SVCHOST

[Guest]

Recieved an error upon bootup: "Generic Host Process for Win32". So far,
without rebooting, everything appears fine. Searched for svchost in Windows
Explorer and returned 7 files in 7 different locations. 5 of files show
Microsoft under the properties/version tab. 2 of the files, coincidentally
the only filenames in uppercase, have no company or version info. Can't find
any info on SVCHOST.EX_ in C:\I386 or SVCHOST.EXE-08EA1B75.pf in
C:\WINNT\Prefetch. Even more curious is that they were created within the
past few days. I updated my JRE right around the same time as these file
create dates but I have a feeling that it's unrelated.

Not sure what, if anything, should be done with these files.
Probably just a big over-reaction on my part but any thoughts/suggestions
are welcomed and appreciated.

Thanks

 

[Rich Barry]

Tom, first try emptying the Prefetch Folder. Then try this if that
doesnt help
1. From the Window Desktop, click Start, and then click
ControlPanel.
The Control Panel will open.

2. Double-click the Administrative Tools icon. The Administrative Tools
window will open.

3. Double-click the Services icon. The Services window will open.

4. Double-click the Windows Image Acquisition (WIA) icon. The Windows Image
Acquisition (WIA) Properties (Local Machine) windows will open.

5. On the General tab, click the drop-down arrow in the Start-up Type box
and select Disabled.

6. Click Stop. A window will open with a message stating the service is
being found. When the message closes, verify the ServiceStatus displays
Stopped. Repeat this step if necessary.

7. Click Apply, and then click OK.

 

[Wesley Vogel]

Generic Host Process for Win32 Services encountered a problem a needs to
close.

Lot of that going around lately. I don't know the fix.

What seven locations are copies of SVCHOST.EXE in?

I have two copies SVCHOST.EXE. One each in C:\WINDOWS\system32 and
C:\WINDOWS\system32\dllcache

SVCHOST.EX_ and SVCHOST.EXE-08EA1B75.pf don't count.

SVCHOST.EX_ is a compressed version of SVCHOST.EXE. The underscore (_)
denotes that fact.

SVCHOST.EXE-08EA1B75.pf is prefetch file, used to make SVCHOST.EXE start
faster.

The C:\I386 folder contains the source files for XP installation and
Windows File Protection. If you add a Windows Component, Add or Remove
Programs finds the files there instead of asking you for a CD. You
probably have this folder because you didn't get a real XP CD when you
purchased your machine.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;314056

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Hi Wes,

Thanks for the info.
I did a new search on just svch and that returned the following:


SVCHOST.EX_ in
C:\I386 (you've already covered)

svchost.exe in
C:\WINNT\$NTServicePackUninstall$
C:\WINNT\system32
C:\WINNT\ServicePackFiles\i386
C:\WINNT\SoftwareDistribution\Download\6ca7b3a8efd5a9b6f87fff295a2eb989

svchost.exe.hdmp in
C:\Documents and Settings\Owner\local Settings\Temp\WERcf77.dir00

svchost.exe.mdmp in
C:\Documents and Settings\Owner\local Settings\Temp\WERcf77.dir00

svchost.bin in
C:\Program Files\Common Files\AOL\1102551284\EE

Odd thing is I receive this error message when I bootup in the morning but
the date/time of the error is from the night before when I shutdown

Norton is up-to-date and daily scans are clean

Thanks again

 

[Wesley Vogel]

Tom,

This a Windows Update file. I have no idea which one.

C:\WINNT\$NTServicePackUninstall$

The svchost.exe file in this folder is the one that actually runs.

C:\WINNT\system32

I'm not sure what this folder is for. Maybe old Windows Update
version4.

C:\WINNT\ServicePackFiles\i386

This folder added by Windows Update version5.

C:\WINNT\SoftwareDistribution\Download\6ca7b3a8efd5a9b6f87fff295a2eb989

Both of these are the result of your error(s) and you have Error
Reporting enabled. There will also be an appcompat.txt file(s) which is
the text that was sent in each error report.

hdmp extension is the uncompressed version of an error dump. The .MDMP
file is the compressed version and is the file sent to Microsoft.

svchost.exe.hdmp in
C:\Documents and Settings\Owner\local Settings\Temp\WERcf77.dir00

svchost.exe.mdmp in
C:\Documents and Settings\Owner\local Settings\Temp\WERcf77.dir00

You can delete anything in the
C:\Documents and Settings\Owner\local Settings\Temp folder. This your
Temporary folder.

I have no earthy idea what this is. Something to do with AOL obviously.

svchost.bin in
C:\Program Files\Common Files\AOL\1102551284\EE

I also have no idea what's causing the errors. Did you try Rich Barry's
suggestion?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Can you check your Application and System EventLog?

To check it go to the Run window and type

%windir%\system32\eventvwr.msc

Look in System and Application and see if there are any useful messages.

SVCHOST is just a shell that runs both Microsoft and Third-Party
applications. If it crashes, it is due to the app it is hosting.

You can use Process Explorer from www.sysinternals.com to view which
processes were spawned from which svchost.exe instance.