Help - Search - Members - Calendar
Full Version: Strange problem
MSFN Forums > Microsoft Software Products - Discussion & Support > Windows Vista

   
Google Internet Forums Unattended CD/DVD Guide
enterman
mk I keep getting these weird errors in vista ive nvr seen b4. They only come up once unless I reboot my comp. They come up at random times (sometimes 20min sometimes 6hours). This is what happens, 1st this 1 comes up (c Error 1) after clicking close the following comes up (c Error 2) when I click no after about 10 - 30 seconds windows will switch the theme to windows standard and if I go to change it back to Aero the list with themes has no aero in it or Vista Basic, just standard and below. The only way to get the comp back to normal is to restart it. Anyone ever seen this b4?

Error 1: Error 2:
cluberti
It sounds like the network services svchost.exe process is failing, and the Themes service (which runs in that svchost.exe process) is not restarting properly. When the problem occurs, and you're unable to run in Aero, can you chech to see if the Themes service is running or not?
enterman
QUOTE (cluberti @ Sep 9 2007, 03:08 AM) *
It sounds like the network services svchost.exe process is failing, and the Themes service (which runs in that svchost.exe process) is not restarting properly. When the problem occurs, and you're unable to run in Aero, can you chech to see if the Themes service is running or not?

wo, u were right. When it happened I opened task manager and sure enough the theme service was stopped. I started it again and aero came right back on but non the less this is still an annoying issue. Any idea on how to fix this issue?
cluberti
QUOTE (enterman @ Sep 9 2007, 08:11 PM) *
wo, u were right. When it happened I opened task manager and sure enough the theme service was stopped. I started it again and aero came right back on but non the less this is still an annoying issue. Any idea on how to fix this issue?

Hard to say for sure yet, but let's get one thing fixed at a time smile.gif. If it's not the themes service that's crashing the svchost.exe process, we can move it out temporarily to keep aero from dying on you by making a quick registry modification and a file copy:

1. In Windows Explorer, go to C:\Windows\system32\ and right-click the "svchost.exe" file there, and select "copy". Now, right-click an empty area somewhere else inside the C:\Windows\system32 folder and select "paste" to create a file called "copy of svchost.exe" - rename this file "svchost_themes.exe" (without the quotes, obviously).

2. In the registry, browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes, and double-click on the "ImagePath" value in the right-hand pane. Modify the current value (which should be "%SystemRoot%\System32\svchost.exe -k netsvcs") so that it reads "%SystemRoot%\System32\svchost_themes.exe -k netsvcs", and click "OK".

3. Reboot - this will move the "Themes" service into it's own svchost.exe process (now called svchost_themes.exe), so that if the svchost.exe process that keeps crashing does crash again, it won't take the Themes service down with it.

4. Now, download and install the debugging tools for windows, and install them to C:\Debuggers (take all other default options, just change the install path).

5. Create the directory C:\adplus.

6. Open a command prompt, and type the following command:
cscript adplus.vbs -crash -pn svchost.exe -quiet -o c:\adplus

This should attach the cdb.exe debugger to the svchost.exe process(es) running on your machine, and the next time one crashes, it should create data in C:\adplus that can be analyzed to see why the svchost.exe process is crashing.
enterman
I did what u said and everything worked out fine except for #6. I opened a command prompt, pasted "cscript adplus.vbs -crash -pn svchost.exe -quiet -o c:\adplus" (without the quotes) and I was greeted with a error which said: Input Error: Can not find script file "C:\Users\enterman\adplus.vbs". thx 4 ur help so far btw

EDIT: Just now a new error randomly came up, i didnt have time to take a screen of it but it said something like "IP Helper has closed" then the old host process error came up again but when I closed it this time aero stayed on (ty for that smile.gif ).
cluberti
QUOTE (enterman @ Sep 10 2007, 01:28 AM) *
EDIT: Just now a new error randomly came up, i didnt have time to take a screen of it but it said something like "IP Helper has closed" then the old host process error came up again but when I closed it this time aero stayed on (ty for that smile.gif ).

