer Service service terminated unexpectedly.
> It has done this 1 time(s). The following corrective action will be taken
> in 60000 milliseconds: Restart the service.
>
> Description:
> The Computer Browser service terminated unexpectedly. It has done this 1
> time(s).
>
> Description:
> The Cryptographic Services service terminated unexpectedly. It has done
> this 1 time(s).
>
> Description:
> The Automatic Updates service terminated unexpectedly. It has done this 1
> time(s).
>
> There are at least a dozen or so more of these in the event viewer sys log,
> and this in the application log:
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 2/15/2005
> Time: 7:07:07 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> Faulting application svchost.exe, version 5.1.2600.2180, faulting module
> ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 32 31 38 30 20 69 0.2180 i
> 0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
> 0040: 32 36 30 30 2e 32 31 38 2600.218
> 0048: 30 20 61 74 20 6f 66 66 0 at off
> 0050: 73 65 74 20 30 30 30 31 set 0001
> 0058: 30 35 66 38 05f8
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 2/15/2005
> Time: 7:07:07 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> Faulting application svchost.exe, version 5.1.2600.2180, faulting module
> ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> > http://support.microsoft.com/?kbid=314056
> >
> > Carlos, you haven't given us enough information about your system to
> > troubleshoot in more detail. What changed between the time things
> > worked and the time they didn't? What makes you think "something is
> > trying to communicate..."? Do you have a firewall installed? If so,
> > what do the logs say?
> >
> > You can also do some clean boot troubleshooting:
> >
> > http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
> > Clean Boot in Windows XP
> >
> > Give us some information about your physical system. There is always the
> > possibility that this is not a software issue, but there is no way to
> > tell from your two posts so far.
> >
> > Malke
> > --
> > MS MVP - Windows Shell/User
> > Elephant Boy Computers
> > www.elephantboycomputers.com
> > "Don't Panic!"
>
>
>
From: Malke on 15 Feb 2005 11:23
Carlos wrote:

> Malke - are you still here?

Yes, I'm still here. See my comments after your post. Even though it's
lengthy, I didn't want to snip any of your post because the details are
important.
>
> Well, I tried someting I saw in another forum to no avail - that is,
> disabling DEP for svchost. Didn't fix it.
>
> Here are some of the errors from the event viewer that occur durig the
> Windows boot - about the same time this error comes up - I've been
> getting two errors - one is a svchost about a memory that could not be
> "read", the other is the Generic Host Process for Win32 Services has
> encountered a Problem and Needs to Close. It includes this:
> szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
> szModVer : 5.1.2600.2180 offset : 000105f8
>
> From the event viewer at the time in reboot the errors occur, some
> examples (all seem to be the Service Control Manager):
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7023
> Date: 2/15/2005
> Time: 7:07:38 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> The Application Management service terminated with the following
> error: The specified module could not be found.
>
> Description:
> The Human Interface Device Access service terminated with the
> following error:
> The specified module could not be found.
>
> Description:
> Timeout (30000 milliseconds) waiting for the Windows Image Acquisition
> (WIA) service to connect.
>
> Description:
> The Windows Image Acquisition (WIA) service failed to start due to the
> following error:
> The service did not respond to the start or control request in a
> timely fashion.
>
> Description:
> The Routing and Remote Access service terminated with service-specific
> error 2147483720 (0x80000048).
>
> Description:
> The IPv6 Helper Service service terminated unexpectedly. It has done
> this 1 time(s).
>
> Description:
> The Windows Audio service terminated unexpectedly. It has done this 1
> time(s).
>
> Description:
> The Background Intelligent Transfer Service service terminated
> unexpectedly.
> It has done this 1 time(s). The following corrective action will be
> taken in 60000 milliseconds: Restart the service.
>
> Description:
> The Computer Browser service terminated unexpectedly. It has done
> this 1 time(s).
>
> Description:
> The Cryptographic Services service terminated unexpectedly. It has
> done this 1 time(s).
>
> Description:
> The Automatic Updates service terminated unexpectedly. It has done
> this 1 time(s).
>
> There are at least a dozen or so more of these in the event viewer
> sys log,
> and this in the application log:
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 2/15/2005
> Time: 7:07:07 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> Faulting application svchost.exe, version 5.1.2600.2180, faulting
> module ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 32 31 38 30 20 69 0.2180 i
> 0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
> 0040: 32 36 30 30 2e 32 31 38 2600.218
> 0048: 30 20 61 74 20 6f 66 66 0 at off
> 0050: 73 65 74 20 30 30 30 31 set 0001
> 0058: 30 35 66 38 05f8
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 2/15/2005
> Time: 7:07:07 AM
> User: N/A
> Computer: DBZXXZ11
> Description:
> Faulting application svchost.exe, version 5.1.2600.2180, faulting
> module ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>

You have a huge amount of services failing. You didn't mention anything
about your physical computer - the hardware, age, if this just started
happening, and if you can pinpoint when things changed.

