SVCHOST - how?

[mathsgames]

Can services (dlls) which have closed be re-started using Start->Run->
"svchost etc? In other words if I identify a Windows dll in %system% that
I want available - for example audiosrv.dll - what is the entry line to get
it up please?
All help appreciated. Thanks

 

[David H. Lipman]

From: "mathsgames" <[email protected]>

| Can services (dlls) which have closed be re-started using Start->Run->
| "svchost etc? In other words if I identify a Windows dll in %system% that
| I want available - for example audiosrv.dll - what is the entry line to get
| it up please?
| All help appreciated. Thanks

No.

It is a server of services and is depent on what's in the registry as well as command line
switches being loaded as a NT Service.

 

[mathsgames]

THANK YOU Gerry and David.
I can now restart my missing services as you suggested. Brilliant.
This is all part of the debug of a killer "Generic Host Process needs to
close"
I need to bring back the missing services one by one until I find the rogue
service (dll) which is incompatible with level 9 of AOL for dial up
broadband users (me).
Many thanks again.

 

[Gerry]

You looking at the problem the wrong way! The problem is more likely to
be with AOL.

Look at the entries in Event Viewer.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[David H. Lipman]

From: "Gerry" <[email protected]>


| You looking at the problem the wrong way! The problem is more likely to
| be with AOL.

I agree. AOL crapware is very obtrusive !

 

[David H. Lipman]

From: "David H. Lipman" <[email protected]>

| From: "Gerry" <[email protected]>


|| You looking at the problem the wrong way! The problem is more likely to
|| be with AOL.

| I agree. AOL crapware is very obtrusive !


Ooooops....
Should have been "intrusive" not obtrusive. < LOL >

 

[mathsgames]

Thanks for your continued interest in this.
The story so far - entered elsewhere in this forum - is that AOL have many
broken arms from users but STILL insist it is not them. D'you know I'm
beginning to believe them. Because after the "Generic Host Process needs to
close" crash the Event viewer does not list a failing serivce. However
looking around I found that one of the SVCHOST commands had LOST 16 out of
it's original 26 services.
BUT - from that point on, AOL can be quickly restored and then runs like a
dream with no further failures, until next power up. That makes me
suspicious about my WinXP SP1. There is much smoke about this "Generic
Host..." around the forums and no fixes. The penalty of this workaround is
that there are casualties. One of which is that services like Windows Audio
are stopped. However this can be easily restarted using the process you
outlined earlier.
Well there it is. I was an AOL basher but now I'm not so sure. Thanks
anyway. I will follow up on ALL your suggestions.

 

[Gerry]

Why have you not updated to Windows XP SP2 or SP3?

What errors appear in Event Viewer for the last boot?

What are your anti-virus and antispyware arrangements?

What Start Up type has Windows Audio been set as? It should be
automatic.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Answers to your Qs Gerrry:

1 SP1 always worked fine - and if it "ain't broke" I don't fix it. The
errors started some years after my purchase of XP, when AOL moved us all to
AOL Dial Up Broadband six months ago. There's quite a bit in various fora
about this thing but no clear fix anywhere. Naturally AOL got kicked.

2. The Event viewer from today:

Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.
There are also a couple of files usually, in a temp dir, but nothing useful
in them.

3. Spyware - up to date McAfee virus checker and Firewall. They do find
things from time to time. No odd things happening except this one.

4. Startup type for Windows Audio is automatic.
-------------------
After the failure, one of the SVCHOST calls - the same one every time -
has reduced from 26 services to 10. It is always the same services dropped
off.
My plan is to get past the bug, when these services are down to 10 - and
restart them one at a time to see if I can get to the conflict. An important
point foir me is
that my work around keeps me going even though I'm running 16 services light.
So far I've proved that Windows Audio can be restarted without further
breakdowns.

Any more opinions will be followed up. Thanks for your interest.

 

[Unknown]

Completely wrong attitude 'If it ain't broke don't fix it'. Can't you make
it better? What about updates?
What about security? Know the difference between SP1 and SP3?

 

[Gerry]

"and if it "ain't broke" -You should at least update to SP2,

The command line for the problematic SVCHOST will be one of these two.
Which is it?

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k LocalService

Which services are being dropped?

