Frequent svchost.exe errors, same instruction address each time

  • Thread starter Thread starter Dave
  • Start date Start date
D

Dave

Guest
I'm getting frequent (every 2-3 min) svchost.exe errors: same instruction
address is trying to access memory at 0x00000000. Is there a way to see what
program is trying to do this? McAfee quarantined something and this started
happening so I figure it's some sort of virus. Anyway to get rid of it
without re-install?

Thanks
 
Re: Frequent svchost.exe errors, same instruction address each time

Dave

Please post copies of all Error and Warning Reports appearing in the
System and Application logs in Event Viewer relating to the last boot in
normal mode . No Information Reports or Duplicates please. Indicate
which also appear in a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


Dave wrote:
> I'm getting frequent (every 2-3 min) svchost.exe errors: same
> instruction address is trying to access memory at 0x00000000. Is
> there a way to see what program is trying to do this? McAfee
> quarantined something and this started happening so I figure it's
> some sort of virus. Anyway to get rid of it without re-install?
>
> Thanks
 
Re: Frequent svchost.exe errors, same instruction address each time

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Dave wrote:
> I'm getting frequent (every 2-3 min) svchost.exe errors: same instruction
> address is trying to access memory at 0x00000000. Is there a way to see
> what program is trying to do this? McAfee quarantined something and this
> started happening so I figure it's some sort of virus. Anyway to get rid
> of it without re-install?
>
> Thanks
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

I cleared the logs before restart and there are 2 errors in application and 3
in system after starting up. It takes forever to start, and, about a minute
after this last application event, i get about 10 more every 3 seconds.
During these errors, I also get Data Prevention Execution errors. Then,
whenever I start a Windows Explorer window, I get another occurrence.

Application Events (first is first error in time after boot):

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/30/2008
Time: 6:45:35 PM
User: N/A
Computer: 62GF7F1
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module
unknown, version 0.0.0.0, fault address 0x00de9eec.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 64 65 set 00de
0050: 39 65 65 63 9eec

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 9/30/2008
Time: 6:46:39 PM
User: N/A
Computer: 62GF7F1
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module
unknown, version 0.0.0.0, fault address 0x00de9eec.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 64 65 set 00de
0050: 39 65 65 63 9eec


System Events:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 9/30/2008
Time: 6:45:18 PM
User: N/A
Computer: 62GF7F1
Description:
The Windows Image Acquisition (WIA) service hung on starting.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 9/30/2008
Time: 6:48:02 PM
User: N/A
Computer: 62GF7F1
Description:
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has
done this 1 time(s).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 9/30/2008
Time: 6:48:22 PM
User: ACCT05\DFLAGG
Computer: 62GF7F1
Description:
The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with DCOM
within the required timeout.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Gerry" wrote:

> Dave
>
> Please post copies of all Error and Warning Reports appearing in the
> System and Application logs in Event Viewer relating to the last boot in
> normal mode . No Information Reports or Duplicates please. Indicate
> which also appear in a previous boot.
>
> You can access Event Viewer by selecting Start, Control Panel,
> Administrative Tools, and Event Viewer. When researching the meaning
> of the error, information regarding Event ID, Source and Description
> are important.
>
> A tip for posting copies of Error Reports! Run Event Viewer and double
> click on the error you want to copy. In the window, which appears is a
> button resembling two pages. Click the button and close Event
> Viewer.Now start your message (email) and do a paste into the body of
> the message. Make sure this is the first paste after exiting from
> Event Viewer.
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
>
>
> Dave wrote:
> > I'm getting frequent (every 2-3 min) svchost.exe errors: same
> > instruction address is trying to access memory at 0x00000000. Is
> > there a way to see what program is trying to do this? McAfee
> > quarantined something and this started happening so I figure it's
> > some sort of virus. Anyway to get rid of it without re-install?
> >
> > Thanks
>
>
>
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave - svchost is a "host" (container) for servcices/files required by a
running application,

Regarding: "Faulting application svchost.exe, version 5.1.2600.5512,
faulting module
unknown, version 0.0.0.0, fault address 0x00de9eecding: "..." - note
reference to "fault module unknown" - it's the module causing the problem -
unfortunately it is not identified - Process Explorer (or maybe Task
Manager) may be of assistance.

