Generic Host Process error

[Carlos]

Everytime I boot I get this. I have run TrendScan, Ad-Aware, NAV, Spybot, MS
Anti-spyware in safe mode, no virus. I also looked at the MS KB article on
HP printers and that is not it. Usually accompanied by a svchost.exe error
indicated a memory could not be read. Have also tried this without NAV and
firewall to no avail. If I click "Send Error Report" applications will not
launch - including Windows shutdown.


Generic Host Process for Win32 Services has encountered a problem and needs
to close. We are sorry for the inconvenience.

szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

Faulting application svchost.exe, version 5.1.2600.2180, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Something is trying to communicate or launch and cannot.

Any ideas?

 

[Mark L. Ferguson]

If you run an XP "Upgrade"setup, from the original, or "Gold" version of the setup CD, and you have SP2 installed, it might go into
a setup loop, and you could lose your install. Uninstall SP2, BEFORE you Upgrade setup from CD (that lacks sp2 on it.)

875350 - How to remove Windows XP Service Pack 2 from your computer: http://support.microsoft.com/default.aspx?kbid=875350

How to Perform a Windows XP Repair Install: http://michaelstevenstech.com/XPrepairinstall.htm

 

[EasyFeelings]

ok, sounds like Norton anti-virus has a problem.

try going into safe mode and uninstalling norton.

while in safe mode you might try running:

http://housecall.trendmicro.com/housecall/start_corp.asp

it's a free virus scan.

good luck.


--
EasyFeelings
A+
MCP
MCSA

"When your computer is working good, That's an EasyFeeling"

 

[Carlos]

Thanks Easy....I'm curious as to why you think it's the NAV?

 

[EasyFeelings]

svchost.exe is your part of your Norton, it also the .exe for a few other
programs.

my first thought is your Norton needs fresh installed.

so to answer your question....... just gut feeling.



--
EasyFeelings
A+
MCP
MCSA

"When your computer is working good, That's an EasyFeeling"

 

[Malke]

svchost.exe is your part of your Norton, it also the .exe for a few
other programs.

my first thought is your Norton needs fresh installed.

so to answer your question....... just gut feeling.

Svchost.exe is *not* part of any Norton products. It is a native Windows
executable. Here is an explanation of Svchost.exe:

http://support.microsoft.com/?kbid=314056

Carlos, you haven't given us enough information about your system to
troubleshoot in more detail. What changed between the time things
worked and the time they didn't? What makes you think "something is
trying to communicate..."? Do you have a firewall installed? If so,
what do the logs say?

You can also do some clean boot troubleshooting:

http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
Clean Boot in Windows XP

Give us some information about your physical system. There is always the
possibility that this is not a software issue, but there is no way to
tell from your two posts so far.

Malke

 

[Carlos]

Okay, Malke - I'l try.
Really, the problem started almost immediately after I installed SP2 - that
wasthe biggest change.
This happens without a firewall running.
The only logs I can think of are even viewer and I've posted that info
below.
szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

Faulting application svchost.exe, version 5.1.2600.2180, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Sometimes I only get the Generic Host process error message, sometimes I get
a svchost.exe error message indicatione some memory could not be "read".
Sometimes I get both messages.


This is what Nighrider says:
This is not a spy ware / virus issue this is a corrupted profile. Backup the
user data from the profile by renaming it to Example C:\Documents and Setti
ngs\administrator.old ECT make sure that you have turned off hide protected
files and show hidden system files then log back in viola the problem is gon
e I have extensively researched this issue and this is a consistent fix. The
temp files located in C:\Documents and Settings\Administrator\Local Setting
s\Temp become corrupted due to a delay in login or a system failure during l
ogin or any other excuse MS may give but this is a pretty wide spread issue
and happens more often when using roaming profiles on a network server. Dele
ting the tmp files running Adaware and or a virus tool is a good idea to do
anyway but this will not resole the issue.


Night Rider

 

[Malke]

Okay, Malke - I'l try.
Really, the problem started almost immediately after I installed SP2 -
that wasthe biggest change.
This happens without a firewall running.
The only logs I can think of are even viewer and I've posted that info
below.
szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

Faulting application svchost.exe, version 5.1.2600.2180, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.