Try this command:
cscript C:\debuggers\adplus.vbs -crash -pn svchost.exe -quiet -o C:\adplus (reboot before doing this, just to be safe).
enterman
QUOTE (cluberti @ Sep 10 2007, 07:44 AM) *
QUOTE (enterman @ Sep 10 2007, 01:28 AM) *
EDIT: Just now a new error randomly came up, i didnt have time to take a screen of it but it said something like "IP Helper has closed" then the old host process error came up again but when I closed it this time aero stayed on (ty for that smile.gif ).

Try this command:
cscript C:\debuggers\adplus.vbs -crash -pn svchost.exe -quiet -o C:\adplus (reboot before doing this, just to be safe).

alright that worked, ill report back when I have the chrash info thx
enterman
i uploaded everything that was added into the adplus folder after several crashes here: http://www.megaupload.com/?d=030OXSQZ
cluberti
Well, no dumps were created, only log files. Also, all the log files match up with running svchost.exe processes in the Process List file, so this captured no crashes. Can you try again and see if it generates any .dmp files next time? You may have to reboot and run the adplus command again.
enterman
sry ive taken so long 2 get back 2 u. Ive uped the dump file here: http://www.megaupload.com/?d=G92IT9ME
enterman
QUOTE (enterman @ Sep 15 2007, 03:27 AM) *
sry ive taken so long 2 get back 2 u. Ive uped the dump file here: http://www.megaupload.com/?d=G92IT9ME

anyone?
cluberti
Looks like it could be nvappfilter.dll (Nvidia network access manager) causing heap corruption (svchost crashes due to a debug breakpoint on a heapfree call on a heap that nvappfilter just wrote to, causing a status c0000374 - "STATUS_HEAP_CORRUPTION"):

CODE
0:047> .ecxr
eax=00000000 ebx=00000000 ecx=777b14cd edx=03e0f99d esi=01c50000 edi=01c59ec4
eip=777d2ea8 esp=03e0fbec ebp=03e0fc68 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
ntdll!DbgBreakPoint:
777d2ea8 cc              int     3

0:047> kb
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  Args to Child              
03e0fbe8 7783f19c 03e02d22 01c59ec4 01c50000 ntdll!DbgBreakPoint
03e0fc68 7783fcef c0000374 7785cf50 03e0fcac ntdll!RtlReportCriticalFailure+0x2e
03e0fc78 7783fddd 00000002 03e02de6 00000000 ntdll!RtlpReportHeapFailure+0x21
03e0fcac 77802c89 00000009 01c50000 01c59ec4 ntdll!RtlpLogHeapFailure+0xa1
03e0fcd8 773d7a7e 01c50000 00000000 01c59ec4 ntdll!RtlFreeHeap+0x60
03e0fcec 10004f7c 01c50000 00000000 01c59ec4 kernel32!HeapFree+0x14
WARNING: Stack unwind information not available. Following frames may be wrong.
03e0fd74 77123891 00000c78 03e0fd90 773d7374 nvappfilter+0x4f7c
03e0fd94 6e23b372 00000c78 03681d5c 03e0fdb8 ws2_32!closesocket+0x85
03e0fda4 6e23aa4e 03681d5c 03681e28 03681d5c iphlpsvc!TeredoDestroySecondarySocket+0x2d
03e0fdb8 6e22cb94 03681d5c 03681488 03e0fddc iphlpsvc!DeviceStop+0x1f
03e0fdc8 6e23479c 03681d5c 00100002 03681488 iphlpsvc!TeredoStopDevice+0x21
03e0fddc 6e238807 03681488 777a3324 00000000 iphlpsvc!TeredoHibernateClient+0x53
03e0fdfc 6e238c18 00000001 777b371c 022e8da8 iphlpsvc!TeredoClientTimerCallbackUnderLock+0x180
03e0fe10 777a32fb 03e0fe70 03681488 022e8da8 iphlpsvc!TeredoClientTimerCallback+0x8d
03e0fe34 777fa2b8 03e0fe70 022e8e08 03e02e16 ntdll!TppTimerpExecuteCallback+0x14d
03e0ff5c 773d3833 002c66a8 03e0ffa8 777ca9bd ntdll!TppWorkerThread+0x522
03e0ff68 777ca9bd 002c66a8 03e02ee2 00000000 kernel32!BaseThreadInitThunk+0xe
03e0ffa8 00000000 777fa044 002c66a8 00000000 ntdll!_RtlUserThreadStart+0x23

