Svchost.exe generating problems - PC is hanging - have to reboot

[Harald]

Hi

On our network with about 25 PCs (all with XP SP2 (one with SP3 - also has
problem)), some of the PCs have problems with Svchost.exe.

The error message they get is: "Generic Host Process for Win32 Services has
encountered a problem and needs to close. We are sorry for the
inconvenience".

If I look into the error signature details I find: szAppName: svchost.exe
szAppVer: 5.1.2600.2180 szModName: TSP5.tsp szModVer: 5.0.980.0
Offset: 0000e203

After the report has been sent to Microsoft the PC is hanging and the PC
must be rebooted. Before sending the report you can continue working on the
PC (leave the error message on the desktop)



The strange thing is that the PCs some time stops with the error message at
the same time. I have searched out Exchange/File server to se if there was
any related error messages, but I can't find.



I have disabled "Windows update" on two of the PCs without any result. (Have
manually run Windows update to be sure they are up to date). I have also
installed SP3 on one of the PCs, and still that PC has problems.

The PCs has been scanned with Windows Defender, Trend Micro Anti virus, and
Spybot S&D. No problem can be found.

I have searched the Internet without find any solution. Some products are
advertising for "solving all svchost.exe problems" (True Sword). I am not
sure if I can trust the product (True Sword), as it for me is not a known
product.



Please let me know if you have any suggestion on how to proceed.



Thanks

Harald

 

[JS]

You can find additional info about Svchost.exe entries using Process
Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and 'Show Lower
Pane' options.
(This will provide some of the detailed info you may need)
Expand the Process tree until 'Services.exe' has been expanded.
Next move the mouse cursor over the Svchost.exe process that you are
interested in.
Or expand the Svchost entry if you see a + sign to the left of Svchost
entry.
(You should now see a pop up with a list of services associated with the
Svchost.exe you chose)
Next double click on the Svchost.exe process that you are interested in.
The 'Properties' Window should now be displayed with numerous tabs
available.

JS

 

[Gerry]

Harald

Can you please post a complete copy of the Error Report from Event
Viewer.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

What are you actually doing before the problem appears? It is likely to
be an application or add-on using svchost.exe, which is causing the
problem.

JS has suggested using Process Explorer. The command line on the Image
tab of the copy of svchost showing cpu usage might help but it may that
the error occurs so quickly you do not get a chance to determine the
problematic svchost process.

Conflicting comments regarding True Sword

http://www.symantec.com/security_response/writeup.jsp?docid=2006-062816-5804-99&tabid=1

http://www.spywarewarrior.com/rogue_anti-spyware.htm#tsword_note

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Harald]

Hi Gerry



Thanks for you help and the info about True Sword. This is definitely an
application I don't want to use..

Below is the info I pasted from the description part of the event
properties. Hopefully it was this info you requested?

The event category is (100) and Event ID = 1000

Faulting application svchost.exe, version 5.1.2600.2180, faulting module
TSP5.tsp, version 5.0.974.0, fault address 0x0000e260.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

This info is copied from a PC running XP SP2

-----

You asked: What are you actually doing before the problem appears?

The difficult is that it some time happened on more than on PC at the same
time. Some is working in Outlook, other in Excel or another application. I
can not see any common application. This was the reason for thinking about
it could be something on exchange / file server (I wrote: I have searched
our Exchange/File server to se if there was any related error messages, but
I can't find.)



Thanks for helping

Harald

 

[Gerry]

Harald

It may be a guess but the problem could relate to an application using
the telephony service. Files with a tsp file extension:
http://filext.com/file-extension/TSP

Two types of application you might be using, which might need this
service.

Fax software.

Call Manager software.

I use WinFax Pro and I can start WinFax Pro from Word or Excel. I have
not used Outlook. I would imagine much commercial fax software can be
used in this way. I have had no experience of Call Manager software but
I would imagine it works in a similar manner.

The problem lies with the Application using the svchost process to
access tsp5.tsp. If you right click on the TSP5.tsp file and select
properties you could find the name of the software provide, who created
the file.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Harald]

Hi Gerry



Thanks a lot for helping. Yes I have a TAPI application installed on the PCs
that have the problem (but my PC is running fine with the application?). I
have now removed the application and I have not seen the problem after
uninstalling.



Again: Thanks a lot for helping.

Harald

 

[Gerry]

You're welcome.



~~~~


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~