You've already done all the virus scanning, and it doesn't sound to me
like that's the issue anyway. It sounds more to me like you are having
some real hardware failures. I'll give you the general hardware
troubleshooting steps; if you need more details about any of them, let
me know.

1) Open the computer and run it open, cleaning out all dust bunnies and
observing all fans (overheating will cause system freezing). Obviously
you can't do this with a laptop, but you can hear if the fan is running
and feel if the laptop is getting too hot.

2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
have to get the program from a working machine. You will either
download the precompiled Windows binary to make a bootable floppy or
the .iso to make a bootable cd. If you want to use the latter, you'll
need to have third-party burning software on the machine where you
download the file - XP's built-in burning capability won't do the job.
In either case, boot with the media you made. The test will run
immediately. Let the test run for an extended period of time - unless
errors are seen immediately. If you get any errors, replace the RAM.

3) Test the hard drive with a diagnostic utility from the mftr. Usually
you will download the file and make a bootable floppy with it. Boot
with the media and do a thorough test. If the drive has physical
errors, replace it.

4) The power supply may be going bad or be inadequate for the devices
you have in the system - this isn't applicable to a laptop, of course.
I don't think this is your issue, but I'm leaving it in to be thorough.

5) Test the motherboard with something like TuffTest from
www.tufftest.com. Sometimes this is useful, and sometimes it isn't.

Testing hardware failures often involves swapping out suspected parts
with known-good parts. If you can't do the testing yourself and/or are
uncomfortable opening your computer, take the machine to a good local
computer repair shop (not a CompUSA or Best Buy type of store).

Good luck, and let me know if you need more help.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
From: Carlos on 15 Feb 2005 18:36
My responses after your numbered points.

"Malke" <malke(a)nospoonnotreally.com> wrote in message
news:%23TFs1q3EFHA.228(a)TK2MSFTNGP15.phx.gbl...>> Malke - are you still here?
>
> Yes, I'm still here. See my comments after your post. Even though it's
> lengthy, I didn't want to snip any of your post because the details are
> important.

<snip>
> You have a huge amount of services failing. You didn't mention anything
> about your physical computer - the hardware, age, if this just started
> happening, and if you can pinpoint when things changed.
>
> You've already done all the virus scanning, and it doesn't sound to me
> like that's the issue anyway. It sounds more to me like you are having
> some real hardware failures. I'll give you the general hardware
> troubleshooting steps; if you need more details about any of them, let
> me know.
>
> 1) Open the computer and run it open, cleaning out all dust bunnies and
> observing all fans (overheating will cause system freezing). Obviously
> you can't do this with a laptop, but you can hear if the fan is running
> and feel if the laptop is getting too hot.

Done last week to no avail.

> 2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
> have to get the program from a working machine. You will either
> download the precompiled Windows binary to make a bootable floppy or
> the .iso to make a bootable cd. If you want to use the latter, you'll
> need to have third-party burning software on the machine where you
> download the file - XP's built-in burning capability won't do the job.
> In either case, boot with the media you made. The test will run
> immediately. Let the test run for an extended period of time - unless
> errors are seen immediately. If you get any errors, replace the RAM.

Ran memtest a few dozen times AND replaced the RAM to no avail last week.
skip to the bottom...

> 3) Test the hard drive with a diagnostic utility from the mftr. Usually
> you will download the file and make a bootable floppy with it. Boot
> with the media and do a thorough test. If the drive has physical
> errors, replace it.
>
> 4) The power supply may be going bad or be inadequate for the devices
> you have in the system - this isn't applicable to a laptop, of course.
> I don't think this is your issue, but I'm leaving it in to be thorough.
>
> 5) Test the motherboard with something like TuffTest from
> www.tufftest.com. Sometimes this is useful, and sometimes it isn't.
>
> Testing hardware failures often involves swapping out suspected parts
> with known-good parts. If you can't do the testing yourself and/or are
> uncomfortable opening your computer, take the machine to a good local
> computer repair shop (not a CompUSA or Best Buy type of store).
>
> Good luck, and let me know if you need more help.
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"


I'm no expert, however, having read about this same story all over the web,
I do not think it is hardware - more like NAV or something interfering with
the svchost. I'm going to try to uninstall my NAV and install a later
version.


From: Carlos on 15 Feb 2005 18:36
Same here Ellie - I'm starting to think this is more and more Norton. What
version do you have? I have Norton Anti Virus Corporate Edition version
7.61.928.
I think the real time protection is shutting out the svchosts.