I think enabling pageheap on this svchost.exe would be a good idea:

1. Download and install app verifier:
http://www.microsoft.com/downloads/details...;displaylang=en

2. Run app verifier, and select File > Add Application - type "svchost.exe" in the box (minus the quotes) and click "Open"

3. Select the "svchost.exe" image name from the list, and on the right hand side make sure everything is UNchecked under the "Basics" tree, then check the "Heaps" option.

4. Exit app verifier, and restart the computer.

5. Run the following command from a command prompt:
cscript C:\debuggers\adplus.vbs -crash -pn svchost.exe -quiet -o C:\adplus


The next time the issue occurs, adplus should generate another folder under C:\adplus, and this will hopefully catch the process or binary that actuallly corrupted the heap.
enterman
here u r: http://www.megaupload.com/?d=ZTIA87BS thx
cluberti
Neither of these dumps is of the process crashing, but terminating. We'll need to try again, it seems.
shoguy
I'd have to say I'm experiencing similar problems on Vista x64. I've gone through the steps of getting the debugger and whatnot setup so it's a matter of waiting at this point. Kinda like fishing although in this scenario the fish are jumping in the boat!

Here's a rundown of my hardware and drivers versions, maybe this will strike a cord with some folks.

Evga mobo with Nvidia 680i chipset. Running 15.08 driver package from nvidia, and P30 bios.
Geforce 8800Ultra. Running 163.69 (gone through several revisions of these and no luck)
SATA DVD Drive
2x SATA HD's in the Nvidia raid config (stripe)

When I get the dump I'll post it. I only have limited experience with the debugger. Only enough to get to the dump and see what's up. Hopefully someone can read more into it then I.

Thanks!
cluberti
I'm pretty sure it's the nvidia network access manager causing it, or the network driver itself, but I don't have any real proof, just circumstantial evidence (like the dump output above).
shoguy
ugh how annoying. Once I get a dump I guess the next steps would be to contact nvidia. Vista definitly has some growing pains.
cluberti
QUOTE (shoguy @ Sep 18 2007, 02:26 PM) *
ugh how annoying. Once I get a dump I guess the next steps would be to contact nvidia. Vista definitly has some growing pains.

Unfortunately, just like XP, driver support on release stinks from some vendors (*cough*Nvidia*cough*).
enterman
QUOTE (cluberti @ Sep 18 2007, 02:33 PM) *
QUOTE (shoguy @ Sep 18 2007, 02:26 PM) *
ugh how annoying. Once I get a dump I guess the next steps would be to contact nvidia. Vista definitly has some growing pains.

Unfortunately, just like XP, driver support on release stinks from some vendors (*cough*Nvidia*cough*).

IDEA 4 me anyways. Ive been running utorrent non stop for longer than ive been having this issue and when launching utorrent it gives me this error: Probably explains my problem. Ill switch 2 azueres 4 a few days and c what happens. 1 thing, after doing what u said 2 do in the last post im having LOTS of bad things happen and my comp is gettin pretty slow as a result of them so can we undo that mabe?
cluberti
QUOTE (enterman @ Sep 18 2007, 04:36 PM) *
1 thing, after doing what u said 2 do in the last post im having LOTS of bad things happen and my comp is gettin pretty slow as a result of them so can we undo that mabe?

We sure can - again, I'm confident the nvidia driver is causing the crash, but I have no real proof. However, if you can't replace the driver, using a different application that is compatible with it (like azureus) might help.
shoguy
QUOTE (enterman @ Sep 18 2007, 01:36 PM) *
QUOTE (cluberti @ Sep 18 2007, 02:33 PM) *
QUOTE (shoguy @ Sep 18 2007, 02:26 PM) *
ugh how annoying. Once I get a dump I guess the next steps would be to contact nvidia. Vista definitly has some growing pains.

