Svchost.exe crashing randomly - Need expert help!

Okay.

I'm gonna have it running for some weeks then. If nothing happens, or I can't get anything useful from it, I'll try out my AVI theory by tranferring the files I have under "suspicion" to my laptop. Should reveal if it truely is the cause of it.


Edited by Jackcolt - 28 May 2008 at 12:54am

Sigh... I don't know anymore.

Just happened again after around 9 days of no errors. I check my AVI files for last time accessed and none of the were around the error. Strange thing was that one a couple of them had been accessed a couple of hours earlier. So I've deleted those... hopefully that will help.

Anyways, I'm kinda worried that it might be something totally different that is causing it. But for some reason it just doesn't happen when I run those monitoring tools. Any ideas why that might be?

I also thought about contacting Microsoft, but I thought I'd ask you first, whether you knew if they would even be able to help me with this. I mean, if their support guys could figure out what thread is doing, would they even want to tell me?

Would seem like a Heisenbug, but as you also said before(as far as I recall...can't be bothered to check :P), ProcMon isn't affecting the system like an attached debugger would.

But I'll try to contact MS now... hopefully they can shed some light on the issue. The thing is, I don't think they have a hotfix, but I think they know some uses of that particular thread, and perhaps come up with some suggestions what might have caused that null pointer exception.

Also, thanks for the quick reply

I think I've nailed it!

The last couple of times it happened, I noticed that a certain computer would have recently been started(or at least on), which made me wonder if the problem had anything to do with that computer. The strange thing about the computer, was that it had some strange network behavoir... I couldn't access it from my own computer, and if it was the only computer in a certain workgroup, I couldn't even access that workgroup.

So I decided to have a look at it. It turns out, that if I disabled the Comodo Firewall, I wouldn't have any troubles access the computer or the workgroup. So the Firewall must be blocking packets incomming from my computer - but since Comodo is bloaded with advanced features and settings, I thought that it may not be all packets that were blocked. Now, I don't know how the networking is handled on the application layer in Windows XP, but maybe the firewall didn't block certain packets which was used to "make contact", but others which was needed to give my computer certain information, is blocked, thus passing on null in the call stack. That's my theory :P - At least it's a lot more plausible that the whole AVI thing.

So what I've done is remove Comodo and install another Firewall, which caused no issues with accessing computers or workgroups on the network.

It hasn't happened since(which is around 2 weeks). Also, if it happens again, I could start using packet analyzers like Wireshark to see if it's network related(which it has to be - as stated, it also happened on my laptop and my brothers computer)

Anyways, I'm confident that the problem is solved. A VEEEEEEERY big thanks to you molotov, for helping me out through these couple of months. You've also helped me learn some debugging techniques, so this error seen in retrospec hasn't all been bad(even though I've cursed numerous times :P). It's awesome to see other people who are willing to share their knowledge without any elitist behavior or anything. So once more, thanks a bunch!

I'll consider the problem solved. If it returns I'll be sure to post again :P

Yeah it's on the same network - It's our home network which consists of 3 workgroups

Exactly... it's incredible that my computer can have a process crashed by another computer. I'm lucky this is a home network, where it's very easy to see computer activity. Imagine a worker in a company with thousands of computers on their network having this issue - Good luck I say :P. Of course, now that I know(at least I think) what the issue is, solution to such a situation wouldn't be too difficult.

Also, I just looked back some of the previous posts in this thread. Just noticed this:

"First-chance exception at 0x7c812a5b (kernel32.dll) in svchost.exe: 0x000006BA: The RPC server is unavailable.
First-chance exception at 0x7c812a5b (kernel32.dll) in svchost.exe: 0x000006BA: The RPC server is unavailable."

That "The RPC server is unavailable" is basically when the application using RPC can't reach the server. I've seen this before when trying to run various network commands(like a remote shutdown), which then is blocked. That could have been an indication of remote method calls being blocked.
Of course it might be something else . It's just an observation.