Frequent svchost.exe errors, same instruction address each time

September 30, 2008

I'm getting frequent (every 2-3 min) svchost.exe errors: same instruction

address is trying to access memory at 0x00000000. Is there a way to see what

program is trying to do this? McAfee quarantined something and this started

happening so I figure it's some sort of virus. Anyway to get rid of it

without re-install?

Thanks

September 30, 2008

Re: Frequent svchost.exe errors, same instruction address each time

Dave

Please post copies of all Error and Warning Reports appearing in the

System and Application logs in Event Viewer relating to the last boot in

normal mode . No Information Reports or Duplicates please. Indicate

which also appear in a previous boot.

You can access Event Viewer by selecting Start, Control Panel,

Administrative Tools, and Event Viewer. When researching the meaning

of the error, information regarding Event ID, Source and Description

are important.

A tip for posting copies of Error Reports! Run Event Viewer and double

click on the error you want to copy. In the window, which appears is a

button resembling two pages. Click the button and close Event

Viewer.Now start your message (email) and do a paste into the body of

the message. Make sure this is the first paste after exiting from

Event Viewer.

--

Hope this helps.

Gerry

~~~~

FCA

Stourport, England

Enquire, plan and execute

~~~~~~~~~~~~~~~~~~~

Dave wrote:

> I'm getting frequent (every 2-3 min) svchost.exe errors: same

> instruction address is trying to access memory at 0x00000000. Is

> there a way to see what program is trying to do this? McAfee

> quarantined something and this started happening so I figure it's

> some sort of virus. Anyway to get rid of it without re-install?

>

> Thanks

September 30, 2008

Re: Frequent svchost.exe errors, same instruction address each time

Unexplained computer behavior may be caused by deceptive software

http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log

to an appropriate forum.

Checking for/Help with Hijackware

http://aumha.org/a/parasite.htm

http://aumha.org/a/quickfix.htm

http://aumha.net/viewtopic.php?t=5878

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://mvps.org/winhelp2002/unwanted.htm

http://inetexplorer.mvps.org/data/prevention.htm

http://inetexplorer.mvps.org/tshoot.html

http://www.mvps.org/sramesh2k/Malware_Defence.htm

http://defendingyourmachine2.blogspot.com/

http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2

(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in

conjuction with some other utilities). HijackThis will NOT fix anything on

its own, but it will help you to both identify and remove any

hijackware/spyware with assistance from an expert. **Post your log to

http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,

http://forums.spybot.info/forumdisplay.php?f=22,

http://aumha.net/viewforum.php?f=30, or another appropriate forum for review

by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this

isn't your cup of tea - take the machine to a local, reputable and

independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

--

~Robear Dyer (PA Bear)

MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

AumHa VSOP & Admin http://aumha.net

DTS-L http://dts-l.net/

Dave wrote:

> I'm getting frequent (every 2-3 min) svchost.exe errors: same instruction

> address is trying to access memory at 0x00000000. Is there a way to see

> what program is trying to do this? McAfee quarantined something and this

> started happening so I figure it's some sort of virus. Anyway to get rid

> of it without re-install?

>

> Thanks

September 30, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

I cleared the logs before restart and there are 2 errors in application and 3

in system after starting up. It takes forever to start, and, about a minute

after this last application event, i get about 10 more every 3 seconds.

During these errors, I also get Data Prevention Execution errors. Then,

whenever I start a Windows Explorer window, I get another occurrence.

