svchost.exe application error -> RPC shutdown

Dear experts,

I hope someone here has some good advice, because I really don't know what
to do.

When booting into Windows XP Pro SP2, I get an error message: "The
instruction at "0x751d379d" referenced memory at "0xffcb8375". The memory
could not be "written". Click on OK to terminate the program. Click on CANCEL
to debug the program."

Closing the window allows me to boot fully into XP, but then I get the
infamous shut down in 60 seconds message:" the system is shutting down.
Please save all work in progress and log off. This request was initiated by
NT Authority\system. Message: Windows must restart because the RPC service
terminated unexpectedly." And then it counts down from 60 seconds, after
which it reboots.

I can stop this using the DOS prompt of course (shutdown -a), but Windows is
still behaving strange: some programs won't start or they behave abnormally,
the Windows key doesn't work, minimized windows do not appear in the taskbar,
etc.

I'm using AVG fully up-to-date (antivirus, anti spyware & anti rootkit)
software. Also, windows XP are fully updated with service pack two, latest
patch, security hotfix, etc.

Please post copies of all Error and Warning Reports appearing in
the System and Application logs in Event Viewer for the last boot. No
Information Reports or Duplicates please. Indicate which also appear in
a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using copy
and paste. Often the link will, however, say there is no further
information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Rully wrote:
> Dear experts,
>
> I hope someone here has some good advice, because I really don't know
> what to do.
>
> When booting into Windows XP Pro SP2, I get an error message: "The
> instruction at "0x751d379d" referenced memory at "0xffcb8375". The
> memory could not be "written". Click on OK to terminate the program.
> Click on CANCEL to debug the program."
>
> Closing the window allows me to boot fully into XP, but then I get the
> infamous shut down in 60 seconds message:" the system is shutting
> down. Please save all work in progress and log off. This request was
> initiated by NT Authority\system. Message: Windows must restart
> because the RPC service terminated unexpectedly." And then it counts
> down from 60 seconds, after which it reboots.
>
> I can stop this using the DOS prompt of course (shutdown -a), but
> Windows is still behaving strange: some programs won't start or they
> behave abnormally, the Windows key doesn't work, minimized windows do
> not appear in the taskbar, etc.
>
> I'm using AVG fully up-to-date (antivirus, anti spyware & anti
> rootkit) software. Also, windows XP are fully updated with service
> pack two, latest patch, security hotfix, etc.

Ok. Here's the error:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 04/12/2007
Time: 15:16:05
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379d" referenced memory at "0xffcb8375". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and also there's no yellow marks in device manager. Oh I forgot, sometimes
the error & DCOM things doesn't show up.

I still waiting for your & others help. Thanks.

-- Rully


"Gerry" wrote:

>
> Please post copies of all Error and Warning Reports appearing in
> the System and Application logs in Event Viewer for the last boot. No
> Information Reports or Duplicates please. Indicate which also appear in
> a previous boot.
>
> You can access Event Viewer by selecting Start, Control Panel,
> Administrative Tools, and Event Viewer. When researching the meaning
> of the error, information regarding Event ID, Source and Description
> are important.
>
> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> http://support.microsoft.com/kb/308427/en-us
>
> Part of the Description of the error will include a link, which you
> should double click for further information. You can copy using copy
> and paste. Often the link will, however, say there is no further
> information.
> http://go.microsoft.com/fw.link/events.asp
> (Please note the hyperlink above is for illustration purposes only)
>
> A tip for posting copies of Error Reports! Run Event Viewer and double
> click on the error you want to copy. In the window, which appears is a
> button resembling two pages. Click the button and close Event
> Viewer.Now start your message (email) and do a paste into the body of
> the message. Make sure this is the first paste after exiting from
> Event Viewer.
>
> Are there any yellow question marks in Device Manager? Right click on
> the My Computer icon on your Desktop and select Properties,
> Hardware,Device Manager. If yes what is the Device Error code?
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~

What are your anto-virus and anti-spyware arrangements?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Rully wrote:
> Ok. Here's the error:
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/12/2007
> Time: 15:16:05
> User: N/A
> Computer: RAN
> Description:
> Application popup: svchost.exe - Application Error : The instruction
> at "0x751d379d" referenced memory at "0xffcb8375". The memory could
> not be "written".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> and also there's no yellow marks in device manager. Oh I forgot,
> sometimes the error & DCOM things doesn't show up.
>
> I still waiting for your & others help. Thanks.
>
> -- Rully
>
>
> "Gerry" wrote:
>
>>
>> Please post copies of all Error and Warning Reports appearing in
>> the System and Application logs in Event Viewer for the last boot. No
>> Information Reports or Duplicates please. Indicate which also appear
>> in a previous boot.
>>
>> You can access Event Viewer by selecting Start, Control Panel,
>> Administrative Tools, and Event Viewer. When researching the meaning
>> of the error, information regarding Event ID, Source and Description
>> are important.
>>
>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
>> http://support.microsoft.com/kb/308427/en-us
>>
>> Part of the Description of the error will include a link, which you
>> should double click for further information. You can copy using copy
>> and paste. Often the link will, however, say there is no further
>> information.
>> http://go.microsoft.com/fw.link/events.asp
>> (Please note the hyperlink above is for illustration purposes only)
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and
>> double click on the error you want to copy. In the window, which
>> appears is a button resembling two pages. Click the button and close
>> Event Viewer.Now start your message (email) and do a paste into the
>> body of the message. Make sure this is the first paste after exiting
>> from Event Viewer.
>>
>> Are there any yellow question marks in Device Manager? Right click on
>> the My Computer icon on your Desktop and select Properties,
>> Hardware,Device Manager. If yes what is the Device Error code?
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~

Hm ... I don't know. I'm using free AVG (anti-virus, anti-spyware &
anti-rootkit).
But I don't think it's a virus or spyware things.

