Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: Svchost.exe crashing randomly - Need expert help!
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Svchost.exe crashing randomly - Need expert help!
 Post Reply Post Reply Page  <1 56789>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Topic: Svchost.exe crashing randomly - Need expert help!
    Posted: 18 April 2008 at 11:07am
I can't do anything while it's on
Did you press F5 after the initial breakin?
 
after I finally manage to get it to stop
What do you mean by this?
 
svchost crashes(silently meaning no message from dumpprep or drwatson)
If you exited WinDbg, the debuggee was probably terminated.
 
With noninvasive, WinDbg warns:
The process can be examined but debug events will not be received
However, it will be desirable to receive debug events, so an invasive attach would seem to be appropriate.  Visual Studio is likely doing this, so continue using it.
 
It's just modules being loaded and unloaded, along with threads exitting with code 0.
Do you get any messages referring to first-chance exceptions or the like in the output window?
 
How long since the last crash (aside from any that were the result of playing with debuggers)?  Is it atypical to go that amount of time between crashes?
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2008 at 8:12am
To be honest I don't know. I can't see an option to select it in Visual Studio 2008.

Just figured out I could use WinDBG instead where I can select it. What should I select?

EDIT:

Just tried invasive mode... I can't do anything while it's on and after I finally manage to get it to stop, svchost crashes(silently meaning no message from dumpprep or drwatson)

So yeah, I've been using non invasive.


Edited by Jackcolt - 18 April 2008 at 8:18am
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2008 at 3:53am
I'll keep the debugger running though.

Did you attach invasively, or noninvasively?
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2008 at 3:36am
Well so far nothing. It's just modules being loaded and unloaded, along with threads exitting with code 0. It haven't crashed yet, so there still might be something of interest.

I also found an old file which caused trouble when I wanted to search for stuff in that folder(would yield any results and it took a lot resources). It's 70 MB big zip file which has thousands of folders with around 30.000 smaller files. When I look back, the trouble may have started since I got that file.

I've tried copying the file to my laptop to see if it will cause a crash on it. Kinda strange hoping for it crash :D

I'll keep the debugger running though. Hopefully I can get something good if it wasn't that(as nothing points towards it anyway)
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2008 at 7:03pm
How's it going with the debugger attached to the NETSVCS instance of SVCHOST? Are there ever any first chance exceptions?  Any interesting debug output in the debugger's output window?
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 15 April 2008 at 12:42pm
Doh! :P Yeah, it was the handle view.

It looks like it won't crash today. So I guess I'll just wait till it crashes with trying any of the other approaches.

Yeah, thanks for the link. That could prove very useful if I can't get anything valuable from Visual Studio.


I think troubleshooting with removing third party software and following my hunch about how I've organized my folders will be postponed till I've tried the other options.

I btw tried to get that other persons e-mail(the one with the seemingly same problem)... but apparently it doesn't exist. I might try to register on one of the forums he is on and try to pm him.
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 15 April 2008 at 7:36am
(all windows dlls)
That's what I saw as well.  But I was wondering what you saw when you stated:
Yeah I can "references" in the lower pane of svchost.exe -netsvcs in PE to all my other running programs.
Perhaps you were in Handle view rather than DLL view.
 
I've attached a debugger(visual studio 2008)
Will be interesting to see how many interruptions you get (if there are a lot of handled / first-chance exceptions, the debugger may break frequently until you ignore the exceptions).
 
also found another person with the same problem
Yes, it appears to be quite similar.  Not much there, though, and the thread seems dead.  Dead  Wonder if tickling it may result in a response...
 
He doesn't use AVG.
There's nothing that definitively or even remotely points at AVG.  Just trying to eliminate third-party software...
 
Still nothing interesting showing up in the event logs?
 
Wonder if an option may be to use a part of the technique described here:
For each service in the NETSVCS group at [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs], change the ImagePath to point to a copy of the SVCHOST.EXE file - SVCHOST_NETSVCS.EXE, for example.  Then, set up various GFLAGS for SVCHOST_NETSVCS.EXE, and attach a debugger to SVCHOST_NETSVCS.EXE after rebooting.  Initial thought for gflags would be turning on full page heap.
 
(Of course, you would want to take detailed notes about the changes you make to your system, so you can back out of them...)
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 15 April 2008 at 6:48am
I've checked the loaded modules using visual studio 2008 and nothing seems to out of the ordinary(all windows dlls)

I've attached a debugger(visual studio 2008) to the svchost -netsvcs process... maybe it prints some valuable information to the console.

I also found another person with the same problem :

http://www.tech-archive.net/Archive/WinXP/microsoft.public.windowsxp.help_and_support/2007-08/msg00996.html

He doesn't use AVG. I will try Avast later on if I can't get other solutions to work though.

I'm more and more getting the feeling that it might be some stupid bug, like having certain amount of avi files with thumbnails(I know this caused trouble with crashing explorer.exe with a friend)

Anyways, hopefully the debugger will print some information that can be used for anything.
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 15 April 2008 at 3:20am
would we be able to see it ... it would seem some application has messed with something in the OS.
Not necessarily.  But if an AV or other app has modules loaded into the address space of SVCHOST, it can certainly affect anything going on there.  It may not be that it is doing anything, and it is all fine.  But it would appear that something is causing the problem in your case, and if we can eliminate third-party code from the picture it will be a good thing.
 
I'll also try changing from AVG to Avast.
I know it's a pain, but it will be interesting to see the results...
 
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 14 April 2008 at 11:13pm
Ah okay, not such a "freak bug" after allEmbarrassed

Yeah when I get home, I'll see what I can find in the address space of svchost.exe -netsvcs.

My only concern, is that if it was another app screwing it up, would we be able to see it? To me, I might be wrong, it would seem some application has messed with something in the OS.

I'll also try changing from AVG to Avast.
Back to Top
 Post Reply Post Reply Page  <1 56789>

Forum Jump Forum Permissions View Drop Down