Application Events (first is first error in time after boot):

Event Type: Error

Event Source: Application Error

Event Category: (100)

Event ID: 1000

Date: 9/30/2008

Time: 6:45:35 PM

User: N/A

Computer: 62GF7F1

Description:

Faulting application svchost.exe, version 5.1.2600.5512, faulting module

unknown, version 0.0.0.0, fault address 0x00de9eec.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 73 76 63 ure svc

0018: 68 6f 73 74 2e 65 78 65 host.exe

0020: 20 35 2e 31 2e 32 36 30 5.1.260

0028: 30 2e 35 35 31 32 20 69 0.5512 i

0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

0040: 30 20 61 74 20 6f 66 66 0 at off

0048: 73 65 74 20 30 30 64 65 set 00de

0050: 39 65 65 63 9eec

Event Type: Error

Event Source: Application Error

Event Category: (100)

Event ID: 1004

Date: 9/30/2008

Time: 6:46:39 PM

User: N/A

Computer: 62GF7F1

Description:

Faulting application svchost.exe, version 5.1.2600.5512, faulting module

unknown, version 0.0.0.0, fault address 0x00de9eec.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 73 76 63 ure svc

0018: 68 6f 73 74 2e 65 78 65 host.exe

0020: 20 35 2e 31 2e 32 36 30 5.1.260

0028: 30 2e 35 35 31 32 20 69 0.5512 i

0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

0040: 30 20 61 74 20 6f 66 66 0 at off

0048: 73 65 74 20 30 30 64 65 set 00de

0050: 39 65 65 63 9eec

System Events:

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7022

Date: 9/30/2008

Time: 6:45:18 PM

User: N/A

Computer: 62GF7F1

Description:

The Windows Image Acquisition (WIA) service hung on starting.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7034

Date: 9/30/2008

Time: 6:48:02 PM

User: N/A

Computer: 62GF7F1

Description:

The Windows Image Acquisition (WIA) service terminated unexpectedly. It has

done this 1 time(s).

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Error

Event Source: DCOM

Event Category: None

Event ID: 10010

Date: 9/30/2008

Time: 6:48:22 PM

User: ACCT05\DFLAGG

Computer: 62GF7F1

Description:

The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with DCOM

within the required timeout.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

"Gerry" wrote:

> Dave

>

> Please post copies of all Error and Warning Reports appearing in the

> System and Application logs in Event Viewer relating to the last boot in

> normal mode . No Information Reports or Duplicates please. Indicate

> which also appear in a previous boot.

>

> You can access Event Viewer by selecting Start, Control Panel,

> Administrative Tools, and Event Viewer. When researching the meaning

> of the error, information regarding Event ID, Source and Description

> are important.

>

> A tip for posting copies of Error Reports! Run Event Viewer and double

> click on the error you want to copy. In the window, which appears is a

> button resembling two pages. Click the button and close Event

> Viewer.Now start your message (email) and do a paste into the body of

> the message. Make sure this is the first paste after exiting from

> Event Viewer.

>

> --

>

> Hope this helps.

>

> Gerry

> ~~~~

> FCA

> Stourport, England

> Enquire, plan and execute

> ~~~~~~~~~~~~~~~~~~~

>

> Dave wrote:

> > I'm getting frequent (every 2-3 min) svchost.exe errors: same

> > instruction address is trying to access memory at 0x00000000. Is

> > there a way to see what program is trying to do this? McAfee

> > quarantined something and this started happening so I figure it's

> > some sort of virus. Anyway to get rid of it without re-install?

> >

> > Thanks

>

September 30, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave - svchost is a "host" (container) for servcices/files required by a

running application,

Regarding: "Faulting application svchost.exe, version 5.1.2600.5512,

faulting module

unknown, version 0.0.0.0, fault address 0x00de9eecding: "..." - note

reference to "fault module unknown" - it's the module causing the problem -

unfortunately it is not identified - Process Explorer (or maybe Task

Manager) may be of assistance.

Data Prevention Execution is notifying you of errors created by an

application attempting to access program code memory (Module in

svchost/WIA?). Default DEP settting provides system file protection.

"Dave" <Dave@discussions.microsoft.com> wrote in message

news:9E9D7C74-9201-4743-915F-E40B86D3B3D7@microsoft.com...

>I cleared the logs before restart and there are 2 errors in application and

>3

> in system after starting up. It takes forever to start, and, about a

> minute

> after this last application event, i get about 10 more every 3 seconds.