Argh ... error again. It's different error now. I think it's come from Yahoo
Messenger. I remove the start up registry of Yahoo Messenger from Safe Mode &
Windows run normally. By the way, how to remove Yahoo Messenger from start up
permanently?

Fiuh ...

Ok, here's the error:

1. From Event Viewer (System):

a. Login

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 06/12/2007
Time: 7:18:34
User: N/A
Computer: RAN
Description:
Application popup: svchost.exe - Application Error : The instruction at
"0x751d379a" referenced memory at "0x00000000". The memory could not be
"read".

Click on OK to terminate the program
Click on CANCEL to debug the program

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b. 60 second shut down things!

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 06/12/2007
Time: 7:25:04
User: NT AUTHORITY\SYSTEM
Computer: RAN
Description:
The process winlogon.exe has initiated the restart of RAN for the following
reason: No title for this reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the Remote Procedure Call (RPC)
service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...

c. reboot (same error with login)


2. From Event Viewer (Application):

a.

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 06/12/2007
Time: 7:22:31
User: N/A
Computer: RAN
Description:
The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of
d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact
Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

b.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 06/12/2007
Time: 7:24:01
User: N/A
Computer: RAN
Description:
Faulting application yahoomessenger.exe, version 8.1.0.421, faulting module
wshbth.dll, version 5.1.2600.2180, fault address 0x0000379a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 79 61 68 ure yah
0018: 6f 6f 6d 65 73 73 65 6e oomessen
0020: 67 65 72 2e 65 78 65 20 ger.exe
0028: 38 2e 31 2e 30 2e 34 32 8.1.0.42
0030: 31 20 69 6e 20 77 73 68 1 in wsh
0038: 62 74 68 2e 64 6c 6c 20 bth.dll
0040: 35 2e 31 2e 32 36 30 30 5.1.2600
0048: 2e 32 31 38 30 20 61 74 .2180 at
0050: 20 6f 66 66 73 65 74 20 offset
0058: 30 30 30 30 33 37 39 61 0000379a
0060: 0d 0a ..

"Gerry" wrote:

> What are your anto-virus and anti-spyware arrangements?

Rully

Yahoo Messenger

Use Autoruns to find any unwanted start ups!
http://www.microsoft.com/technet/sys.../Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from starting,
or you can can right click an item and then delete it. If you uncheck
you can recheck to re-enable the item. It is a much safer approach than
editing the Registry. Another useful feature of the programme is that
you can right click an item and select Search Online to get information
about the item selected.

Select Start, Control Panel, Administrative Tools, Services. Is the
Start Up type for COM + Event service set to Manual?

Another thought is to create a new User Profie for yourself.
How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/kb/811151/en-us


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~




Rully wrote:
> Hm ... I don't know. I'm using free AVG (anti-virus, anti-spyware &
> anti-rootkit).
> But I don't think it's a virus or spyware things.
>
> Argh ... error again. It's different error now. I think it's come
> from Yahoo Messenger. I remove the start up registry of Yahoo
> Messenger from Safe Mode & Windows run normally. By the way, how to
> remove Yahoo Messenger from start up permanently?
>
> Fiuh ...
>
> Ok, here's the error:
>
> 1. From Event Viewer (System):
>
> a. Login
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 06/12/2007
> Time: 7:18:34
> User: N/A
> Computer: RAN
> Description:
> Application popup: svchost.exe - Application Error : The instruction
> at "0x751d379a" referenced memory at "0x00000000". The memory could
> not be "read".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> b. 60 second shut down things!
>
> Event Type: Information
> Event Source: USER32
> Event Category: None
> Event ID: 1074
> Date: 06/12/2007
> Time: 7:25:04
> User: NT AUTHORITY\SYSTEM
> Computer: RAN
> Description:
> The process winlogon.exe has initiated the restart of RAN for the
> following reason: No title for this reason could be found
> Minor Reason: 0xff
> Shutdown Type: reboot
> Comment: Windows must now restart because the Remote Procedure Call
> (RPC) service terminated unexpectedly
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: ff 00 00 00 ÿ...
>
> c. reboot (same error with login)
>
>
> 2. From Event Viewer (Application):
>
> a.
>
> Event Type: Error
> Event Source: EventSystem
> Event Category: (50)
> Event ID: 4609
> Date: 06/12/2007
> Time: 7:22:31
> User: N/A
> Computer: RAN
> Description:
> The COM+ Event System detected a bad return code during its internal
> processing. HRESULT was 800706BA from line 44 of
> d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please
> contact Microsoft Product Support Services to report this error.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> b.
>
> Event Type: Error
> Event Source: Application Error
> Event Category: None
> Event ID: 1000
> Date: 06/12/2007
> Time: 7:24:01
> User: N/A
> Computer: RAN
> Description:
> Faulting application yahoomessenger.exe, version 8.1.0.421, faulting
> module wshbth.dll, version 5.1.2600.2180, fault address 0x0000379a.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 79 61 68 ure yah
> 0018: 6f 6f 6d 65 73 73 65 6e oomessen
> 0020: 67 65 72 2e 65 78 65 20 ger.exe
> 0028: 38 2e 31 2e 30 2e 34 32 8.1.0.42
> 0030: 31 20 69 6e 20 77 73 68 1 in wsh
> 0038: 62 74 68 2e 64 6c 6c 20 bth.dll
> 0040: 35 2e 31 2e 32 36 30 30 5.1.2600
> 0048: 2e 32 31 38 30 20 61 74 .2180 at
> 0050: 20 6f 66 66 73 65 74 20 offset
> 0058: 30 30 30 30 33 37 39 61 0000379a
> 0060: 0d 0a ..
>
> "Gerry" wrote:
>
>> What are your anto-virus and anti-spyware arrangements?