Unfortunately, just like XP, driver support on release stinks from some vendors (*cough*Nvidia*cough*).

IDEA 4 me anyways. Ive been running utorrent non stop for longer than ive been having this issue and when launching utorrent it gives me this error: Probably explains my problem. Ill switch 2 azueres 4 a few days and c what happens. 1 thing, after doing what u said 2 do in the last post im having LOTS of bad things happen and my comp is gettin pretty slow as a result of them so can we undo that mabe?


So I haven't been running any torrent software. Don't even have any installed. If the problems are related and it looks like they are, then switching your torrent application probably won't make the problems happen any less often. In my case svchost crashes at random and it's a random instance every time. Sometimes it's the iphlsvc, sometimes it's the one running the themes service.

I'm going to see when I get home tonight if I got any dumps, and find a way to uninstall that one firewall driver. This is annoying.
shoguy
http://blogs.technet.com/askperf/archive/2...rash-dumps.aspx has a really cool writup about the various ways to application dumps if there are problems.
enterman
QUOTE (shoguy @ Sep 18 2007, 06:54 PM) *
QUOTE (enterman @ Sep 18 2007, 01:36 PM) *
QUOTE (cluberti @ Sep 18 2007, 02:33 PM) *
QUOTE (shoguy @ Sep 18 2007, 02:26 PM) *
ugh how annoying. Once I get a dump I guess the next steps would be to contact nvidia. Vista definitly has some growing pains.

Unfortunately, just like XP, driver support on release stinks from some vendors (*cough*Nvidia*cough*).

IDEA 4 me anyways. Ive been running utorrent non stop for longer than ive been having this issue and when launching utorrent it gives me this error: Probably explains my problem. Ill switch 2 azueres 4 a few days and c what happens. 1 thing, after doing what u said 2 do in the last post im having LOTS of bad things happen and my comp is gettin pretty slow as a result of them so can we undo that mabe?


So I haven't been running any torrent software. Don't even have any installed. If the problems are related and it looks like they are, then switching your torrent application probably won't make the problems happen any less often. In my case svchost crashes at random and it's a random instance every time. Sometimes it's the iphlsvc, sometimes it's the one running the themes service.

I'm going to see when I get home tonight if I got any dumps, and find a way to uninstall that one firewall driver. This is annoying.

I uninstalled the firewall just now and everything seems a bit better. Also undid what cluberti had me do earlier. So far so good ill post if it comes back. Thx for ur help guys.
shoguy
I uninstalled the Nvidia Network Acess Manager and life seems to be a ton better for me as well. Haven't had a host process crash in over 12 hours. I would have had one by now. Never got a dump of the crash. But at least the suspision of the nvappfilter was a good one.

Thanks! Now I just hope anyone else who has this problem is able to find a solution. This thing has plagued me for 3 weeks.
enterman
QUOTE (shoguy @ Sep 19 2007, 10:00 AM) *
I uninstalled the Nvidia Network Acess Manager and life seems to be a ton better for me as well. Haven't had a host process crash in over 12 hours. I would have had one by now. Never got a dump of the crash. But at least the suspision of the nvappfilter was a good one.

Thanks! Now I just hope anyone else who has this problem is able to find a solution. This thing has plagued me for 3 weeks.

same here, since i uninstalled all has been much better. Ive got other probs id like help with though... 4 instance, with wmp11 I have 2. 1st, wmp quite often the 1st time I open it it will chrash 4 no reason. Another prob, sometimes when I close wmp11 it doesnt full close but just sits in the background. Pls dont suggest to use another program, I prefer wmp thx. Another question, would it b better 4 me speed wise 2 b running Vista x64 instead of x86? Specs: CPU: Intel Core 2 Duo E6600 GPU: EVGA GeForce 8800 GTX Superclocked Sound Card:
Creative Sound Blaster X-Fi XtremeGamer Fatal1ty 2GBs of ram. 1 more thing, b4 I uninstalled the firewall, I observed a SVhost process using a constant 50% CPU (its stopped that since i uninstalled firewall) and in taskmanager I went ahead and right clicked that process and created a dump of it, would that dump be useful 2 u cluberti? if so then Id b happy 2 up it if u knew where windows put the dump file.
cluberti
Yeah, dumps would be great but you'll have to use the debugger to actually launch Windows Media Player to capture these:

cscript C:\Debuggers\adplus.vbs -crash -quiet -o c:\adplus -sc "C:\Program Files\Windows Media Player\wmplayer.exe"