> During these errors, I also get Data Prevention Execution errors. Then,

> whenever I start a Windows Explorer window, I get another occurrence.

>

> Application Events (first is first error in time after boot):

>

> Event Type: Error

> Event Source: Application Error

> Event Category: (100)

> Event ID: 1000

> Date: 9/30/2008

> Time: 6:45:35 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> Faulting application svchost.exe, version 5.1.2600.5512, faulting module

> unknown, version 0.0.0.0, fault address 0x00de9eec.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 73 76 63 ure svc

> 0018: 68 6f 73 74 2e 65 78 65 host.exe

> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> 0040: 30 20 61 74 20 6f 66 66 0 at off

> 0048: 73 65 74 20 30 30 64 65 set 00de

> 0050: 39 65 65 63 9eec

>

> Event Type: Error

> Event Source: Application Error

> Event Category: (100)

> Event ID: 1004

> Date: 9/30/2008

> Time: 6:46:39 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> Faulting application svchost.exe, version 5.1.2600.5512, faulting module

> unknown, version 0.0.0.0, fault address 0x00de9eec.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 73 76 63 ure svc

> 0018: 68 6f 73 74 2e 65 78 65 host.exe

> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> 0040: 30 20 61 74 20 6f 66 66 0 at off

> 0048: 73 65 74 20 30 30 64 65 set 00de

> 0050: 39 65 65 63 9eec

>

> System Events:

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7022

> Date: 9/30/2008

> Time: 6:45:18 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service hung on starting.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7034

> Date: 9/30/2008

> Time: 6:48:02 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service terminated unexpectedly. It

> has

> done this 1 time(s).

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> Event Type: Error

> Event Source: DCOM

> Event Category: None

> Event ID: 10010

> Date: 9/30/2008

> Time: 6:48:22 PM

> User: ACCT05\DFLAGG

> Computer: 62GF7F1

> Description:

> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with

> DCOM

> within the required timeout.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> "Gerry" wrote:

>

>> Dave

>>

>> Please post copies of all Error and Warning Reports appearing in the

>> System and Application logs in Event Viewer relating to the last boot in

>> normal mode . No Information Reports or Duplicates please. Indicate

>> which also appear in a previous boot.

>>

>> You can access Event Viewer by selecting Start, Control Panel,

>> Administrative Tools, and Event Viewer. When researching the meaning

>> of the error, information regarding Event ID, Source and Description

>> are important.

>>

>> A tip for posting copies of Error Reports! Run Event Viewer and double

>> click on the error you want to copy. In the window, which appears is a

>> button resembling two pages. Click the button and close Event

>> Viewer.Now start your message (email) and do a paste into the body of

>> the message. Make sure this is the first paste after exiting from

>> Event Viewer.

>>

>> --

>>

>> Hope this helps.

>>

>> Gerry

>> ~~~~

>> FCA

>> Stourport, England

>> Enquire, plan and execute

>> ~~~~~~~~~~~~~~~~~~~

>>

>> Dave wrote:

>> > I'm getting frequent (every 2-3 min) svchost.exe errors: same

>> > instruction address is trying to access memory at 0x00000000. Is

>> > there a way to see what program is trying to do this? McAfee

>> > quarantined something and this started happening so I figure it's

>> > some sort of virus. Anyway to get rid of it without re-install?

>> >

>> > Thanks

>>

October 1, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave wrote:

snip...

> System Events:

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7022

> Date: 9/30/2008

> Time: 6:45:18 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service hung on starting.

>

snip...

>> Dave

>>

>> Please post copies of all Error and Warning Reports appearing in the

>> System and Application logs in Event Viewer relating to the last boot in

>> normal mode . No Information Reports or Duplicates please. Indicate

>> which also appear in a previous boot.

>>

>> You can access Event Viewer by selecting Start, Control Panel,

>> Administrative Tools, and Event Viewer. When researching the meaning

>> of the error, information regarding Event ID, Source and Description

>> are important.

