Prev: InCDsrv.exe
Next: How to reinstall the SmartCard service on Windows XP?
From: Rully on 28 Nov 2007 08:21
Dear experts,

I hope someone here has some good advice, because I really don't know what
to do.

When booting into Windows XP Pro SP2, I get an error message: "The
instruction at "0x751d379d" referenced memory at "0xffcb8375". The memory
could not be "written". Click on OK to terminate the program. Click on CANCEL
to debug the program."

Closing the window allows me to boot fully into XP, but then I get the
infamous shut down in 60 seconds message:" the system is shutting down.
Please save all work in progress and log off. This request was initiated by
NT Authority\system. Message: Windows must restart because the RPC service
terminated unexpectedly." And then it counts down from 60 seconds, after
which it reboots.

I can stop this using the DOS prompt of course (shutdown -a), but Windows is
still behaving strange: some programs won't start or they behave abnormally,
the Windows key doesn't work, minimized windows do not appear in the taskbar,
etc.

I'm using AVG fully up-to-date (antivirus, anti spyware & anti rootkit)
software. Also, windows XP are fully updated with service pack two, latest
patch, security hotfix, etc.
From: Gerry on 28 Nov 2007 09:40

Please post copies of all Error and Warning Reports appearing in
the System and Application logs in Event Viewer for the last boot. No
Information Reports or Duplicates please. Indicate which also appear in
a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using copy
and paste. Often the link will, however, say there is no further
information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Rully wrote:
> Dear experts,
>
> I hope someone here has some good advice, because I really don't know
> what to do.
>
> When booting into Windows XP Pro SP2, I get an error message: "The
> instruction at "0x751d379d" referenced memory at "0xffcb8375". The
> memory could not be "written". Click on OK to terminate the program.
> Click on CANCEL to debug the program."
>
> Closing the window allows me to boot fully into XP, but then I get the
> infamous shut down in 60 seconds message:" the system is shutting
> down. Please save all work in progress and log off. This request was
> initiated by NT Authority\system. Message: Windows must restart
> because the RPC service terminated unexpectedly." And then it counts
> down from 60 seconds, after which it reboots.
>
> I can stop this using the DOS prompt of course (shutdown -a), but
> Windows is still behaving strange: some programs won't start or they
> behave abnormally, the Windows key doesn't work, minimized windows do
> not appear in the taskbar, etc.
>
> I'm using AVG fully up-to-date (antivirus, anti spyware & anti
> rootkit) software. Also, windows XP are fully updated with service
> pack two, latest patch, security hotfix, etc.


From: Rully on 5 Dec 2007 05:38
Ok. Here's the error:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 04/12/2007
Time: 15:16:05
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379d" referenced memory at "0xffcb8375". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and also there's no yellow marks in device manager. Oh I forgot, sometimes
the error & DCOM things doesn't show up.

I still waiting for your & others help. Thanks.

-- Rully


"Gerry" wrote:

>
> Please post copies of all Error and Warning Reports appearing in
> the System and Application logs in Event Viewer for the last boot. No
> Information Reports or Duplicates please. Indicate which also appear in
> a previous boot.
>
> You can access Event Viewer by selecting Start, Control Panel,
> Administrative Tools, and Event Viewer. When researching the meaning
> of the error, information regarding Event ID, Source and Description
> are important.
>
> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> http://support.microsoft.com/kb/308427/en-us
>
> Part of the Description of the error will include a link, which you
> should double click for further information. You can copy using copy
> and paste. Often the link will, however, say there is no further
> information.
> http://go.microsoft.com/fw.link/events.asp
> (Please note the hyperlink above is for illustration purposes only)
>
> A tip for posting copies of Error Reports! Run Event Viewer and double
> click on the error you want to copy. In the window, which appears is a
> button resembling two pages. Click the button and close Event
> Viewer.Now start your message (email) and do a paste into the body of
> the message. Make sure this is the first paste after exiting from
> Event Viewer.
>
> Are there any yellow question marks in Device Manager? Right click on
> the My Computer icon on your Desktop and select Properties,
> Hardware,Device Manager. If yes what is the Device Error code?
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~

