svchost.exe error: "0x745f2780" referenced memory at "0x00000000"

Application popup: svchost.exe - Application Error : The instruction at
"0x745f2780" referenced memory at "0x00000000". The memory could not be
"read".

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This happened on only two out of ~380 systems back after the August 2006
patch day, but now it is happening on three dozen more of them after
September 2006 patch day. Everytime I think I have figured out what might
be the problem, another system and some more testing blows my current
working hypothesis out of the water.

The only common point is that I point AU to a central WSUS
server and I will point out I never had these errors or these problems
before SP1 was applied to the WSUS server this summer and thus the wuau*.*
client files were updated to version 5.8.0.2607, instead of the usual
5.8.0.2469 version I never had a problem with. However, everyone on these
groups are always quick to defend WSUS SP1 and say there is no possible way
it is the cause of the problems, but then I have yet to find any of them
ever reply with any hint of what the actual cause of these errors are nor
provide a solution.

When does this error happen? Sometimes the popup will even show *before* a
user login, but usually a person logs on soon after the boot up at which
point it appears to be the case that it is happening a few seconds after
logon.

In any case, one interesting thing to note is to NOT click on the "Send
error report" nor the "Don't send", because once one does, the system
pretty much locks up to the point of being useless and a hard hold-down-
the-power-button reboot is really all that can be done. If one just leaves
that error box up, though, the system can still be used.

If one sees the automatic updates yellow taskbar icon and installs the
pending updates, on most systems they will install, but on a few the first
update just hangs and again all you can do is a hard reboot. Here's the
kicker, doesn't matter which patch is the first patch AU will install, at
least I've ruled out three of the seven pending updates so far.

Also, not every system that gets the initial svchost error will hang or
error on installing the pending AU updates. Some do hang on installing
whatever the first pending update is and a hard reboot is all that can be
done at that point. Some were left as long as 5 hours with no change, so I
think we can assume that is an infinite loop condition. Now, on some
where the initial svchost error box was closed, sometimes the system is
responsive enough to still try to install the pending AU updates, but then
the first patch throws another svchost error and things are again locked
up and waiting for a hard reboot.

Note that these are systems which were fully patched before the August
patches and now before the September patches. These systems already had
the ancient KB894391 patch installed and I even tried to install it again,
anyway, even though clearly that shouldn't be applicable nearly a year
later. Oddly, although a reboot after installing it on a system that
already had it didn't throw the svchost error upon boot, when I went to
install the pending AU patches, the first one then caused the svchost
error and... hard reboot time.

Now, what *appears* to have helped me dig my way out of this, although I
can't see how this really was any actual solution, but someone had
mentioned on one of the posts that they were having the same svchost
errors starting last month also connecting to a WSUS SP1 server and by not
approving Office-related patches it cleared things up. Well, that also
*appears* to have helped me as well, once I no longer approved the
Publisher 2003 patch nor the Outlook Junk Mail update. Note that some of
these problem systems do have Publisher 2003, others do not, although just
having Office 2003 installed at all will make the Publisher 2003 available
in AU.

Helped in that the initial svchost error no longer is coming up, based on
a few more systems I visited after making that change. However, these
systems had *already* downloaded those Office updates anyway and had them
pending to install. So, as was the case before, some systems they install
and on others the first update - whichever update happens to be first on
the list -throws the svchost error.

Again, no repeatable logic I have been able to find, I just go to each
system and it behaves differently. The only solution is to install the
updates manually either from the individual downloads or to go to
Microsoft Updates through IE. That of course defeats the entire purpose
of Automatic Updates, WSUS or no WSUS. I'm going to take some of the
systems and no longer point them to the WSUS SP1 server and we'll see if
next month when patch day comes whether they are saved from these issues.
Given that the same svchost error above has happened after two different
patch days, it stands to reason this will happen again on some systems
next month too.

(Disclaimer: Yes, I typed this really fast and didn't proof-read it, I
would if I didn't have all of these systems to patch manually because AU
is useless on them.)

Just this morning, the exact same error came up on my computer. I'm
running XP Media Center -- latest. I always leave my computer on and no
updates have been installed in the last 3-4 weeks.

On a weird note, somehow it lost reference to my sound card, although
it showed up in Device manager, my system (media player and Windows)
did not recognize any sound card being installed.

I rebooted the computer and once again got audio, but then less than 2
minutes later, svchost.exe "0x745f2780" referenced memory at
"0x00000000" error occured again. This locked up Outlook, Messenger and
Task Manager and I was unable to shutdown or open any programs -- start
menu functioned, but no programs opened.

Had to perform warm reboot, got into Windows and 30 seconds later same
error appeared again. I see no evidence of Virii, my computer is 100%
up to date and I have not installed any programs nor downloaded any
files, nor visited any suspicious websites in the last month.