>>

>> A tip for posting copies of Error Reports! Run Event Viewer and double

>> click on the error you want to copy. In the window, which appears is a

>> button resembling two pages. Click the button and close Event

>> Viewer.Now start your message (email) and do a paste into the body of

>> the message. Make sure this is the first paste after exiting from

>> Event Viewer.

>>

>> --

>>

>> Hope this helps.

>>

>> Gerry

>> ~~~~

>> FCA

>> Stourport, England

>> Enquire, plan and execute

>> ~~~~~~~~~~~~~~~~~~~

>>

>> Dave wrote:

>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same

>>> instruction address is trying to access memory at 0x00000000. Is

>>> there a way to see what program is trying to do this? McAfee

>>> quarantined something and this started happening so I figure it's

>>> some sort of virus. Anyway to get rid of it without re-install?

>>>

>>> Thanks

>>

Seeing the WIA (Windows Image Acquisition) service mentioned among the

errors would prompt me to temporarily disable it and try again. I may help

and it seems unlikely to hurt.

John McGaw

http://johnmcgaw.com

October 1, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave

This seems to be the error where the problem starts.

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7022

Date: 9/30/2008

Time: 6:45:18 PM

User: N/A

Computer: 62GF7F1

Description:

The Windows Image Acquisition (WIA) service hung on starting.

Go to Start, Control Panel. Administrative Tools, Services and right

click on the WIA Service. Select Properties and check the Start Up type.

Mine is set to Start Automatically.

This link describes the service.

http://smallvoid.com/article/winnt-services-stisvc.html

You will see that the recommended setting is Manual but I changed mine

after getting problems years ago.

--

Hope this helps.

Gerry

~~~~

FCA

Stourport, England

Enquire, plan and execute

~~~~~~~~~~~~~~~~~~~

Dave wrote:

> I cleared the logs before restart and there are 2 errors in

> application and 3 in system after starting up. It takes forever to

> start, and, about a minute after this last application event, i get

> about 10 more every 3 seconds. During these errors, I also get Data

> Prevention Execution errors. Then, whenever I start a Windows

> Explorer window, I get another occurrence.

>

> Application Events (first is first error in time after boot):

>

> Event Type: Error

> Event Source: Application Error

> Event Category: (100)

> Event ID: 1000

> Date: 9/30/2008

> Time: 6:45:35 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> Faulting application svchost.exe, version 5.1.2600.5512, faulting

> module unknown, version 0.0.0.0, fault address 0x00de9eec.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 73 76 63 ure svc

> 0018: 68 6f 73 74 2e 65 78 65 host.exe

> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> 0040: 30 20 61 74 20 6f 66 66 0 at off

> 0048: 73 65 74 20 30 30 64 65 set 00de

> 0050: 39 65 65 63 9eec

>

> Event Type: Error

> Event Source: Application Error

> Event Category: (100)

> Event ID: 1004

> Date: 9/30/2008

> Time: 6:46:39 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> Faulting application svchost.exe, version 5.1.2600.5512, faulting

> module unknown, version 0.0.0.0, fault address 0x00de9eec.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 73 76 63 ure svc

> 0018: 68 6f 73 74 2e 65 78 65 host.exe

> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> 0040: 30 20 61 74 20 6f 66 66 0 at off

> 0048: 73 65 74 20 30 30 64 65 set 00de

> 0050: 39 65 65 63 9eec

>

> System Events:

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7022

> Date: 9/30/2008

> Time: 6:45:18 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service hung on starting.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7034

> Date: 9/30/2008

> Time: 6:48:02 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service terminated unexpectedly.

> It has done this 1 time(s).

