Suspicious crashes

[tamaranth]

The PC keeps encountering a problem with "Generic Host Process for Win32 Services". It's happened four times in the last three hours and every time I've had to restart to get my broadband connection back.

The message comes up after about 10 mins logged on (I just sat on the other side of the room and watched it happen without my having touched the keyboard for 5 mins).

I'm only running Firefox and Notetab (under, I'mverysorry, Windows XP). I checked the Micros*ft site re this problem, and there's a patch, but it's not at all recent -- so what I'm suspicious about is the way it's suddenly started happening. Can't think of how it could be caused by having unplugged and moved the PC, then moved it back, and that's all that's changed since Before Problem.

Any ideas? Virus? Physical damage? Weird hardware thing? Mercury in retrograde? Absence of cat urine in carpet?

Comments

[zoo-music-girl.livejournal.com]

This happened to thermaland recently. The advice he got was to check for updates (which you've done) and check for malware.

[marypcb.livejournal.com]

Generic Host Process for Win32 Services shows up in Task manager as SVCHOST. It's a wrapper for programs that can't run on their own, which can be anything from the various bits of the control panel to the background services that make up all of Windows apart from the kernel. Expect to see several of them; some services are separated for security.

badly written drivers, physical memory faults, malware and viruses can all cause this error. If it was the MS Blaster virus you'd get a message saying the PC was going to shut down, so it's not that. As you've moved the PC, open the case and check that everything is seated firmly - the move could have jolted a connection. it's also possible that the timing is coincidence and it's a driver that just went wrong.

To find out what the problem program is, check the error (click where it says Click Here) for the szModName - you should see something like szModName : ntdll.dll. If the module is Hpgtpusd.dll it's an HP printer driver that needs updating. The error is your best bet for the info and the solution, which will probably be updating or re-installing the problem file.

if you don't see a module name, you can also open a command prompt and type TASKLIST /SVC to see whats running under the SVCHOST's sessions before the problem happens and see if they're all things you want running. Or you can turn all the services that aren't part of Windows itself off to see if they're responsible. Use Start > Run > MSCONFIG to start the System Configuration Utility. On the Services tab choose Hide all Microsoft services; now choose Disable all. Restart your PC. if you don't get the error, you know it's one of the third party services causing it (if you do it's a hardware problem, a Windows problem or possibly a virus). if it is a third party service go back to the System Config Utility and turn the services back on one by one, rebooting each time till you find the one that gives the error. once you know what it is you can uninstall, update or reinstall it.

get the November 2005 patch just in case.http://support.microsoft.com/default.aspx?scid=kb;en-us;894391

one thought. it takes out your network connection. one SVCHOST is devoted to networking. get Windows to chck the system files by opening a command prompt and typing SFC /SCANNOW. if a networking system file is corrupted this will replace it with a fresh copy.

[tamaranth.livejournal.com]

PC doesn't know about tasklist/svc : "not recognised"
szModName is 'unknown', szAppName = szApp, offset is 00000000.

I am certainly suspicious!



I've installed the Nov05 patch ... no joy.

Have now restarted with all third-party gunk disabled: gmail was a bit slow but apart from that everything is fine so far.

Just running sfc scannow. It is checking very slowly. .. oh, and now ("Files that are required for Windows to run properly must be copied to the DLL Cache") it wants my Windows XP CD. Which I think I've packed ...

I swear technology knows when it's a bad time!

Will try to send this, then have a ferret. no, not the small furry toothy kind

Thank you everso for all your advice! It won't be the end of the world if I don't get this running, but it would make the last few days here easier.

[tamaranth.livejournal.com]

Generic Host Process just crashed again, though there are no non-Microsoft thingies running. However, I have only myself to blame for asymmetric markup in previous comment.

[tamaranth.livejournal.com]

connection persists until I have sent the error report: then SPLAT.

[marypcb.livejournal.com]

OK, get the tasklist program
turn on the PC
run
tasklist /svc > alltasks.txt
check you have a file called alltasks.txt
wait till it throws the error
run
tasklist /svc > crashtasks.txt
look for the service that's in the first file and not in the second

make sure SFC finishes its job

possible shortcut
make a new user account in Windows and see if you get the error in that account too - if not, migrate your stuff to it and kill the old account

[tamaranth.livejournal.com]

logged on via werk laptop, as I'm sick of restarting the other one ...

Ran three tests: one when I had everything up and running and was freshly logged on, one when the 'encountered an error, haha' message came up, and one when it'd finished error reporting and disconnected me.

A process called dwwin was running on test 2 but not on 1 or 3. Also on test 2, there was a very busy svchost process with lots of Things. By test 3, that had gone, as had dwwin -- but dwwin had been replaced, in terms of position in list, by a stripped-down version of svchost running fewer things.

Am very much inclined to either scrap it or go for full reinstall at some stage, especially as all my data is now backed up. Given probably-limited cash, what do you recommend? Main uses: LJ, The Interweb, a bit of multimedia, Word&Excel&Access. And I could live without Access these days.