What version of svchost.exe is in c:\windows\ System32? Right click on
the file in Windows Explorer and select Properties, Version tab to get
this information. You may need to Show Hidden Files to see the file.

Select, Start, Control Panel, Folder Options, View, Advanced Settings
and verify that the box before "Show hidden files and folders" is
checked and "Hide protected operating system files " is unchecked. You
may need to scroll down to see the second item. You should also make
certain that the box before "Hide extensions for known file types" is
not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Morning Gerry

# SP2. When this came out there were so may issues that I made a command
decision to let it go by. Until this latest problem I have had no big issues.
Neither is there any evidence so far that this issue is SP1 related.

# SVCHOST. The broken one is the big one - svchost.exe -k netsvcs

# Dropped services.
1 computer browser
2 Crypto servics
3 DHCP client
4 Distributed link tracking
5 error reporting
6 fast user
7 sec logon
8 server
9 shell hardware
10 system restore
11 task scheduler
12 termina services
13 windows audio
14 windows time
15 wireless zero
16 workstation

Strangely enough everything I use works fine with all these services down
except for the missing windows audio -- which I now restart everytime since
it's exonerated.


# SVCHOST. version = 5.1.2600.0

I got the bug ten mins. after web connection today. I'm restarting some more
of the missing services until I get a culprit.

Can you spot any service from my list that in your opinion, may cause a
forced closure during Dial Up Broadband web activity? Thank you for your
time.

 

[Gerry]

Trying to sort out your problem with only SP1 installed may prove
difficult. You really need to upgrade to SP2. This is a big step. How
large is your hard drive and how much free disk space is there?

The best way is to obtain or borrow an SP2 update CD. These were widely
available in 2004. Microsoft originally issued these for free but
subsequently made a charge for packaging and postage. I am not sure
whether you can still get an SP2 CD from Microsoft. The link I found in
one of the links below produced an Order Form for the SP3 Update. You
need to have SP2 installed before you even consider updating to SP3.
Downloading SP2 even over a good broadband connection takes quite a
time. That is why a CD is a better way forward.

http://support.microsoft.com/gp/windowsxpsp2

http://support.microsoft.com/xpsp2getinstall

http://support.microsoft.com/kb/322389

Leaving aside updating Windows XP you need to be certain you do not have
a malware infestation. What is the exact version of McAfee which is
installed? Do you have a current subscription, when does it expire and
are definitions being automatically updated weekly? You should never
update an infected or malfunctioning computer. So you really need to be
certain your computer is not infected and working properly.
Coincidentally if the computer had been updated it would have a much
better level of protection.

What do you have by way of an original Windows XP CD? The easiest way to
resolve your malfunctioning problem may be to reinstall Windows XP and
your programmes. Do you really need the AOL software?

It would helpful to have more background information on your computer.
What is the computer make and model? What is the CPU and how much RAM
does your computer have? Right click on the My Computer icon on your
Desktop and select Properties to get this information.

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Hi Gerry,

# Did any of the services I listed look relevant ??

# My TaskMan shows commit charge Total 29M, Limit 64M, Peak 30M

# My PC is Dell Dimension DIM2400 2.5G disk 256M ram 74Gb disk

# My McAfee is an annual subscription update almost daily on line.

I'm inclined to stick with the analysis a while longer. It always seems to
me a 'cop-out' to start re-loading everything. That's usually what the AOL
help desk say and it means they have no idea what's cooking. If it isn't on
their list there is no analysis - just re-install. I came up a different IT
route - may have cost me a little time over the years!!!

Thank you for your interest. It's useful to bounce ideas off other IT folk.
All the best.

 

[Gerry]

I am not a great believer in solving problems by reinstalling. I am
merely pointing out options and asking questions to ascertain what might
be the best way to resolve your problems. You have a number of problems;
more than are immediately obvious. The loss of so many services is
puzzling.

I have found this link to documentation concerning your computer
http://supportapj.dell.com/support/edocs/systems/dim2400/en/sm_en/index.htm

The figures from Task Manager suggest your computer may be over reliant
on using the pagefile. The amount of RAM installed is minimal. Most
users need 512 mb to run Windows XP ( but they are using SP2 or SP3 -few
are still using SP1 who visit these newsgroups ) but this does depend on
what the computer is used for. Your computer can be upgraded to take a
maximum of 1 gb. However, I am not saying going to 1 gb is necessary
but additional RAM would be beneficial. You could conduct more detailed
tests to determine the extent your system is reliant on RAM. It could be
that the system is under stress at times for lack of memory and this
will lead to problems. Normally this becomes evident when applications
hangs and errors arise. I have not seen it reported that this can lead
to wholesale loss of services.