Data Prevention Execution is notifying you of errors created by an
application attempting to access program code memory (Module in
svchost/WIA?). Default DEP settting provides system file protection.


"Dave" <Dave@discussions.microsoft.com> wrote in message
news:9E9D7C74-9201-4743-915F-E40B86D3B3D7@microsoft.com...
>I cleared the logs before restart and there are 2 errors in application and
>3
> in system after starting up. It takes forever to start, and, about a
> minute
> after this last application event, i get about 10 more every 3 seconds.
> During these errors, I also get Data Prevention Execution errors. Then,
> whenever I start a Windows Explorer window, I get another occurrence.
>
> Application Events (first is first error in time after boot):
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 9/30/2008
> Time: 6:45:35 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> Faulting application svchost.exe, version 5.1.2600.5512, faulting module
> unknown, version 0.0.0.0, fault address 0x00de9eec.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> 0040: 30 20 61 74 20 6f 66 66 0 at off
> 0048: 73 65 74 20 30 30 64 65 set 00de
> 0050: 39 65 65 63 9eec
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1004
> Date: 9/30/2008
> Time: 6:46:39 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> Faulting application svchost.exe, version 5.1.2600.5512, faulting module
> unknown, version 0.0.0.0, fault address 0x00de9eec.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> 0040: 30 20 61 74 20 6f 66 66 0 at off
> 0048: 73 65 74 20 30 30 64 65 set 00de
> 0050: 39 65 65 63 9eec
>
>
> System Events:
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7022
> Date: 9/30/2008
> Time: 6:45:18 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service hung on starting.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7034
> Date: 9/30/2008
> Time: 6:48:02 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service terminated unexpectedly. It
> has
> done this 1 time(s).
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: DCOM
> Event Category: None
> Event ID: 10010
> Date: 9/30/2008
> Time: 6:48:22 PM
> User: ACCT05\DFLAGG
> Computer: 62GF7F1
> Description:
> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with
> DCOM
> within the required timeout.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> "Gerry" wrote:
>
>> Dave
>>
>> Please post copies of all Error and Warning Reports appearing in the
>> System and Application logs in Event Viewer relating to the last boot in
>> normal mode . No Information Reports or Duplicates please. Indicate
>> which also appear in a previous boot.
>>
>> You can access Event Viewer by selecting Start, Control Panel,
>> Administrative Tools, and Event Viewer. When researching the meaning
>> of the error, information regarding Event ID, Source and Description
>> are important.
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and double
>> click on the error you want to copy. In the window, which appears is a
>> button resembling two pages. Click the button and close Event
>> Viewer.Now start your message (email) and do a paste into the body of
>> the message. Make sure this is the first paste after exiting from
>> Event Viewer.
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>>
>>
>> Dave wrote:
>> > I'm getting frequent (every 2-3 min) svchost.exe errors: same
>> > instruction address is trying to access memory at 0x00000000. Is
>> > there a way to see what program is trying to do this? McAfee
>> > quarantined something and this started happening so I figure it's
>> > some sort of virus. Anyway to get rid of it without re-install?
>> >
>> > Thanks
>>
>>
>>
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave wrote:
snip...

> System Events:
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7022
> Date: 9/30/2008
> Time: 6:45:18 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service hung on starting.
>
snip...
>> Dave
>>
>> Please post copies of all Error and Warning Reports appearing in the
>> System and Application logs in Event Viewer relating to the last boot in
>> normal mode . No Information Reports or Duplicates please. Indicate
>> which also appear in a previous boot.
>>
>> You can access Event Viewer by selecting Start, Control Panel,
>> Administrative Tools, and Event Viewer. When researching the meaning
>> of the error, information regarding Event ID, Source and Description
>> are important.
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and double
>> click on the error you want to copy. In the window, which appears is a
>> button resembling two pages. Click the button and close Event
>> Viewer.Now start your message (email) and do a paste into the body of
>> the message. Make sure this is the first paste after exiting from
>> Event Viewer.
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>>
>>
>> Dave wrote:
>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same
>>> instruction address is trying to access memory at 0x00000000. Is
>>> there a way to see what program is trying to do this? McAfee
>>> quarantined something and this started happening so I figure it's
>>> some sort of virus. Anyway to get rid of it without re-install?
>>>
>>> Thanks
>>
>>

Seeing the WIA (Windows Image Acquisition) service mentioned among the
errors would prompt me to temporarily disable it and try again. I may help
and it seems unlikely to hurt.