We did have Publisher 2003 and Outlook 2003 open over the last several
days while printing out 120+ brochures.


Any help in troubleshooting is greatly appreciated.
Thanks!

I've been testing it since Thursday and it seems to have fixed all of our svchost.exe issues. I've rolled it out to 550+ machines without any issues.

Not sure how you're requesting the HotFix, but they should stay on the phone with you until you have it in your in your Inbox or have it downloaded.

Well, after hours of doing methodical testing on several of my systems with
this problem, I still couldn't pin the problem down to one thing.
However, at the end of the evening I did get one where even after I had all
pending updates finally installed, verified it by going to the Microsoft
Update web site, each login after a yet another reboot was STILL throwing
svchost.exe errors. So, on all the other systems I had visited that seemed
to clear up the errors once all the pending updates were installed
apparently wasn't good enough for this system.

The only thing I was able to do to get that FULLY PATCHED system to stop
still throwing svchost.exe errors after every boot was to...

net stop wuauserv
net stop bits
del /q /s %windir%\SoftwareDistribution

.... and reboot one last time. I rebooted three more times just to make
sure it was gone and it appears to be fine now. Sadly, I now
apparently have to do this on 20+ more systems. So much for "automatic"
updates. :<

I think this is a problem with automatic updates MS-BIT and virus checkers being unable to unload or terminate svchost.exe correctly, i know you are using WSUS server but correct me if im wrong but they are based on the same code(or they are the same) as a stand alone XP machine's automatic updates, with the virus checker enabled and automatic updates on OCT patches where down loaded and i chose to install on shutdown to my shock! ok not shock more like expected disapointment i got svchost error whilist installing the first update, upon reboot i get as above error's, lucky for me i mirrored my hdd before i applied this update ( a practice i have gotten into since supporting the SP2 update and having had 50% of my companys customers expereincing serious problems upon reboot)
Then once all was working fine back to an identical OS as i had before i applied the updates, i disabled my virus scanner applied updates and guess what no problems, saying that this may be relevant to only non-WSUS as not all your machines do this as you stated and i know disabling virus scanners on you scale is not a wise move, all i hope is this points you in the right direction!

spelling is not the best but hey who said i perfect :P

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

I was relieved when I saw your post about the same issue I have been dealing with for months. I too believe it is related to WSUS SP1, or the timing sure is extremely coincidental.

Very well written analysis of the situation. Are you running Windows Defender at all?

Thanks,

ajh

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

Here's your fix...you'll need to contact microsoft to get the patch...

http://support.microsoft.com/kb/916089

I have used this on the machines that are getting the error and it
seems to have fixed the error.

USE REGEDIT AND GO TO THE FOLLOWING KEY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER.
with the explorer key highlighted, create another key (a subkey) by
clicking Edit, New, and Key. Type AlwaysUnloadDLL to name the key,
press ENTER double-click its default value, type 1 in the value field,
and click OK. Close REGEDIT then reboot the computer.

XP should now empty the DLLs from the cache memory

I have used this on the machines that are getting the error and it
seems to have fixed the error.

USE REGEDIT AND GO TO THE FOLLOWING KEY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER.
with the explorer key highlighted, create another key (a subkey) by
clicking Edit, New, and Key. Type AlwaysUnloadDLL to name the key,
press ENTER double-click its default value, type 1 in the value field,
and click OK. Close REGEDIT then reboot the computer.

XP should now empty the DLLs from the cache memory

Hallo,
I installed the Patch 916089, but it didn´t solved my Problem. Only
the Errormessage changed to the following:

Fehlgeschlagene Anwendung svchost.exe, Version 0.0.0.0,
fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse
0x00000000.

After 3 reboots the Error has gone, but i think with the next Updates
the Error will be back.
Has anyone got the same experiences ?

Markus F

I got no response from Microsoft via email so I called the local toll free
help number and got thru to a nice chap (with an Indian accent) who gave me
the FTP download site and the required password. I installed the patch and
now my computer is much faster, and no svchost error--but I still have Auto
Updates turned off as a precaution!

Thanks to Roman S for the solution--I bet there are a hugh number of users
who are suffering this problem, with insufficient knowledge to know what to
do. I know I wasted two and a half days until I found this hotfix--all the
time thinking I had a virus, or had done something wrong myself, when it was
a genuine MS Update that had caused the error.>

[mdowling]

I run a single XP SP2 machine, which is a Pentium Core Duo. I experienced nearly all of the symptoms noted above. I disabled virus checking and AU and installed updates from the AU website. Now I run with all virus checking enabled but with AU set to download and notify - not to install automatically. Thanks to all previous correspondents for helping me fix this!

[newtech]

http://forums.techarena.in/tags/index.php/0x00000000/4/
http://forums.techarena.in/tags/index.php/0x745f2780/
http://forums.techarena.in/tags/index.php/svchostexe/5/