Sometimes I only get the Generic Host process error message, sometimes
I get a svchost.exe error message indicatione some memory could not be
"read". Sometimes I get both messages.


This is what Nighrider says:
This is not a spy ware / virus issue this is a corrupted profile.
Backup the
user data from the profile by renaming it to Example C:\Documents and
Setti
ngs\administrator.old ECT make sure that you have turned off hide
protected files and show hidden system files then log back in viola
the problem is gon e I have extensively researched this issue and this
is a consistent fix. The
temp files located in C:\Documents and Settings\Administrator\Local
Setting
s\Temp become corrupted due to a delay in login or a system failure
during l ogin or any other excuse MS may give but this is a pretty
wide spread issue and happens more often when using roaming profiles
on a network server. Dele ting the tmp files running Adaware and or a
virus tool is a good idea to do anyway but this will not resole the
issue.

I don't know who Nightrider is, but since the problem occurred
immediately after installing SP2, you have a pretty clear
cause-and-effect. Here are some links to free MS tech support to help
with SP2 issues:

SP2 Support Center
http://support.microsoft.com/default.aspx?&pr=windowsxpsp2

Welcome to the Microsoft Windows XP Service Pack 2 (SP2) Chat (no-charge
online support):
http://support.microsoft.com/default.aspx?pr=Wxpsp2chat

I think I'd try MS first. Since the support is free, it can't hurt.

Malke

 

[Carlos]

Malke - are you still here?

Well, I tried someting I saw in another forum to no avail - that is,
disabling DEP for svchost. Didn't fix it.

Here are some of the errors from the event viewer that occur durig the
Windows boot - about the same time this error comes up - I've been getting
two errors - one is a svchost about a memory that could not be "read", the
other is the Generic Host Process for Win32 Services has encountered a
Problem and Needs to Close. It includes this:
szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
szModVer : 5.1.2600.2180 offset : 000105f8

From the event viewer at the time in reboot the errors occur, some examples
(all seem to be the Service Control Manager):

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 2/15/2005
Time: 7:07:38 AM
User: N/A
Computer: DBZXXZ11
Description:
The Application Management service terminated with the following error:
The specified module could not be found.

Description:
The Human Interface Device Access service terminated with the following
error:
The specified module could not be found.

Description:
Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA)
service to connect.

Description:
The Windows Image Acquisition (WIA) service failed to start due to the
following error:
The service did not respond to the start or control request in a timely
fashion.

Description:
The Routing and Remote Access service terminated with service-specific error
2147483720 (0x80000048).

Description:
The IPv6 Helper Service service terminated unexpectedly. It has done this 1
time(s).

Description:
The Windows Audio service terminated unexpectedly. It has done this 1
time(s).

Description:
The Background Intelligent Transfer Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken
in 60000 milliseconds: Restart the service.

Description:
The Computer Browser service terminated unexpectedly. It has done this 1
time(s).

Description:
The Cryptographic Services service terminated unexpectedly. It has done
this 1 time(s).

Description:
The Automatic Updates service terminated unexpectedly. It has done this 1
time(s).

There are at least a dozen or so more of these in the event viewer sys log,
and this in the application log:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 30 35 66 38 05f8

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.

 

[Guest]

HI Carlos, I'm new on this thread...but I have the same problem you do. I
have a new notebook, and have had this problem almost since the beginning. I
didn't note
exactly when it started (dumb, I know!) but it was in the same session when
I installed Norton. This morning I booted up and didn't get the error until
I noticed that the Norton icon in the tray had "Auto Protect Disabled". When
I enabled it, the SVCHOST.EXE Application Error showed up.

 

[Malke]

Malke - are you still here?

Yes, I'm still here. See my comments after your post. Even though it's
lengthy, I didn't want to snip any of your post because the details are
important.

Well, I tried someting I saw in another forum to no avail - that is,
disabling DEP for svchost. Didn't fix it.

Here are some of the errors from the event viewer that occur durig the
Windows boot - about the same time this error comes up - I've been
getting two errors - one is a svchost about a memory that could not be
"read", the other is the Generic Host Process for Win32 Services has
encountered a Problem and Needs to Close. It includes this:
szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : ntdll.dll
szModVer : 5.1.2600.2180 offset : 000105f8

From the event viewer at the time in reboot the errors occur, some
examples (all seem to be the Service Control Manager):

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 2/15/2005
Time: 7:07:38 AM
User: N/A
Computer: DBZXXZ11
Description:
The Application Management service terminated with the following
error: The specified module could not be found.