John McGaw
http://johnmcgaw.com
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave

This seems to be the error where the problem starts.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 9/30/2008
Time: 6:45:18 PM
User: N/A
Computer: 62GF7F1
Description:
The Windows Image Acquisition (WIA) service hung on starting.

Go to Start, Control Panel. Administrative Tools, Services and right
click on the WIA Service. Select Properties and check the Start Up type.
Mine is set to Start Automatically.

This link describes the service.
http://smallvoid.com/article/winnt-services-stisvc.html

You will see that the recommended setting is Manual but I changed mine
after getting problems years ago.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Dave wrote:
> I cleared the logs before restart and there are 2 errors in
> application and 3 in system after starting up. It takes forever to
> start, and, about a minute after this last application event, i get
> about 10 more every 3 seconds. During these errors, I also get Data
> Prevention Execution errors. Then, whenever I start a Windows
> Explorer window, I get another occurrence.
>
> Application Events (first is first error in time after boot):
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 9/30/2008
> Time: 6:45:35 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> Faulting application svchost.exe, version 5.1.2600.5512, faulting
> module unknown, version 0.0.0.0, fault address 0x00de9eec.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> 0040: 30 20 61 74 20 6f 66 66 0 at off
> 0048: 73 65 74 20 30 30 64 65 set 00de
> 0050: 39 65 65 63 9eec
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1004
> Date: 9/30/2008
> Time: 6:46:39 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> Faulting application svchost.exe, version 5.1.2600.5512, faulting
> module unknown, version 0.0.0.0, fault address 0x00de9eec.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 73 76 63 ure svc
> 0018: 68 6f 73 74 2e 65 78 65 host.exe
> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> 0040: 30 20 61 74 20 6f 66 66 0 at off
> 0048: 73 65 74 20 30 30 64 65 set 00de
> 0050: 39 65 65 63 9eec
>
>
> System Events:
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7022
> Date: 9/30/2008
> Time: 6:45:18 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service hung on starting.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7034
> Date: 9/30/2008
> Time: 6:48:02 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service terminated unexpectedly.
> It has done this 1 time(s).
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Error
> Event Source: DCOM
> Event Category: None
> Event ID: 10010
> Date: 9/30/2008
> Time: 6:48:22 PM
> User: ACCT05\DFLAGG
> Computer: 62GF7F1
> Description:
> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register
> with DCOM within the required timeout.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> "Gerry" wrote:
>
>> Dave
>>
>> Please post copies of all Error and Warning Reports appearing in the
>> System and Application logs in Event Viewer relating to the last
>> boot in normal mode . No Information Reports or Duplicates please.
>> Indicate which also appear in a previous boot.
>>
>> You can access Event Viewer by selecting Start, Control Panel,
>> Administrative Tools, and Event Viewer. When researching the meaning
>> of the error, information regarding Event ID, Source and Description
>> are important.
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and
>> double click on the error you want to copy. In the window, which
>> appears is a button resembling two pages. Click the button and close
>> Event Viewer.Now start your message (email) and do a paste into the
>> body of the message. Make sure this is the first paste after exiting
>> from
>> Event Viewer.
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>>
>>
>> Dave wrote:
>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same
>>> instruction address is trying to access memory at 0x00000000. Is
>>> there a way to see what program is trying to do this? McAfee
>>> quarantined something and this started happening so I figure it's
>>> some sort of virus. Anyway to get rid of it without re-install?
>>>
>>> Thanks
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Thank you! I killed that service and the behavior stopped. Then I did a
search for that specific service, and found a problem associated with my
printer software installation which I had forgotten I performed (HP PSC
2510). HP had a patch for the problem and it's now gone.