Ok. Yahoo Messenger problem, solve.

I'd already try Autoruns. But I don't know which programs should or
shouldn't when start up.

Start Up type for COM + Event service is set to Manual. I have to change it
to Automatic?

About the error on the first post on this thred, still show up. Sometimes
run normally (without error), if I switch to Safe Mode and switch to Windows
Normally.
Hm ... I don't know. I still confuse.

"Gerry" wrote:

> Rully
>
> Yahoo Messenger
>
> Use Autoruns to find any unwanted start ups!
> http://www.microsoft.com/technet/sys.../Autoruns.mspx
>
> With Autoruns you can uncheck an item, which disables it from starting,
> or you can can right click an item and then delete it. If you uncheck
> you can recheck to re-enable the item. It is a much safer approach than
> editing the Registry. Another useful feature of the programme is that
> you can right click an item and select Search Online to get information
> about the item selected.
>
> Select Start, Control Panel, Administrative Tools, Services. Is the
> Start Up type for COM + Event service set to Manual?
>
> Another thought is to create a new User Profie for yourself.
> How to copy data from a corrupted user profile to a new profile
> http://support.microsoft.com/kb/811151/en-us
>
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~

Rully

Leave the COM + Event service st to manual.

Are all your Windows Update being successfully installed? Check for
failures.

Select, Start, Help and Support, Keep your Windows up- to-date with
Windows Update, Review your Update History and check the Status Column?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Rully wrote:
> Ok. Yahoo Messenger problem, solve.
>
> I'd already try Autoruns. But I don't know which programs should or
> shouldn't when start up.
>
> Start Up type for COM + Event service is set to Manual. I have to
> change it to Automatic?
>
> About the error on the first post on this thred, still show up.
> Sometimes run normally (without error), if I switch to Safe Mode and
> switch to Windows Normally.
> Hm ... I don't know. I still confuse.
>
> "Gerry" wrote:
>
>> Rully
>>
>> Yahoo Messenger
>>
>> Use Autoruns to find any unwanted start ups!
>> http://www.microsoft.com/technet/sys.../Autoruns.mspx
>>
>> With Autoruns you can uncheck an item, which disables it from
>> starting, or you can can right click an item and then delete it. If
>> you uncheck you can recheck to re-enable the item. It is a much
>> safer approach than editing the Registry. Another useful feature of
>> the programme is that you can right click an item and select Search
>> Online to get information about the item selected.
>>
>> Select Start, Control Panel, Administrative Tools, Services. Is the
>> Start Up type for COM + Event service set to Manual?
>>
>> Another thought is to create a new User Profie for yourself.
>> How to copy data from a corrupted user profile to a new profile
>> http://support.microsoft.com/kb/811151/en-us
>>
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~

All Windows Update status are succeeded.

Ok. What's next?

"Gerry" wrote:

> Rully
>
> Leave the COM + Event service st to manual.
>
> Are all your Windows Update being successfully installed? Check for
> failures.
>
> Select, Start, Help and Support, Keep your Windows up- to-date with
> Windows Update, Review your Update History and check the Status Column?
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~

Install XP Service Pack 3. Problem solved! Thanks all for your help. :)

"Rully" wrote:

> All Windows Update status are succeeded.
>
> Ok. What's next?
>
> "Gerry" wrote:
>
> > Rully
> >
> > Leave the COM + Event service st to manual.
> >
> > Are all your Windows Update being successfully installed? Check for
> > failures.
> >
> > Select, Start, Help and Support, Keep your Windows up- to-date with
> > Windows Update, Review your Update History and check the Status Column?
> >
> > --
> >
> >
> >
> > Hope this helps.
> >
> > Gerry
> > ~~~~
> > FCA
> > Stourport, England
> > Enquire, plan and execute
> > ~~~~~~~~~~~~~~~~~~~