You did not say what McAfee product and version. Can you please provide
this information so that we can determine how comprehensive your
computer is? I am not sure we can rule out the possibility that malware
is causing your problems? I should say that McAfee is a resource hungry
product and not necessarily a good choice for a computer with only 256
mb RAM. There are more suitable freeware alternatives.

I would be interested in seeing a Disk Defragmenter report . Open Disk
Defragmenter and click on Analyse. Select View Report and click on Save
As and Save. Now find VolumeC.txt in your My Documents Folder and post a
copy. Do this before running Disk Defragmenter as it is more
informative.

What error and warning are there in the last two days in the System log
of Event Viewer?

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Hi Gerry,

# I'm still moving slowly forward - now got five of the closed services
back up and clean.
Seems to me that I'm heading towards the network services as culprits. I web
connect directly down a copper wire and do not have any networking
requirements.
Perhaps many of these 'networking services' could be left down ??

# Today's failure event log: (ta for the pasting tip)

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 06/12/2008
Time: 14:28:35
User: N/A
Computer: ED
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 75 6e 6b 6e 6f 77 6e unknown
0028: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0030: 20 61 74 20 6f 66 66 73 at offs
0038: 65 74 20 30 30 30 30 30 et 00000
0040: 30 30 30 000

# I'll keep any eye on RAM usage - maybe some of these network services are
RAM rich and simply closing them solves the issue.

# McAfee - mine is Version 13 Build 13.0. 218 AffId 105 Last Update
6/12/2008

# I'll check out that link you sent.

# Last I checked the defrag (three weeks ago it said no need to do it.

#This memory suggestion may lead somwhere. I'll keep close to it.

Thanks for your interest.

 

[Gerry]

Which services remain problematic?

You seem to have McAfee Virus Scanner. What anti-spyware software are
you using? What firewall?

Does disabling Window Automatic update have any effect on the inumber of
problems occuring?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Hello Gerry,

# Moving slowly forward.
Now got 18 of the original 26 services running and all clean.
The services yet to bring back in in no particular order are:
*computer browser
*Crypto svcs
*DHCP client
*Distributed link tracking
*secondary logon
*server
*shell hardware
*workstation

# My McAfee is an inclusive package - inc. firewall.

# Disabling window updates - I'm scratching my head here. I may have
disabled it way back - or not. Where is the user choice? I'm not aware of
any background updating taking place so maybe it is disabled.

# The other fora chats on this issue suggested the the official windows
sites had been trawled for help and there was nothing there.

# Regarding RAM - I do occasionally - maybe once per month - get a screen
warning that I am low on RAM and should close a process or two. These
warnings never co-incide with the web bug.

# I'm now monitoring RAM usage to see if I can see a pattern. One thing I
notice is that from time to time McAfee is a big user as shown under Mem
Usage of the Task Manager.

# It may be that it is simply the large number of services running that has
suddenly become a problem. We shall see on that one. The daily trials take a
while but since I have a workaround I will persevere.

# One Q - do you know where Windows keeps the list that SVCHOST uses for
netsvcs ?? If you do I could end up modifying that as a perm. fix until I
upgrade my system. Any clues where it is??

Thanks again.

 

[Gerry]

All the services you list should have their Start Up type set to
Automatic. -Start, Control Panel, Administrative Tools, Services. To
check place the cursor on the service, right click and select
Properties. Please confirm whether they are showing as Automatic. Please
let me know any discrepancies.

Windows Updates -Start, Control Panel, Automatic Updates.

The number of services running if set correctly should not creates
excessive usage of memory. McAfee is at least one of your problems.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[mathsgames]

Hi Gerry,

Did you notice my last Q?

Where is the 'netsvcs' list kept which is used by the failing SVCHOST call?
I'm probably going to have to modify this eventually to get a regular
workaround.
It must carry the list of services used by that particular SVCHOST call.
Appreciate it if you could point me to it.
Thanks. Ed