Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: Svchost.exe crashing randomly - Need expert help!
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Svchost.exe crashing randomly - Need expert help!
 Post Reply Post Reply Page  <1234 9>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Topic: Svchost.exe crashing randomly - Need expert help!
    Posted: 20 June 2008 at 7:02pm
But for some reason it just doesn't happen when I run those monitoring tools.
A Heisenbug? LOL
 
I also thought about contacting Microsoft, but I thought I'd ask you first, whether you knew if they would even be able to help me with this. I mean, if their support guys could figure out what thread is doing, would they even want to tell me?
It's possible Microsoft is aware of an issue of this nature, and may have a hotfix or some such.
 
I didn't mention this, but at some point after we started working on this, I decided that this problem was "interesting" enough to try a "test".  I posted a description of the problem and some of my analysis and thoughts at DumpAnalysis.org.  Dmitry suggested several things along the lines of things that I had already suggested.  But his first statement was:
In such cases like this where we have a NULL pointer and valid call stack I usually recommend to contact MS.
 
So, it would seem that contacting Microsoft may be an appropriate approach at this point, if you're inclined to do so.


Edited by molotov - 20 June 2008 at 7:02pm
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 20 June 2008 at 3:24pm
Sigh... I don't know anymore.

Just happened again after around 9 days of no errors. I check my AVI files for last time accessed and none of the were around the error. Strange thing was that one a couple of them had been accessed a couple of hours earlier. So I've deleted those... hopefully that will help.

Anyways, I'm kinda worried that it might be something totally different that is causing it. But for some reason it just doesn't happen when I run those monitoring tools. Any ideas why that might be?

I also thought about contacting Microsoft, but I thought I'd ask you first, whether you knew if they would even be able to help me with this. I mean, if their support guys could figure out what thread is doing, would they even want to tell me?
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 11 June 2008 at 9:49am
Okay... hasn't happened again on my brothers computer. I've also stopped ProcMon as it hasn't happened in a long time.

I've also thought about the possibility that my brother might not actually have copied the file to his computer, but having to render the thumbnail(or something similar) while browsing the folder over the network, eventually lead it to crashing.

Good thing is though, I can limit the amount of AVI which could have caused it, by comparing creation date(which haven't been altered from formating, as it's on a seperate hard drive) with my idea of when it started. 

So I've tried to clean out a bit, seen if it doesn't happen anymore. If it does, I'll try to test them out with my laptop.
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 28 May 2008 at 12:54am
Okay.

I'm gonna have it running for some weeks then. If nothing happens, or I can't get anything useful from it, I'll try out my AVI theory by tranferring the files I have under "suspicion" to my laptop. Should reveal if it truely is the cause of it.


Edited by Jackcolt - 28 May 2008 at 12:54am
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 27 May 2008 at 3:08pm
Process Monitor shouldn't impact the process in the same fashion - it's not a debugger.  It does have an impact on the system however (as would any similar tool / software)...
Daily affirmation:
net helpmsg 4006
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 27 May 2008 at 8:59am
By the way, ProcMon shouldn't "interfere" with svchost.exe right? You know, the same way that Debug Diags debugger did. I haven't the crash in a couple of days(even though that far from my "record" with no debugger attached), so I just want to make sure that it's not ProcMon preventing it from crashing.
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2008 at 1:50pm
Yeah, I've set it to use it's own backing file.
Back to Top
Intuit View Drop Down
Groupie
Groupie


Joined: 19 August 2006
Online Status: Offline
Posts: 83 		Post Options Post Options   Quote Intuit Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2008 at 1:15pm
I actually stopped using ProcMon because it's eating up my pagefile(or any file I want) pretty quickly,

I configure it use it's own backing file rather than RAM/PageFile. Doesn't have the system-wide performance hit that it might otherwise have.
Back to Top
Jackcolt View Drop Down
Groupie
Groupie


Joined: 01 April 2008
Location: Denmark
Online Status: Offline
Posts: 73 		Post Options Post Options   Quote Jackcolt Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2008 at 11:33am
Argh, of course :D

Yeah, ProcMon is running now with configured symbols.

Yeah, with symbols resolving properly
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2008 at 11:29am
Is there a way to dismiss events that is filtered away
Filter -> Drop Filtered Events
 
The stack call is identical except for a few parameters. Everything else is identical.
With symbols resolving properly, correct?
Daily affirmation:
net helpmsg 4006
Back to Top
 Post Reply Post Reply Page  <1234 9>

Forum Jump Forum Permissions View Drop Down