Faulting application svchost.exe, version 5.1.2600.5512

[Tom]

This is a persistent problem I have had for many months. I have McAfee
running all the time; I've run scans, I've run Adware; I've run chkdsk; I
even backed off SP3 and reinstalled it - all to no avail. The error dumps
fill up my HD requiring me to delete the files periodically. Also, explre
runs VERY slow when I open a folder for the first time. I have an ACER
Aspire 5000 notebook w/ AMD Turion and 1.2GB memory. I have a ton of error
msgs in event viewer. It appears that a new one is created even when I'mnot
doing anything. Below is a sample. Please help.
-Tom

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 12/29/2008
Time: 9:59:40 AM
User: N/A
Computer: ACER
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module
unknown, version 0.0.0.0, fault address 0x00cb96bc.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 63 62 set 00cb
0050: 39 36 62 63 96bc

 

[Leonard Grey]

The Generic Host Service (svchost) is a host for other services. You
want to find out which underlying service is causing the problem.

Process Explorer will show you which processes are being hosted by
svchost. This is your starting point towards identifying which process
causes the problem. (My guess is malware.)

Get Process Explorer here:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

 

[nass]

This is a persistent problem I have had for many months. I have McAfee
running all the time; I've run scans, I've run Adware; I've run chkdsk; I
even backed off SP3 and reinstalled it - all to no avail. The error dumps
fill up my HD requiring me to delete the files periodically. Also, explre
runs VERY slow when I open a folder for the first time. I have an ACER
Aspire 5000 notebook w/ AMD Turion and 1.2GB memory. I have a ton of error
msgs in event viewer. It appears that a new one is created even when I'mnot
doing anything. Below is a sample. Please help.
-Tom

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 12/29/2008
Time: 9:59:40 AM
User: N/A
Computer: ACER
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module
unknown, version 0.0.0.0, fault address 0x00cb96bc.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 63 62 set 00cb
0050: 39 36 62 63 96bc

Do you get a DEP error message with this and the win32 error message?
Check your RAM by running a test, most computer has a Diagnostic tools for
HDD, RAM, CD, Mobo and other components!

Run a thorough scan by doing the following steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
Download and Update SuperAntispyware and run a complete scan - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Comodo BOClean : Anti-Malware Version 4.27
http://www.comodo.com/boclean/boclean.html

If you wish to send me your Hijackthis log I will be happy to help you
further or send to one of many forums on the internet!
Download Hijackthis and send me the log.
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)
my address is : to_you_ross(at remove this and repalce with the
obvious)yahoo.co.uk ( _ is underscore)

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/builds/downloading-slim
Run Disk Clean Up on your Drive.
HTH,
nass

 

[Tom]

This is a persistent problem I have had for many months. I have McAfee
running all the time; I've run scans, I've run Adware; I've run chkdsk; I
even backed off SP3 and reinstalled it - all to no avail. The error dumps
fill up my HD requiring me to delete the files periodically. Also, explre
runs VERY slow when I open a folder for the first time. I have an ACER
Aspire 5000 notebook w/ AMD Turion and 1.2GB memory. I have a ton of error
msgs in event viewer. It appears that a new one is created even when I'mnot
doing anything. Below is a sample. Please help.
-Tom

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 12/29/2008
Time: 9:59:40 AM
User: N/A
Computer: ACER
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module
unknown, version 0.0.0.0, fault address 0x00cb96bc.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 63 62 set 00cb
0050: 39 36 62 63 96bc

Do you get a DEP error message with this and the win32 error message?
Check your RAM by running a test, most computer has a Diagnostic tools for
HDD, RAM, CD, Mobo and other components!

Run a thorough scan by doing the following steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
Download and Update SuperAntispyware and run a complete scan - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Comodo BOClean : Anti-Malware Version 4.27
http://www.comodo.com/boclean/boclean.html

If you wish to send me your Hijackthis log I will be happy to help you
further or send to one of many forums on the internet!
Download Hijackthis and send me the log.
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)
my address is : to_you_ross(at remove this and repalce with the
obvious)yahoo.co.uk ( _ is underscore)

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/builds/downloading-slim
Run Disk Clean Up on your Drive.
HTH,
nass

Nass - Thank you very much for your help! I did everything that both you
and Leonard suggested, but I still have the problem. I suspect that malware
may not be causing my problem. Yes, I'm getting the DEP and Win32 msgs every
time I boot the system. I noticed that it only occurs if a svchost.exe dump
file exists. I can usually avoid these msgs if I delete those files before I
re-boot. I monitor that directory while I'm running and I can see when a dump
file appears. It happens consistently when I launch Explore or IE. A
potential memory problem never occured to me. I'm not aware of any
diagnostic tool that came with my system. Can you recommend one that won't
require creation of a boot disk?

I'm sending you the Hijackthis log file.
-Tom

 

[nass]

Nass - Thank you very much for your help! I did everything that both you
and Leonard suggested, but I still have the problem. I suspect that malware
may not be causing my problem. Yes, I'm getting the DEP and Win32 msgs every
time I boot the system. I noticed that it only occurs if a svchost.exe dump
file exists. I can usually avoid these msgs if I delete those files before I
re-boot. I monitor that directory while I'm running and I can see when a dump
file appears. It happens consistently when I launch Explore or IE. A
potential memory problem never occured to me. I'm not aware of any
diagnostic tool that came with my system. Can you recommend one that won't
require creation of a boot disk?

I'm sending you the Hijackthis log file.
-Tom

Hi Tom,
That make things easy a little bit!
The DEP can occur if you installed a new security software or an Unsigneed
driver like Scanner, Printer or a general driver for a new hardware.

We can tell to turn off the DEP message but my worries is it can be more
than that and we just killing the system by shutting/disabling the DEP!

Let me know if you installed new hardware/updates recently and also for the
record I have found that an old security suite (the left over/behind
orphans/folders) can cause the same issue.

If you can send me the Dump file that will be great too!

 

[nass]

Hi Tom,
That make things easy a little bit!
The DEP can occur if you installed a new security software or an Unsigneed
driver like Scanner, Printer or a general driver for a new hardware.

We can tell to turn off the DEP message but my worries is it can be more
than that and we just killing the system by shutting/disabling the DEP!

Let me know if you installed new hardware/updates recently and also for the
record I have found that an old security suite (the left over/behind
orphans/folders) can cause the same issue.

If you can send me the Dump file that will be great too!

Windows Memory Diagnostic
http://oca.microsoft.com/en/windiag.asp

And you can download the Diagnostic tool/utility from here:
http://global.acer.com/support/download.htm