Description:
The Human Interface Device Access service terminated with the
following error:
The specified module could not be found.

Description:
Timeout (30000 milliseconds) waiting for the Windows Image Acquisition
(WIA) service to connect.

Description:
The Windows Image Acquisition (WIA) service failed to start due to the
following error:
The service did not respond to the start or control request in a
timely fashion.

Description:
The Routing and Remote Access service terminated with service-specific
error 2147483720 (0x80000048).

Description:
The IPv6 Helper Service service terminated unexpectedly. It has done
this 1 time(s).

Description:
The Windows Audio service terminated unexpectedly. It has done this 1
time(s).

Description:
The Background Intelligent Transfer Service service terminated
unexpectedly.
It has done this 1 time(s). The following corrective action will be
taken in 60000 milliseconds: Restart the service.

Description:
The Computer Browser service terminated unexpectedly. It has done
this 1 time(s).

Description:
The Cryptographic Services service terminated unexpectedly. It has
done this 1 time(s).

Description:
The Automatic Updates service terminated unexpectedly. It has done
this 1 time(s).

There are at least a dozen or so more of these in the event viewer
sys log,
and this in the application log:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6e 74 64 6c 6c 2e n ntdll.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 30 35 66 38 05f8

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/15/2005
Time: 7:07:07 AM
User: N/A
Computer: DBZXXZ11
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x000105f8.

You have a huge amount of services failing. You didn't mention anything
about your physical computer - the hardware, age, if this just started
happening, and if you can pinpoint when things changed.

You've already done all the virus scanning, and it doesn't sound to me
like that's the issue anyway. It sounds more to me like you are having
some real hardware failures. I'll give you the general hardware
troubleshooting steps; if you need more details about any of them, let
me know.

1) Open the computer and run it open, cleaning out all dust bunnies and
observing all fans (overheating will cause system freezing). Obviously
you can't do this with a laptop, but you can hear if the fan is running
and feel if the laptop is getting too hot.

2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
have to get the program from a working machine. You will either
download the precompiled Windows binary to make a bootable floppy or
the .iso to make a bootable cd. If you want to use the latter, you'll
need to have third-party burning software on the machine where you
download the file - XP's built-in burning capability won't do the job.
In either case, boot with the media you made. The test will run
immediately. Let the test run for an extended period of time - unless
errors are seen immediately. If you get any errors, replace the RAM.

3) Test the hard drive with a diagnostic utility from the mftr. Usually
you will download the file and make a bootable floppy with it. Boot
with the media and do a thorough test. If the drive has physical
errors, replace it.

4) The power supply may be going bad or be inadequate for the devices
you have in the system - this isn't applicable to a laptop, of course.
I don't think this is your issue, but I'm leaving it in to be thorough.

5) Test the motherboard with something like TuffTest from
www.tufftest.com. Sometimes this is useful, and sometimes it isn't.

Testing hardware failures often involves swapping out suspected parts
with known-good parts. If you can't do the testing yourself and/or are
uncomfortable opening your computer, take the machine to a good local
computer repair shop (not a CompUSA or Best Buy type of store).

Good luck, and let me know if you need more help.

Malke

 

[Carlos]

My responses after your numbered points.

Yes, I'm still here. See my comments after your post. Even though it's
lengthy, I didn't want to snip any of your post because the details are
important.

You have a huge amount of services failing. You didn't mention anything
about your physical computer - the hardware, age, if this just started
happening, and if you can pinpoint when things changed.

You've already done all the virus scanning, and it doesn't sound to me
like that's the issue anyway. It sounds more to me like you are having
some real hardware failures. I'll give you the general hardware
troubleshooting steps; if you need more details about any of them, let
me know.

1) Open the computer and run it open, cleaning out all dust bunnies and
observing all fans (overheating will cause system freezing). Obviously
you can't do this with a laptop, but you can hear if the fan is running
and feel if the laptop is getting too hot.

Done last week to no avail.