They was linking the svchost error to the Windows Image Acquisition (WIA)
service which, at a glance, don't seem to relate to each other at all. Your
help was invaluable and I learned something about Windows!

Thanks again,
Dave

"Gerry" wrote:

> Dave
>
> This seems to be the error where the problem starts.
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7022
> Date: 9/30/2008
> Time: 6:45:18 PM
> User: N/A
> Computer: 62GF7F1
> Description:
> The Windows Image Acquisition (WIA) service hung on starting.
>
> Go to Start, Control Panel. Administrative Tools, Services and right
> click on the WIA Service. Select Properties and check the Start Up type.
> Mine is set to Start Automatically.
>
> This link describes the service.
> http://smallvoid.com/article/winnt-services-stisvc.html
>
> You will see that the recommended setting is Manual but I changed mine
> after getting problems years ago.
>
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
>
> Dave wrote:
> > I cleared the logs before restart and there are 2 errors in
> > application and 3 in system after starting up. It takes forever to
> > start, and, about a minute after this last application event, i get
> > about 10 more every 3 seconds. During these errors, I also get Data
> > Prevention Execution errors. Then, whenever I start a Windows
> > Explorer window, I get another occurrence.
> >
> > Application Events (first is first error in time after boot):
> >
> > Event Type: Error
> > Event Source: Application Error
> > Event Category: (100)
> > Event ID: 1000
> > Date: 9/30/2008
> > Time: 6:45:35 PM
> > User: N/A
> > Computer: 62GF7F1
> > Description:
> > Faulting application svchost.exe, version 5.1.2600.5512, faulting
> > module unknown, version 0.0.0.0, fault address 0x00de9eec.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: 41 70 70 6c 69 63 61 74 Applicat
> > 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> > 0010: 75 72 65 20 20 73 76 63 ure svc
> > 0018: 68 6f 73 74 2e 65 78 65 host.exe
> > 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> > 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> > 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> > 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> > 0040: 30 20 61 74 20 6f 66 66 0 at off
> > 0048: 73 65 74 20 30 30 64 65 set 00de
> > 0050: 39 65 65 63 9eec
> >
> > Event Type: Error
> > Event Source: Application Error
> > Event Category: (100)
> > Event ID: 1004
> > Date: 9/30/2008
> > Time: 6:46:39 PM
> > User: N/A
> > Computer: 62GF7F1
> > Description:
> > Faulting application svchost.exe, version 5.1.2600.5512, faulting
> > module unknown, version 0.0.0.0, fault address 0x00de9eec.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: 41 70 70 6c 69 63 61 74 Applicat
> > 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> > 0010: 75 72 65 20 20 73 76 63 ure svc
> > 0018: 68 6f 73 74 2e 65 78 65 host.exe
> > 0020: 20 35 2e 31 2e 32 36 30 5.1.260
> > 0028: 30 2e 35 35 31 32 20 69 0.5512 i
> > 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
> > 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
> > 0040: 30 20 61 74 20 6f 66 66 0 at off
> > 0048: 73 65 74 20 30 30 64 65 set 00de
> > 0050: 39 65 65 63 9eec
> >
> >
> > System Events:
> >
> > Event Type: Error
> > Event Source: Service Control Manager
> > Event Category: None
> > Event ID: 7022
> > Date: 9/30/2008
> > Time: 6:45:18 PM
> > User: N/A
> > Computer: 62GF7F1
> > Description:
> > The Windows Image Acquisition (WIA) service hung on starting.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > Event Type: Error
> > Event Source: Service Control Manager
> > Event Category: None
> > Event ID: 7034
> > Date: 9/30/2008
> > Time: 6:48:02 PM
> > User: N/A
> > Computer: 62GF7F1
> > Description:
> > The Windows Image Acquisition (WIA) service terminated unexpectedly.
> > It has done this 1 time(s).
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > Event Type: Error
> > Event Source: DCOM
> > Event Category: None
> > Event ID: 10010
> > Date: 9/30/2008
> > Time: 6:48:22 PM
> > User: ACCT05\DFLAGG
> > Computer: 62GF7F1
> > Description:
> > The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register
> > with DCOM within the required timeout.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > "Gerry" wrote:
> >
> >> Dave
> >>
> >> Please post copies of all Error and Warning Reports appearing in the
> >> System and Application logs in Event Viewer relating to the last
> >> boot in normal mode . No Information Reports or Duplicates please.
> >> Indicate which also appear in a previous boot.
> >>
> >> You can access Event Viewer by selecting Start, Control Panel,
> >> Administrative Tools, and Event Viewer. When researching the meaning
> >> of the error, information regarding Event ID, Source and Description
> >> are important.
> >>
> >> A tip for posting copies of Error Reports! Run Event Viewer and
> >> double click on the error you want to copy. In the window, which
> >> appears is a button resembling two pages. Click the button and close
> >> Event Viewer.Now start your message (email) and do a paste into the
> >> body of the message. Make sure this is the first paste after exiting
> >> from
> >> Event Viewer.
> >>
> >> --
> >>
> >>
> >>
> >> Hope this helps.
> >>
> >> Gerry
> >> ~~~~
> >> FCA
> >> Stourport, England
> >> Enquire, plan and execute
> >> ~~~~~~~~~~~~~~~~~~~
> >>
> >>
> >> Dave wrote:
> >>> I'm getting frequent (every 2-3 min) svchost.exe errors: same
> >>> instruction address is trying to access memory at 0x00000000. Is
> >>> there a way to see what program is trying to do this? McAfee
> >>> quarantined something and this started happening so I figure it's
> >>> some sort of virus. Anyway to get rid of it without re-install?
> >>>
> >>> Thanks
>
>
>
 
Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave

That's a good result.


--



Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Dave wrote:
> Thank you! I killed that service and the behavior stopped. Then I
> did a search for that specific service, and found a problem
> associated with my printer software installation which I had
> forgotten I performed (HP PSC 2510). HP had a patch for the problem
> and it's now gone.
>
> They was linking the svchost error to the Windows Image Acquisition
> (WIA) service which, at a glance, don't seem to relate to each other
> at all. Your help was invaluable and I learned something about
> Windows!
>
> Thanks again,
> Dave
>
> "Gerry" wrote:
>
>> Dave
>>
>> This seems to be the error where the problem starts.
>>
>> Event Type: Error
>> Event Source: Service Control Manager
>> Event Category: None
>> Event ID: 7022
>> Date: 9/30/2008
>> Time: 6:45:18 PM
>> User: N/A
>> Computer: 62GF7F1
>> Description:
>> The Windows Image Acquisition (WIA) service hung on starting.
>>
>> Go to Start, Control Panel. Administrative Tools, Services and right
>> click on the WIA Service. Select Properties and check the Start Up
>> type. Mine is set to Start Automatically.
>>
>> This link describes the service.
>> http://smallvoid.com/article/winnt-services-stisvc.html
>>
>> You will see that the recommended setting is Manual but I changed
>> mine after getting problems years ago.
>>
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>>
>> Dave wrote:
>>> I cleared the logs before restart and there are 2 errors in
>>> application and 3 in system after starting up. It takes forever to
>>> start, and, about a minute after this last application event, i get
>>> about 10 more every 3 seconds. During these errors, I also get Data
>>> Prevention Execution errors. Then, whenever I start a Windows
>>> Explorer window, I get another occurrence.
>>>
>>> Application Events (first is first error in time after boot):
>>>
>>> Event Type: Error
>>> Event Source: Application Error
>>> Event Category: (100)
>>> Event ID: 1000
>>> Date: 9/30/2008
>>> Time: 6:45:35 PM
>>> User: N/A
>>> Computer: 62GF7F1
>>> Description:
>>> Faulting application svchost.exe, version 5.1.2600.5512, faulting
>>> module unknown, version 0.0.0.0, fault address 0x00de9eec.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>>> 0010: 75 72 65 20 20 73 76 63 ure svc
>>> 0018: 68 6f 73 74 2e 65 78 65 host.exe
>>> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
>>> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
>>> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
>>> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
>>> 0040: 30 20 61 74 20 6f 66 66 0 at off
>>> 0048: 73 65 74 20 30 30 64 65 set 00de
>>> 0050: 39 65 65 63 9eec
>>>
>>> Event Type: Error
>>> Event Source: Application Error
>>> Event Category: (100)
>>> Event ID: 1004
>>> Date: 9/30/2008
>>> Time: 6:46:39 PM
>>> User: N/A
>>> Computer: 62GF7F1
>>> Description:
>>> Faulting application svchost.exe, version 5.1.2600.5512, faulting
