How do I determine which service caused this error?

[unacoder]

How can I determine which service caused DEP to terminate the Generic
Host Process?

I received the following error:

Data Execution Prevention

Generic Host Process


Is there a way I can see which service did this?

Thanks,
Dan

 

[Sharon F]

How can I determine which service caused DEP to terminate the Generic
Host Process?

I received the following error:

Data Execution Prevention

Generic Host Process


Is there a way I can see which service did this?

Thanks,
Dan

Generic Host Process can host many programs and parts of programs. So the
question really is what program is not being allowed by DEP. I do not know
the answer but here is a link to an article that tells more about DEP.
Perhaps you'll find something useful in it.

A detailed description of the Data Execution Prevention (DEP) feature in
Windows XP Service Pack 2, Windows XP Tablet PC Edition 2005, and Windows
Server 2003
http://support.microsoft.com/kb/875352

 

[UnaCoder]

I've already read the article as well as a describtion for how svchost
works, what I'm trying to do is use the error message to determine
which service DEP doesn't like, so I can determine if it is a bug or
otherwise. Or at the very least disable the offending service if it's
not needed. Somebody has to know how to do this...

Thanks for the reply though,
Dan

 

[Sharon F]

I've already read the article as well as a describtion for how svchost
works, what I'm trying to do is use the error message to determine
which service DEP doesn't like, so I can determine if it is a bug or
otherwise. Or at the very least disable the offending service if it's
not needed. Somebody has to know how to do this...

For finding out what bit of code is being hosted by Generic Host process
(and then getting stomped on by DEP), what about using something like
process explorer?
http://www.sysinternals.com/Utilities/ProcessExplorer.html

 

[UnaCoder]

I actually obtained that utility earlier today. I wasn't able to
locate anything in the DLL list that matched the address given by the
error message... I think (I'm just guessing here) that based on the
addresses that I see the other svchost processes running under that the
address in the message is the load address of the scvhost process that
was terminated... All the module addressed seem to be quite a bit
higher.

So, that leads me to a second question. How would I be able to use the
memory and stack dump files that are created to do error submission to
microsoft to determine which service was causing dep to kill svchost?

On a side note:

I corrected the issue. I noticed the at the same time the error popped
up the HP background software was being started and terminated watching
the process list with ProcessExplorer. I found a driver patch on HP's
web site that corrected the issue. If anyone has an HP all in one and
was getting the error I started this thread with, try this HP driver
patch:

http://h10025.www1.hp.com/ewfrf/wc/...=420428&lang=en&cc=us&softwareitem=oj-27722-1

That solved the issue with out having to reconfigure DEP (which
wouldn't be a fix, it would be a hack).

I would still like to find out how to use the memory dump files to
determine the source of the problem so I don't have to guess, I can go
straight to the issue.

Thanks in advance for any insight!

-Dan

 

[Sharon F]

On a side note:

I corrected the issue. I noticed the at the same time the error popped
up the HP background software was being started and terminated watching
the process list with ProcessExplorer. I found a driver patch on HP's
web site that corrected the issue.

I'm glad to hear you were finally able to track down the offending process.
I don't know the answers to your other questions. Sorry.