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> Event Type: Error

> Event Source: DCOM

> Event Category: None

> Event ID: 10010

> Date: 9/30/2008

> Time: 6:48:22 PM

> User: ACCT05\DFLAGG

> Computer: 62GF7F1

> Description:

> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register

> with DCOM within the required timeout.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

>

> "Gerry" wrote:

>

>> Dave

>>

>> Please post copies of all Error and Warning Reports appearing in the

>> System and Application logs in Event Viewer relating to the last

>> boot in normal mode . No Information Reports or Duplicates please.

>> Indicate which also appear in a previous boot.

>>

>> You can access Event Viewer by selecting Start, Control Panel,

>> Administrative Tools, and Event Viewer. When researching the meaning

>> of the error, information regarding Event ID, Source and Description

>> are important.

>>

>> A tip for posting copies of Error Reports! Run Event Viewer and

>> double click on the error you want to copy. In the window, which

>> appears is a button resembling two pages. Click the button and close

>> Event Viewer.Now start your message (email) and do a paste into the

>> body of the message. Make sure this is the first paste after exiting

>> from

>> Event Viewer.

>>

>> --

>>

>> Hope this helps.

>>

>> Gerry

>> ~~~~

>> FCA

>> Stourport, England

>> Enquire, plan and execute

>> ~~~~~~~~~~~~~~~~~~~

>>

>> Dave wrote:

>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same

>>> instruction address is trying to access memory at 0x00000000. Is

>>> there a way to see what program is trying to do this? McAfee

>>> quarantined something and this started happening so I figure it's

>>> some sort of virus. Anyway to get rid of it without re-install?

>>>

>>> Thanks

October 1, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Thank you! I killed that service and the behavior stopped. Then I did a

search for that specific service, and found a problem associated with my

printer software installation which I had forgotten I performed (HP PSC

2510). HP had a patch for the problem and it's now gone.

They was linking the svchost error to the Windows Image Acquisition (WIA)

service which, at a glance, don't seem to relate to each other at all. Your

help was invaluable and I learned something about Windows!

Thanks again,

Dave

"Gerry" wrote:

> Dave

>

> This seems to be the error where the problem starts.

>

> Event Type: Error

> Event Source: Service Control Manager

> Event Category: None

> Event ID: 7022

> Date: 9/30/2008

> Time: 6:45:18 PM

> User: N/A

> Computer: 62GF7F1

> Description:

> The Windows Image Acquisition (WIA) service hung on starting.

>

> Go to Start, Control Panel. Administrative Tools, Services and right

> click on the WIA Service. Select Properties and check the Start Up type.

> Mine is set to Start Automatically.

>

> This link describes the service.

> http://smallvoid.com/article/winnt-services-stisvc.html

>

> You will see that the recommended setting is Manual but I changed mine

> after getting problems years ago.

>

> --

>

> Hope this helps.

>

> Gerry

> ~~~~

> FCA

> Stourport, England

> Enquire, plan and execute

> ~~~~~~~~~~~~~~~~~~~

>

> Dave wrote:

> > I cleared the logs before restart and there are 2 errors in

> > application and 3 in system after starting up. It takes forever to

> > start, and, about a minute after this last application event, i get

> > about 10 more every 3 seconds. During these errors, I also get Data

> > Prevention Execution errors. Then, whenever I start a Windows

> > Explorer window, I get another occurrence.

> >

> > Application Events (first is first error in time after boot):

> >

> > Event Type: Error

> > Event Source: Application Error

> > Event Category: (100)

> > Event ID: 1000

> > Date: 9/30/2008

> > Time: 6:45:35 PM

> > User: N/A

> > Computer: 62GF7F1

> > Description:

> > Faulting application svchost.exe, version 5.1.2600.5512, faulting

> > module unknown, version 0.0.0.0, fault address 0x00de9eec.

> >

> > For more information, see Help and Support Center at

> > http://go.microsoft.com/fwlink/events.asp.

