Generic Host Process for Win32 Services

[jaredhattaway]

Over the last week and a half we have started having random XP(SP3) machines
encounter an error "Generic Host Process for Win32" failed.

It appears that Data Execution Prevention is intercepting and shutting down
the service.

I have installed a fresh OS and patched and have still seen the error occur.
This does not happen on all systems, and I can not find any commonalities.

I have also already clicked on every post on the first 5 pages of Google.
And have tried all the published solutions.

The KB articles referencing this message do not apply.

Any help is appreciated.

Error Signature:
EventType: BEX
P1: svchost.exe
P2: 5.1.2600.5512
P3: 48025bc0
P4: unknown
P5: 0.0.0.0
P6: 00000000
P7: 5a6ebbee
P8: c0000005
P9: 00000008

 

[Gerry]

Jared

The error 0xC0000005 is generated by an illegal "memory access violation".
This can be caused by anything from faulty RAM, an incorrect/corrupt device
driver, poorly written/updated software and more commonly under Windows XP
Service pack 2, malware/adware installations.
Source: http://www.updatexp.com/0xC0000005.html

Does the error occur during or after the boot process?

The problem is being caused by whatever is calling svchost.exe. This can
difficult to determine.

Can you tell me where you are getting the Error report from?

Can you get the same error using safe mode?

What are the anti-virus and anti-spyware arrangements?

You might spot something using HijackThis but interpreting a HijackThis log
is a task for a specialist.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[jaredhattaway]

Gerry,

Thanks for the response:

All systems that this is happening to are running Symantec Endpoint
Protection for Anti-Virus and Anti-Spyware.

I have already done an in-depth scan for spyware using a variety of tools
and have come up blank.

This error occurs during a normal boot-up, after logon as the desktop is
becoming available.

It appears to not occur when running in safe mode.

Any guidance is appreciated.

-Jared

 

[Gerry]

jared

Does the error occur if you prevent Symantec Endpoint from loading?

Can you tell me where you are getting the Error report from?

Are there any other errors before this error occurs?

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[jaredhattaway]

Gerry,

I just tried explicitly preventing Symantec from loading (same result).

Then to eliminate Symantec, I've removed it from the system I am working on.

The error data is coming from the "Send Error Report" details dialog box.

There are no other errors prior to (or after) receiving this one.

-Jared

 

[Gerry]

Jared

Instead of relying on the "Send Error Report" details use Event Viewer.

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

Have you tried a logged boot?
A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315222


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~