Sleeeep now. thank you ever so for all your support! I know it's not working but I've given it a fair shot.

[marypcb.livejournal.com]

dwwin.exe is Dr Watson which is used by the error reporting tool, which is why you see it in 2 but not 1 or 3 ;-)
the interesting thing is the difference between what is in SVCHOST in 1 and 2 and again from 2 to three. i'd expect to see a networking service that's in 1 and 2 but not in 3 and a culprit that's only in 1 - possibly with several things that depend on the culprit going to to complicate it. but if new account works I'd not fuss.

if you want a new machine - I'd suggest a cheap Tosh or Dell laptop and a student version of Office which gives you Word and Excel.

but we can go for a repair windows reinstall and then a full windows reinstall before we give up (if you have that much patience!)

[tamaranth.livejournal.com]

Aren't Dell laptops rather a ... hot topic at the moment?

May see what I can do with this one when it's retrieved: meanwhile, a combination of K's laptop and werk PC will do me for most things. And really am quite tempted to switch to Linux, though OpenOffice's Word-substitute is a nasty thing. Mind you, I do have an installation CD for Word 97: may stick to that!

[marypcb.livejournal.com]

Apple's had batteries and power supplies catching on fire for years - Sony isn't that good at batteries and they supply both.

Linux - that'll be Liam for tech support then ;-)
(miaow)

[tamaranth.livejournal.com]

Saucer of milk, dear?

Werk is an enthusiastically Linux site, so tech support should be available at the drop of a penguin. I've had very few problems with the desktop machine at werk in the last 8 months -- but then, I haven't been using it for fun stuff like web, multimedia etc.

[tamaranth.livejournal.com]

I've created a new account and so far it seems OK, touch wood! You are my Salvation!

Is there a quick and easy way of grabbing apps and settings from the old account?

[marypcb.livejournal.com]

the files and settings transfer wizard will get documents and settings - from broadband to what you like in the start menu.
BUT - as whatever went wrong, if it's fixed in a new account is down to either a setting or a program from the old account, it may be better to do the settings by hand rather than getting the setting that caused the problem!

any progams that have been installed for All Users should show up on the start menu automatically; for the others go to control panel/add or remove programs and click Change if the program is there but not listed on the start menu and choose Repair if it's an option. for some programs finding them in Program Files and running the EXE will offer to install for all users (works for Office). for others you can just drag the exe file to the start menu and make a shortcut. some will need a re-install - it all depends on the program!

salvation goes around, like grace and port ;-) it's just your turn this time

[tamaranth.livejournal.com]

very inclined to leave it alone for these last few days -- there's nothing urgent that I need to do -- and then start from scratch when I retrieve it from storage. It does seem to at least stay connected at the moment! And I'll be setting up the basics, at least, on K's PC.

Bah. Maybe I'll switch to Linux after all!

[tamaranth.livejournal.com]

oh BLOODY HELL IT'S HAPPENING AGAIN.
Did take a lot longer. But still.

[marypcb.livejournal.com]

aargh...
ok, i'd try this next - http://www.michaelstevenstech.com/XPrepairinstall.htm has the full details; we're installing Windows over itself to replace the Windows files without affecting files or applications.

Boot the computer using the XP CD. usually that's just put in the CD, shut down, turn the power on.

When you see the "Welcome To Setup" screen, you will see the options below
This portion of the Setup program prepares Microsoft
Windows XP to run on your computer:

To setup Windows XP now, press ENTER.

To repair a Windows XP installation using Recovery Console, press R.

To quit Setup without installing Windows XP, press F3.

Press Enter to start the Windows Setup.
I know it says repair but DO NO choose "To repair a Windows XP installation using the Recovery Console, press R", (you Do Not want to load Recovery Console). I repeat, do not choose "To repair a Windows XP installation using the Recovery Console, press R". Press ENTER instead!

Accept the License Agreement and Windows will search for existing Windows installations.

Select the XP installation you want to repair from the list - it should be the only one - and press R to start the repair. If Repair is not one of the options, END setup. Don't go ahead - we need to try something different. Just turn the PC off, take the CD out and reboot as normal. Continuing would wipe your system.

Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact.

[(Anonymous)]

don;t worry about the temp files - they're probably more details about the error - I can't quite see on the image tho'. don't wory about no module name; it's less helpful but doesn't mean bad trouble. that SFC wants files makes me think it's a corrupted file going bang - but if minus all third party services you don't get the error that's where I'll point ;-)

TASKLIST is absurdly only available in XP Pro. how stupid. http://www.computerhope.com/download/winxp/tasklist.exe has it for download and I think they're a reputable site. or I can mail it. but if stopping third party services has got rid of the error it's not absolutely necessary.

forward the packing!

hugs

[tamaranth.livejournal.com]

AAAARGH it's still happening despite insertion of XP CD (which made the 'feed me CD' message go away) and subsequent copying-or-something: despite starting up without third-party stuff: despite only using Firefox ...
Grrr.
Here I go again! just downloading tasklist