> > Data:

> > 0000: 41 70 70 6c 69 63 61 74 Applicat

> > 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> > 0010: 75 72 65 20 20 73 76 63 ure svc

> > 0018: 68 6f 73 74 2e 65 78 65 host.exe

> > 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> > 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> > 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> > 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> > 0040: 30 20 61 74 20 6f 66 66 0 at off

> > 0048: 73 65 74 20 30 30 64 65 set 00de

> > 0050: 39 65 65 63 9eec

> >

> > Event Type: Error

> > Event Source: Application Error

> > Event Category: (100)

> > Event ID: 1004

> > Date: 9/30/2008

> > Time: 6:46:39 PM

> > User: N/A

> > Computer: 62GF7F1

> > Description:

> > Faulting application svchost.exe, version 5.1.2600.5512, faulting

> > module unknown, version 0.0.0.0, fault address 0x00de9eec.

> >

> > For more information, see Help and Support Center at

> > http://go.microsoft.com/fwlink/events.asp.

> > Data:

> > 0000: 41 70 70 6c 69 63 61 74 Applicat

> > 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> > 0010: 75 72 65 20 20 73 76 63 ure svc

> > 0018: 68 6f 73 74 2e 65 78 65 host.exe

> > 0020: 20 35 2e 31 2e 32 36 30 5.1.260

> > 0028: 30 2e 35 35 31 32 20 69 0.5512 i

> > 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

> > 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

> > 0040: 30 20 61 74 20 6f 66 66 0 at off

> > 0048: 73 65 74 20 30 30 64 65 set 00de

> > 0050: 39 65 65 63 9eec

> >

> > System Events:

> >

> > Event Type: Error

> > Event Source: Service Control Manager

> > Event Category: None

> > Event ID: 7022

> > Date: 9/30/2008

> > Time: 6:45:18 PM

> > User: N/A

> > Computer: 62GF7F1

> > Description:

> > The Windows Image Acquisition (WIA) service hung on starting.

> >

> > For more information, see Help and Support Center at

> > http://go.microsoft.com/fwlink/events.asp.

> >

> > Event Type: Error

> > Event Source: Service Control Manager

> > Event Category: None

> > Event ID: 7034

> > Date: 9/30/2008

> > Time: 6:48:02 PM

> > User: N/A

> > Computer: 62GF7F1

> > Description:

> > The Windows Image Acquisition (WIA) service terminated unexpectedly.

> > It has done this 1 time(s).

> >

> > For more information, see Help and Support Center at

> > http://go.microsoft.com/fwlink/events.asp.

> >

> > Event Type: Error

> > Event Source: DCOM

> > Event Category: None

> > Event ID: 10010

> > Date: 9/30/2008

> > Time: 6:48:22 PM

> > User: ACCT05\DFLAGG

> > Computer: 62GF7F1

> > Description:

> > The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register

> > with DCOM within the required timeout.

> >

> > For more information, see Help and Support Center at

> > http://go.microsoft.com/fwlink/events.asp.

> >

> > "Gerry" wrote:

> >

> >> Dave

> >>

> >> Please post copies of all Error and Warning Reports appearing in the

> >> System and Application logs in Event Viewer relating to the last

> >> boot in normal mode . No Information Reports or Duplicates please.

> >> Indicate which also appear in a previous boot.

> >>

> >> You can access Event Viewer by selecting Start, Control Panel,

> >> Administrative Tools, and Event Viewer. When researching the meaning

> >> of the error, information regarding Event ID, Source and Description

> >> are important.

> >>

> >> A tip for posting copies of Error Reports! Run Event Viewer and

> >> double click on the error you want to copy. In the window, which

> >> appears is a button resembling two pages. Click the button and close

> >> Event Viewer.Now start your message (email) and do a paste into the

> >> body of the message. Make sure this is the first paste after exiting

> >> from

> >> Event Viewer.

> >>

> >> --

> >>

> >> Hope this helps.