2) Test the RAM - I like Memtest86+ from www.memtest.org. Obviously, you
have to get the program from a working machine. You will either
download the precompiled Windows binary to make a bootable floppy or
the .iso to make a bootable cd. If you want to use the latter, you'll
need to have third-party burning software on the machine where you
download the file - XP's built-in burning capability won't do the job.
In either case, boot with the media you made. The test will run
immediately. Let the test run for an extended period of time - unless
errors are seen immediately. If you get any errors, replace the RAM.

Ran memtest a few dozen times AND replaced the RAM to no avail last week.
skip to the bottom...

3) Test the hard drive with a diagnostic utility from the mftr. Usually
you will download the file and make a bootable floppy with it. Boot
with the media and do a thorough test. If the drive has physical
errors, replace it.

4) The power supply may be going bad or be inadequate for the devices
you have in the system - this isn't applicable to a laptop, of course.
I don't think this is your issue, but I'm leaving it in to be thorough.

5) Test the motherboard with something like TuffTest from
www.tufftest.com. Sometimes this is useful, and sometimes it isn't.

Testing hardware failures often involves swapping out suspected parts
with known-good parts. If you can't do the testing yourself and/or are
uncomfortable opening your computer, take the machine to a good local
computer repair shop (not a CompUSA or Best Buy type of store).

Good luck, and let me know if you need more help.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

I'm no expert, however, having read about this same story all over the web,
I do not think it is hardware - more like NAV or something interfering with
the svchost. I'm going to try to uninstall my NAV and install a later
version.

 

[Carlos]

Same here Ellie - I'm starting to think this is more and more Norton. What
version do you have? I have Norton Anti Virus Corporate Edition version
7.61.928.
I think the real time protection is shutting out the svchosts.

 

[Malke]

Carlos wrote:

(snip all the stuff because we'll need a drink soon, right?)

I'm no expert, however, having read about this same story all over the
web, I do not think it is hardware - more like NAV or something
interfering with
the svchost. I'm going to try to uninstall my NAV and install a later
version.

OK, try uninstalling NAV. Don't install it again. Of course I'm not
telling you to go naked - just disconnect from the Internet and see
what happens. Then put on a different av, just to try it. Maybe AVG
because it's free and therefore won't cost you anything to test.

Let me know what happens.

Malke

 

[Carlos]

Okay - did that. No difference.
Also getting this:

Event ID 7024
The Routing and Remote Access service terminated with service-specific error
2147483720 (0x80000048).

Comes after the WIA errors in the log.
All svchost related.

 

[Carlos]

Yeah, I need a drink! I'm going to uninstall my Kodak Easyshare software
next - one of the few remaining potential culprits.

 

[Malke]

Yeah, I need a drink! I'm going to uninstall my Kodak Easyshare
software next - one of the few remaining potential culprits.

OK, try that. I've also heard that Kodak Easyshare can cause major
problems. Let me know.

Malke

 

[yummycheese]

Sometimes I get that error when I turn on my computer. It doesn't
really bother me much. All of my programs run fine.

 

[Guest]

All my programs run fine after I clear away this error message, except that I
am not able to install the new version of MSN Messenger. I get a long
"installer information" box that includes something about win32.

I have a Dell Inspiron 4000 with Windows XP Pro (SP2). My machine has 512
MB RAM, PIII 800 Mhz, 20 GB HD. I am running Norton 2003 v6.01.

Any other ideas or should I do what Malke suggested for Carlos?

Thanks.

 

[Guest]

Hi there,
I've had this problem for a while now...I found the source of the problem.
As for my experience, I new I had a corrupt winsock(I did run a check
through MS website to check if the winsock was corrupt and it was), so what I
did was a winsock fix, which required a tcp/ip reinstall. So I did that and
obtained this error that you all have been getting(Win32 Generic Host
Process). I did a system restore and things were back to normal, but I was
still unable to access some sites. Well I think that is the source of the
problem, now if someone could figure out how to fix it, then it would be
greatly appreciated. I did get it to work one day, by chance I had to setup
my network because I was unable to share my files, so I did that and
everything seemed to work. Able to access the sites that I wasn't able to
and no more generic host error message. hope someone could figure this one
out. Hope this helps to finding a solution.
-Victor