This will catch it when it crashes, if it crashes. Just run the above command and it'll attach the debugger, launch Windows Miedia Player, and dump it if it crashes. Keep running the above command until it crashes (don't close the open windows yet, though, for any that didn't crash - we don't want those dumps!), and zip up C:\adplus and post it. Once you've zipped up C:\adplus, you can close any open WMP windows that didn't crash.
enterman
well wmp11 has yet 2 chrash, this post is about another issue (i have many issues, i know). When I try 2 launch any game from the games folder I get this error: . This error was sudden, it started 2 weeks ago after doing nothing strange, it just happened 1 day upon bootup. Ive tried editing its values for play n such but when I click the edit button absolutely nothing happens when i click it though, it just sits there as if I didnt click it.

EDIT: ok now this is bothering me, U removed my sig and I understand y but I fixed it 2 where it was within the rules so y did u remove it again?
cluberti
I haven't touched your sig, and I can see it just fine here...

As to your error, try this:

Open Regedit and navigate to HKEY_CLASSES_ROOT\Lnkfile - click on this registry key to highlight it
Once you're there, click Edit > New > String Value, and give it the name IsShortcut
Click OK, then close regedit and reboot.

That should fix it.
enterman
QUOTE (cluberti @ Sep 21 2007, 05:57 PM) *
I haven't touched your sig, and I can see it just fine here...

As to your error, try this:

Open Regedit and navigate to HKEY_CLASSES_ROOT\Lnkfile - click on this registry key to highlight it
Once you're there, click Edit > New > String Value, and give it the name IsShortcut
Click OK, then close regedit and reboot.

That should fix it.

thx cluberti, fixed perfectly. What caused that? And im still wondering about x64 vista?
cluberti
QUOTE (enterman @ Sep 22 2007, 12:12 AM) *
thx cluberti, fixed perfectly. What caused that? And im still wondering about x64 vista?

Honestly, I couldn't say. It exists on a default install, so perhaps a game was installed onto the box that deleted it - I really couldn't say. As to x64, I wouldn't do it if you're running Creative hardware in your box, as they're notoriously bad with x64 drivers. As to the firewall and the svchost CPU issue, it's likely that the svchost.exe process was the network services svchost, which holds the server and workstation services (responsible for handling incoming and outgoing network traffic), and the firewall wasn't 100% vista compatible - I've seen that before with versions of ZoneAlarm (not the newest version, but some of the previous ones).

Were you ever able to get dumps of wmp?
GTO
have you done all the updates. This is very NB at the moment!
enterman
QUOTE (cluberti @ Sep 22 2007, 01:04 PM) *
QUOTE (enterman @ Sep 22 2007, 12:12 AM) *
thx cluberti, fixed perfectly. What caused that? And im still wondering about x64 vista?

Honestly, I couldn't say. It exists on a default install, so perhaps a game was installed onto the box that deleted it - I really couldn't say. As to x64, I wouldn't do it if you're running Creative hardware in your box, as they're notoriously bad with x64 drivers. As to the firewall and the svchost CPU issue, it's likely that the svchost.exe process was the network services svchost, which holds the server and workstation services (responsible for handling incoming and outgoing network traffic), and the firewall wasn't 100% vista compatible - I've seen that before with versions of ZoneAlarm (not the newest version, but some of the previous ones).

Were you ever able to get dumps of wmp?

it still hasnt crashed, go figure eh? It was crashing b4 I uninstalled nvidia firewall so mabe that had something 2 do with it. Thx 4 ur advice and all ur help smile.gif
Google Internet Forums Unattended CD/DVD Guide
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.