svchost.exe

A

Andre

I just started getting a svchost.exe error when I reboot my machine.
Nothing new has been installed on it hardware or software wise, and I can't
find any articles about this particular message. Can anyone help?

svchost.exe - Application error
The instructions at "0x0009a96bc" referenced memory at "0x000000000". The
memory could not be "written"

In event log it's event id 7034 and the source is Service Control Manager.
The Description is:
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has
done this 1 time(s).

Thanks in advance.

Andre
 
J

Juan Perez

Hi:

I have some references with printer or multifuncion software that may cause
problems. Did you have installed any of these devices may be from Canon, HP
or Epson?
 
J

Juan Perez

Hi:

I was checking around and found that the probable cause of the problem is in
the HP software, that may interfere with the DEP (Data execution
prevention). You can disable that as a workaround but just a temporal
solution. You need to get in contact with HP and get the latest version of
the software of your HP multifuntion.

--

Un saludo

Juan Perez

P.D.:

Also found this info:

Data Execution Prevention

What does data execution prevention do?

Data execution prevention (DEP) is a set of hardware and software
technologies

that perform additional checks on memory to help protect against malicious
code

exploits. In Windows XP SP2, DEP is enforced by both hardware and software.

Hardware-enforced DEP

Hardware-enforced DEP marks all memory locations in a process as
non-executable

unless the location explicitly contains executable code. There is a class of

attacks that attempt to insert and execute code from non-executable memory

locations. DEP helps prevent these attacks by intercepting them and raising
an

exception.

Hardware-enforced DEP relies on processor hardware to mark memory with an

attribute that indicates that code should not be executed from that memory.
DEP

functions on a per-virtual memory page basis, usually changing a bit in the
page

table entry (PTE) to mark the memory page.

The actual hardware implementation of DEP and marking of the virtual memory
page

varies by processor architecture. However, processors that support

hardware-enforced DEP are capable of raising an exception when code is
executed

from a page marked with the appropriate attribute set.

Both Advanced Micro DevicesT (AMD) and Intel® Corporation have defined and
shipped

Windows-compatible architectures that are compatible with DEP.

Beginning with Windows XP Service Pack 2, the 32-bit version of Windows
utilizes

the no-execute page-protection (NX) processor feature as defined by AMD or
the

Execute Disable bit feature as defined by Intel. In order to use these
processor

features, the processor must be running in Physical Address Extension (PAE)
mode.

The 64-bit versions of Windows XP uses the NX processor feature on 64-bit

extensions and certain values of the access rights page table entry (PTE)
field on

IPF processors.

It is hoped that all future 32-bit and 64-bit processors will provide
support for

hardware-enforced data execution prevention. Microsoft continues to work
with

processor vendors to encourage the adoption and development of DEP
technologies.

Software-enforced DEP

An additional set of data execution prevention security checks have been
added to

Windows XP SP2. These checks, known as software-enforced DEP, are designed
to

mitigate exploits of exception handling mechanisms in Windows.
Software-enforced

DEP runs on any processor which is capable of running Windows XP SP2. By
default,

software-enforced DEP only protects limited system binaries, regardless of
the

hardware-enforced DEP capabilities of the processor.

Who does this feature apply to?

Application and driver developers should be aware of data execution
prevention and

the requirements of software running on a supporting platform. Applications
that

perform just-in-time (JIT) code generation or execute memory from the
default

process stack or heap should pay careful attention to DEP requirements.

Driver developers are encouraged to be aware of PAE mode on platforms
supporting

hardware-enforced DEP. PAE mode behavior on Windows XP Service Pack 2
systems is

changed to improve driver compatibility.

For More information

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx



--
Un saludo
Juan Perez


Este mensaje se proporciona "como está" sin garantías de ninguna clase, y no
otorga ningún derecho.
 
A

Andre

Thanks Juan. After I got your post yesterday I did confirm I have the
latest version of the HP software, as well as I removed a couple of the HP
objects from the Startup folder - and also removed them from the registry
startup section too -
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. But to no
avail; the message still appears when I reboot.

Andre
 
J

Juan Perez

Hi:

I am sorry, that I was unable to find more info to you. Try to place your
question in others news and let me know if you find a solution for your
problem.

Un saludo
Juan Perez
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top