From: Gerry on 5 Dec 2007 06:39
What are your anto-virus and anti-spyware arrangements?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Rully wrote:
> Ok. Here's the error:
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/12/2007
> Time: 15:16:05
> User: N/A
> Computer: RAN
> Description:
> Application popup: svchost.exe - Application Error : The instruction
> at "0x751d379d" referenced memory at "0xffcb8375". The memory could
> not be "written".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> and also there's no yellow marks in device manager. Oh I forgot,
> sometimes the error & DCOM things doesn't show up.
>
> I still waiting for your & others help. Thanks.
>
> -- Rully
>
>
> "Gerry" wrote:
>
>>
>> Please post copies of all Error and Warning Reports appearing in
>> the System and Application logs in Event Viewer for the last boot. No
>> Information Reports or Duplicates please. Indicate which also appear
>> in a previous boot.
>>
>> You can access Event Viewer by selecting Start, Control Panel,
>> Administrative Tools, and Event Viewer. When researching the meaning
>> of the error, information regarding Event ID, Source and Description
>> are important.
>>
>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
>> http://support.microsoft.com/kb/308427/en-us
>>
>> Part of the Description of the error will include a link, which you
>> should double click for further information. You can copy using copy
>> and paste. Often the link will, however, say there is no further
>> information.
>> http://go.microsoft.com/fw.link/events.asp
>> (Please note the hyperlink above is for illustration purposes only)
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and
>> double click on the error you want to copy. In the window, which
>> appears is a button resembling two pages. Click the button and close
>> Event Viewer.Now start your message (email) and do a paste into the
>> body of the message. Make sure this is the first paste after exiting
>> from Event Viewer.
>>
>> Are there any yellow question marks in Device Manager? Right click on
>> the My Computer icon on your Desktop and select Properties,
>> Hardware,Device Manager. If yes what is the Device Error code?
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~


From: Rully on 8 Dec 2007 02:28
Hm ... I don't know. I'm using free AVG (anti-virus, anti-spyware &
anti-rootkit).
But I don't think it's a virus or spyware things.

Argh ... error again. It's different error now. I think it's come from Yahoo
Messenger. I remove the start up registry of Yahoo Messenger from Safe Mode &
Windows run normally. By the way, how to remove Yahoo Messenger from start up
permanently?

Fiuh ...

Ok, here's the error:

1. From Event Viewer (System):

a. Login

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 06/12/2007
Time: 7:18:34
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379a" referenced memory at "0x00000000". The memory could not be
"read".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b. 60 second shut down things!

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 06/12/2007
Time: 7:25:04
User: NT AUTHORITY\SYSTEM
Computer: RAN
Description:
The process winlogon.exe has initiated the restart of RAN for the following
reason: No title for this reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the Remote Procedure Call (RPC)
service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ΓΏ...

c. reboot (same error with login)


2. From Event Viewer (Application):

a.

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 06/12/2007
Time: 7:22:31
User: N/A
Computer: RAN
Description:
The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of
d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact
Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 06/12/2007
Time: 7:24:01
User: N/A
Computer: RAN
Description:
Faulting application yahoomessenger.exe, version 8.1.0.421, faulting module
wshbth.dll, version 5.1.2600.2180, fault address 0x0000379a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 79 61 68 ure yah
0018: 6f 6f 6d 65 73 73 65 6e oomessen
0020: 67 65 72 2e 65 78 65 20 ger.exe
0028: 38 2e 31 2e 30 2e 34 32 8.1.0.42
0030: 31 20 69 6e 20 77 73 68 1 in wsh
0038: 62 74 68 2e 64 6c 6c 20 bth.dll
0040: 35 2e 31 2e 32 36 30 30 5.1.2600
0048: 2e 32 31 38 30 20 61 74 .2180 at
0050: 20 6f 66 66 73 65 74 20 offset
0058: 30 30 30 30 33 37 39 61 0000379a
0060: 0d 0a ..

"Gerry" wrote:

> What are your anto-virus and anti-spyware arrangements?
 |  Next  |  Last
Pages: 1 2
Prev: InCDsrv.exe
Next: How to reinstall the SmartCard service on Windows XP?