> >>

> >> Gerry

> >> ~~~~

> >> FCA

> >> Stourport, England

> >> Enquire, plan and execute

> >> ~~~~~~~~~~~~~~~~~~~

> >>

> >> Dave wrote:

> >>> I'm getting frequent (every 2-3 min) svchost.exe errors: same

> >>> instruction address is trying to access memory at 0x00000000. Is

> >>> there a way to see what program is trying to do this? McAfee

> >>> quarantined something and this started happening so I figure it's

> >>> some sort of virus. Anyway to get rid of it without re-install?

> >>>

> >>> Thanks

>

October 1, 2008

Re: Frequent svchost.exe errors, same instruction address each tim

Re: Frequent svchost.exe errors, same instruction address each tim

Dave

That's a good result.

--

Gerry

~~~~

FCA

Stourport, England

Enquire, plan and execute

~~~~~~~~~~~~~~~~~~~

Dave wrote:

> Thank you! I killed that service and the behavior stopped. Then I

> did a search for that specific service, and found a problem

> associated with my printer software installation which I had

> forgotten I performed (HP PSC 2510). HP had a patch for the problem

> and it's now gone.

>

> They was linking the svchost error to the Windows Image Acquisition

> (WIA) service which, at a glance, don't seem to relate to each other

> at all. Your help was invaluable and I learned something about

> Windows!

>

> Thanks again,

> Dave

>

> "Gerry" wrote:

>

>> Dave

>>

>> This seems to be the error where the problem starts.

>>

>> Event Type: Error

>> Event Source: Service Control Manager

>> Event Category: None

>> Event ID: 7022

>> Date: 9/30/2008

>> Time: 6:45:18 PM

>> User: N/A

>> Computer: 62GF7F1

>> Description:

>> The Windows Image Acquisition (WIA) service hung on starting.

>>

>> Go to Start, Control Panel. Administrative Tools, Services and right

>> click on the WIA Service. Select Properties and check the Start Up

>> type. Mine is set to Start Automatically.

>>

>> This link describes the service.

>> http://smallvoid.com/article/winnt-services-stisvc.html

>>

>> You will see that the recommended setting is Manual but I changed

>> mine after getting problems years ago.

>>

>> --

>>

>> Hope this helps.

>>

>> Gerry

>> ~~~~

>> FCA

>> Stourport, England

>> Enquire, plan and execute

>> ~~~~~~~~~~~~~~~~~~~

>>

>> Dave wrote:

>>> I cleared the logs before restart and there are 2 errors in

>>> application and 3 in system after starting up. It takes forever to

>>> start, and, about a minute after this last application event, i get

>>> about 10 more every 3 seconds. During these errors, I also get Data

>>> Prevention Execution errors. Then, whenever I start a Windows

>>> Explorer window, I get another occurrence.

>>>

>>> Application Events (first is first error in time after boot):

>>>

>>> Event Type: Error

>>> Event Source: Application Error

>>> Event Category: (100)

>>> Event ID: 1000

>>> Date: 9/30/2008

>>> Time: 6:45:35 PM

>>> User: N/A

>>> Computer: 62GF7F1

>>> Description:

>>> Faulting application svchost.exe, version 5.1.2600.5512, faulting

>>> module unknown, version 0.0.0.0, fault address 0x00de9eec.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>> Data:

>>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>>> 0010: 75 72 65 20 20 73 76 63 ure svc

>>> 0018: 68 6f 73 74 2e 65 78 65 host.exe

>>> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

>>> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

>>> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

>>> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

>>> 0040: 30 20 61 74 20 6f 66 66 0 at off

>>> 0048: 73 65 74 20 30 30 64 65 set 00de

>>> 0050: 39 65 65 63 9eec

>>>

>>> Event Type: Error

>>> Event Source: Application Error

>>> Event Category: (100)

>>> Event ID: 1004

>>> Date: 9/30/2008

>>> Time: 6:46:39 PM

>>> User: N/A

>>> Computer: 62GF7F1

>>> Description:

>>> Faulting application svchost.exe, version 5.1.2600.5512, faulting

>>> module unknown, version 0.0.0.0, fault address 0x00de9eec.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>> Data:

>>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>>> 0010: 75 72 65 20 20 73 76 63 ure svc

>>> 0018: 68 6f 73 74 2e 65 78 65 host.exe

>>> 0020: 20 35 2e 31 2e 32 36 30 5.1.260

>>> 0028: 30 2e 35 35 31 32 20 69 0.5512 i

>>> 0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

>>> 0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

>>> 0040: 30 20 61 74 20 6f 66 66 0 at off

>>> 0048: 73 65 74 20 30 30 64 65 set 00de

>>> 0050: 39 65 65 63 9eec

>>>

>>> System Events:

>>>

>>> Event Type: Error

>>> Event Source: Service Control Manager

>>> Event Category: None

>>> Event ID: 7022

>>> Date: 9/30/2008

>>> Time: 6:45:18 PM

>>> User: N/A

>>> Computer: 62GF7F1

>>> Description:

>>> The Windows Image Acquisition (WIA) service hung on starting.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>>

>>> Event Type: Error

>>> Event Source: Service Control Manager

>>> Event Category: None

>>> Event ID: 7034

>>> Date: 9/30/2008

>>> Time: 6:48:02 PM

>>> User: N/A

>>> Computer: 62GF7F1

>>> Description:

>>> The Windows Image Acquisition (WIA) service terminated unexpectedly.

>>> It has done this 1 time(s).

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>>

>>> Event Type: Error

>>> Event Source: DCOM

>>> Event Category: None

>>> Event ID: 10010

>>> Date: 9/30/2008

>>> Time: 6:48:22 PM

>>> User: ACCT05\DFLAGG

>>> Computer: 62GF7F1

>>> Description:

>>> The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register

>>> with DCOM within the required timeout.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>>

>>> "Gerry" wrote:

>>>

>>>> Dave

>>>>

>>>> Please post copies of all Error and Warning Reports appearing in

>>>> the System and Application logs in Event Viewer relating to the

>>>> last boot in normal mode . No Information Reports or Duplicates

>>>> please. Indicate which also appear in a previous boot.

>>>>

>>>> You can access Event Viewer by selecting Start, Control Panel,

>>>> Administrative Tools, and Event Viewer. When researching the

>>>> meaning of the error, information regarding Event ID, Source and

>>>> Description are important.

>>>>

>>>> A tip for posting copies of Error Reports! Run Event Viewer and

>>>> double click on the error you want to copy. In the window, which

>>>> appears is a button resembling two pages. Click the button and

>>>> close Event Viewer.Now start your message (email) and do a paste

>>>> into the body of the message. Make sure this is the first paste

>>>> after exiting from

>>>> Event Viewer.

>>>>

>>>> --

>>>>

>>>> Hope this helps.

>>>>

>>>> Gerry

>>>> ~~~~

>>>> FCA

>>>> Stourport, England

>>>> Enquire, plan and execute

>>>> ~~~~~~~~~~~~~~~~~~~

>>>>

>>>> Dave wrote:

>>>>> I'm getting frequent (every 2-3 min) svchost.exe errors: same

>>>>> instruction address is trying to access memory at 0x00000000. Is

>>>>> there a way to see what program is trying to do this? McAfee

>>>>> quarantined something and this started happening so I figure it's

>>>>> some sort of virus. Anyway to get rid of it without re-install?

>>>>>

>>>>> Thanks

Sign In

Frequent svchost.exe errors, same instruction address each time

Recommended Posts

Guest Dave

Popular Days

Popular Days

Guest Gerry

Guest PA Bear [MS MVP]

Guest Dave

Guest AJR

Guest John McGaw

Guest Gerry

Guest Dave

Guest Gerry

Similar Content

Multiple Instances of the same software for each user possible?

BSOD errors galore, different error code each time

Multiple random bluescreen's, with different error codes each time.

Games on XBOX games pass crash within 5 minutes each time all I can see is Disributed Com Error

How do I use my pc and laptop at the same time?

Browse

Activity

Site Info