>>> module unknown, version 0.0.0.0, fault address 0x00de9eec.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>>> 0010: 75 72 65 20 20 73 76 63 ure svc
>>> 0018: 68 6f 73 74 2e 65 78 65 host.exe
>>> 0020: 20 35 2e 31 2e 32 36 30 5.1.260
>>> 0028: 30 2e 35 35 31 32 20 69 0.5512 i
>>> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
>>> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
>>> 0040: 30 20 61 74 20 6f 66 66 0 at off
>>> 0048: 73 65 74 20 30 30 64 65 set 00de
>>> 0050: 39 65 65 63 9eec
>>>
>>>
>>> System Events:
>>>
>>> Event Type: Error
>>> Event Source: Service Control Manager
>>> Event Category: None
>>> Event ID: 7022
>>> Date: 9/30/2008
>>> Time: 6:45:18 PM
>>> User: N/A
>>> Computer: 62GF7F1
>>> Description:
>>> The Windows Image Acquisition (WIA) service hung on starting.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Event Type: Error
>>> Event Source: Service Control Manager
>>> Event Category: None
>>> Event ID: 7034
>>> Date: 9/30/2008
>>> Time: 6:48:02 PM
>>> User: N/A
>>> Computer: 62GF7F1
>>> Description:
>>> The Windows Image Acquisition (WIA) service terminated unexpectedly.
>>> It has done this 1 time(s).
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Event Type: Error
>>> Event Source: DCOM
>>> Event Category: None
>>> Event ID: 10010
>>> Date: 9/30/2008
>>> Time: 6:48:22 PM
>>> User: ACCT05\DFLAGG
>>> Computer: 62GF7F1
>>> Description:
>>> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register
>>> with DCOM within the required timeout.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> "Gerry" wrote:
>>>
>>>> Dave
>>>>
>>>> Please post copies of all Error and Warning Reports appearing in
>>>> the System and Application logs in Event Viewer relating to the
>>>> last boot in normal mode . No Information Reports or Duplicates
>>>> please. Indicate which also appear in a previous boot.
>>>>
>>>> You can access Event Viewer by selecting Start, Control Panel,
>>>> Administrative Tools, and Event Viewer. When researching the
>>>> meaning of the error, information regarding Event ID, Source and
>>>> Description are important.
>>>>
>>>> A tip for posting copies of Error Reports! Run Event Viewer and
>>>> double click on the error you want to copy. In the window, which
>>>> appears is a button resembling two pages. Click the button and
>>>> close Event Viewer.Now start your message (email) and do a paste
>>>> into the body of the message. Make sure this is the first paste
>>>> after exiting from
>>>> Event Viewer.
>>>>
>>>> --
>>>>
>>>>
>>>>
>>>> Hope this helps.
>>>>
>>>> Gerry
>>>> ~~~~
>>>> FCA
>>>> Stourport, England
>>>> Enquire, plan and execute
>>>> ~~~~~~~~~~~~~~~~~~~
>>>>
>>>>
>>>> Dave wrote:
>>>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same
>>>>> instruction address is trying to access memory at 0x00000000. Is
>>>>> there a way to see what program is trying to do this? McAfee
>>>>> quarantined something and this started happening so I figure it's
>>>>> some sort of virus. Anyway to get rid of it without re-install?
>>>>>
>>>>> Thanks
 
Back
Top