"Ellie" <Ellie(a)discussions.microsoft.com> wrote in message
news:96736F2A-1A1D-413F-B0C3-074FB39CD61D(a)microsoft.com...
> HI Carlos, I'm new on this thread...but I have the same problem you do.
> I
> have a new notebook, and have had this problem almost since the beginning.
> I
> didn't note
> exactly when it started (dumb, I know!) but it was in the same session
> when
> I installed Norton. This morning I booted up and didn't get the error
> until
> I noticed that the Norton icon in the tray had "Auto Protect Disabled".
> When
> I enabled it, the SVCHOST.EXE Application Error showed up.
>
> "Carlos" wrote:
>
>> Malke - are you still here?
>>
>> Well, I tried someting I saw in another forum to no avail - that is,
>> disabling DEP for svchost. Didn't fix it.
>>
>> Here are some of the errors from the event viewer that occur durig the
>> Windows boot - about the same time this error comes up - I've been
>> getting
>> two errors - one is a svchost about a memory that could not be "read",
>> the
>> other is the Generic Host Process for Win32 Services has encountered a
>> Problem and Needs to Close. It includes this:
>> szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
>> szModVer : 5.1.2600.2180 offset : 000105f8
>>
>> From the event viewer at the time in reboot the errors occur, some
>> examples
>> (all seem to be the Service Control Manager):
>>
>> Event Type: Error
>> Event Source: Service Control Manager
>> Event Category: None
>> Event ID: 7023
>> Date: 2/15/2005
>> Time: 7:07:38 AM
>> User: N/A
>> Computer: DBZXXZ11
>> Description:
>> The Application Management service terminated with the following error:
>> The specified module could not be found.
>>
>> Description:
>> The Human Interface Device Access service terminated with the following
>> error:
>> The specified module could not be found.
>>
>> Description:
>> Timeout (30000 milliseconds) waiting for the Windows Image Acquisition
>> (WIA)
>> service to connect.
>>
>> Description:
>> The Windows Image Acquisition (WIA) service failed to start due to the
>> following error:
>> The service did not respond to the start or control request in a timely
>> fashion.
>>
>> Description:
>> The Routing and Remote Access service terminated with service-specific
>> error
>> 2147483720 (0x80000048).
>>
>> Description:
>> The IPv6 Helper Service service terminated unexpectedly. It has done
>> this 1
>> time(s).
>>
>> Description:
>> The Windows Audio service terminated unexpectedly. It has done this 1
>> time(s).
>>
>> Description:
>> The Background Intelligent Transfer Service service terminated
>> unexpectedly.
>> It has done this 1 time(s). The following corrective action will be
>> taken
>> in 60000 milliseconds: Restart the service.
>>
>> Description:
>> The Computer Browser service terminated unexpectedly. It has done this 1
>> time(s).
>>
>> Description:
>> The Cryptographic Services service terminated unexpectedly. It has done
>> this 1 time(s).
>>
>> Description:
>> The Automatic Updates service terminated unexpectedly. It has done this
>> 1
>> time(s).
>>
>> There are at least a dozen or so more of these in the event viewer sys
>> log,
>> and this in the application log:
>>
>> Event Type: Error
>> Event Source: Application Error
>> Event Category: (100)
>> Event ID: 1000
>> Date: 2/15/2005
>> Time: 7:07:07 AM
>> User: N/A
>> Computer: DBZXXZ11
>> Description:
>> Faulting application svchost.exe, version 5.1.2600.2180, faulting module
>> ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>> 0010: 75 72 65 20 20 73 76 63 ure svc
>> 0018: 68 6f 73 74 2e 65 78 65 host.exe
>> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
>> 0028: 30 2e 32 31 38 30 20 69 0.2180 i
>> 0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
>> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
>> 0040: 32 36 30 30 2e 32 31 38 2600.218
>> 0048: 30 20 61 74 20 6f 66 66 0 at off
>> 0050: 73 65 74 20 30 30 30 31 set 0001
>> 0058: 30 35 66 38 05f8
>>
>> Event Type: Error
>> Event Source: Application Error
>> Event Category: (100)
>> Event ID: 1000
>> Date: 2/15/2005
>> Time: 7:07:07 AM
>> User: N/A
>> Computer: DBZXXZ11
>> Description:
>> Faulting application svchost.exe, version 5.1.2600.2180, faulting module
>> ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> > http://support.microsoft.com/?kbid=314056
>> >
>> > Carlos, you haven't given us enough information about your system to
>> > troubleshoot in more detail. What changed between the time things
>> > worked and the time they didn't? What makes you think "something is
>> > trying to communicate..."? Do you have a firewall installed? If so,
>> > what do the logs say?
>> >
>> > You can also do some clean boot troubleshooting:
>> >
>> > http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform
>> > a
>> > Clean Boot in Windows XP
>> >
>> > Give us some information about your physical system. There is always
>> > the
>> > possibility that this is not a software issue, but there is no way to
>> > tell from your two posts so far.
>> >
>> > Malke
>> > --
>> > MS MVP - Windows Shell/User
>> > Elephant Boy Computers
>> > www.elephantboycomputers.com
>> > "Don't Panic!"
>>
>>
>>


 |  Next  |  Last
Pages: 1 2
Prev: Sudden Shutdown of XP Home
Next: Help!! I am stuck in the reboot loop.