svchost.exe application error -> RPC shutdown

[Rully]

Dear experts,

I hope someone here has some good advice, because I really don't know what
to do.

When booting into Windows XP Pro SP2, I get an error message: "The
instruction at "0x751d379d" referenced memory at "0xffcb8375". The memory
could not be "written". Click on OK to terminate the program. Click on CANCEL
to debug the program."

Closing the window allows me to boot fully into XP, but then I get the
infamous shut down in 60 seconds message:" the system is shutting down.
Please save all work in progress and log off. This request was initiated by
NT Authority\system. Message: Windows must restart because the RPC service
terminated unexpectedly." And then it counts down from 60 seconds, after
which it reboots.

I can stop this using the DOS prompt of course (shutdown -a), but Windows is
still behaving strange: some programs won't start or they behave abnormally,
the Windows key doesn't work, minimized windows do not appear in the taskbar,
etc.

I'm using AVG fully up-to-date (antivirus, anti spyware & anti rootkit)
software. Also, windows XP are fully updated with service pack two, latest
patch, security hotfix, etc.

 

[Gerry]

Please post copies of all Error and Warning Reports appearing in
the System and Application logs in Event Viewer for the last boot. No
Information Reports or Duplicates please. Indicate which also appear in
a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using copy
and paste. Often the link will, however, say there is no further
information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Rully]

Ok. Here's the error:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 04/12/2007
Time: 15:16:05
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379d" referenced memory at "0xffcb8375". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and also there's no yellow marks in device manager. Oh I forgot, sometimes
the error & DCOM things doesn't show up.

I still waiting for your & others help. Thanks.

-- Rully

 

[Gerry]

What are your anto-virus and anti-spyware arrangements?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Rully]

Hm ... I don't know. I'm using free AVG (anti-virus, anti-spyware &
anti-rootkit).
But I don't think it's a virus or spyware things.

Argh ... error again. It's different error now. I think it's come from Yahoo
Messenger. I remove the start up registry of Yahoo Messenger from Safe Mode &
Windows run normally. By the way, how to remove Yahoo Messenger from start up
permanently?

Fiuh ...

Ok, here's the error:

1. From Event Viewer (System):

a. Login

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 06/12/2007
Time: 7:18:34
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379a" referenced memory at "0x00000000". The memory could not be
"read".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b. 60 second shut down things!

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 06/12/2007
Time: 7:25:04
User: NT AUTHORITY\SYSTEM
Computer: RAN
Description:
The process winlogon.exe has initiated the restart of RAN for the following
reason: No title for this reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the Remote Procedure Call (RPC)
service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...

c. reboot (same error with login)


2. From Event Viewer (Application):

a.

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 06/12/2007
Time: 7:22:31
User: N/A
Computer: RAN
Description:
The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of
d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact
Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 06/12/2007
Time: 7:24:01
User: N/A
Computer: RAN
Description:
Faulting application yahoomessenger.exe, version 8.1.0.421, faulting module
wshbth.dll, version 5.1.2600.2180, fault address 0x0000379a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 79 61 68 ure yah
0018: 6f 6f 6d 65 73 73 65 6e oomessen
0020: 67 65 72 2e 65 78 65 20 ger.exe
0028: 38 2e 31 2e 30 2e 34 32 8.1.0.42
0030: 31 20 69 6e 20 77 73 68 1 in wsh
0038: 62 74 68 2e 64 6c 6c 20 bth.dll
0040: 35 2e 31 2e 32 36 30 30 5.1.2600
0048: 2e 32 31 38 30 20 61 74 .2180 at
0050: 20 6f 66 66 73 65 74 20 offset
0058: 30 30 30 30 33 37 39 61 0000379a
0060: 0d 0a ..

 

[Gerry]

Rully

Yahoo Messenger

Use Autoruns to find any unwanted start ups!
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from starting,
or you can can right click an item and then delete it. If you uncheck
you can recheck to re-enable the item. It is a much safer approach than
editing the Registry. Another useful feature of the programme is that
you can right click an item and select Search Online to get information
about the item selected.

Select Start, Control Panel, Administrative Tools, Services. Is the
Start Up type for COM + Event service set to Manual?

Another thought is to create a new User Profie for yourself.
How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/kb/811151/en-us


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Rully]

Ok. Yahoo Messenger problem, solve.

I'd already try Autoruns. But I don't know which programs should or
shouldn't when start up.

Start Up type for COM + Event service is set to Manual. I have to change it
to Automatic?

About the error on the first post on this thred, still show up. Sometimes
run normally (without error), if I switch to Safe Mode and switch to Windows
Normally.
Hm ... I don't know. I still confuse.

 

[Gerry]

Rully

Leave the COM + Event service st to manual.

Are all your Windows Update being successfully installed? Check for
failures.

Select, Start, Help and Support, Keep your Windows up- to-date with
Windows Update, Review your Update History and check the Status Column?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Rully]

All Windows Update status are succeeded.

Ok. What's next?

 

[Rully]

Install XP Service Pack 3. Problem solved! Thanks all for your help.