Services.exe issue

[tomas]

We're having some issues with a couple of our new computers, unfortunately
they are remote from my location so troubleshooting this error has been a bit
of a pain. The issue I am seeing is the following error notices:

1) The instruction at "0X606cbaec" referenced memory at "0X02a90328". The
memory could not be "read"

if you click OK to terminate program then you get:

2) C:Windows\system32\services.exe terminated unexpectedly with status code
-1.

and the computer shuts down.

Both of these affected systems are running Symantec AV, with the latest
patch and fully updated. I oringally suspected some sore of a worm, and
Symantec nor the Kaspersky online scan found anything. They are both running
Windows XP SP2, fully patched.

I've given the users the short term workaround of start > run shutdown -a
but would like to figure out what is causing this. Has anyone seen this
issue before? The other odd thing seems to be that this only occurs when the
systems are connected to the network, and it only started doing this after
the systems were running for a week or two. They say they haven't installed
any software on these systems either. I've had them reinstall the network
drivers, but that only seemed to help for a bit. These systems were both set
up with a clean install of an image after receiving them from Dell using UIU
3.0 and Ghost. I'm wondering if it's a driver issue and I should have the
user go through and reinstall all of the drivers?

Any help or insight would be greatly appreciated!

[nass]

"tomas" wrote:

> We're having some issues with a couple of our new computers, unfortunately
> they are remote from my location so troubleshooting this error has been a bit
> of a pain. The issue I am seeing is the following error notices:
>
> 1) The instruction at "0X606cbaec" referenced memory at "0X02a90328". The
> memory could not be "read"
>
> if you click OK to terminate program then you get:
>
> 2) C:Windows\system32\services.exe terminated unexpectedly with status code
> -1.
>
> and the computer shuts down.
>
> Both of these affected systems are running Symantec AV, with the latest
> patch and fully updated. I oringally suspected some sore of a worm, and
> Symantec nor the Kaspersky online scan found anything. They are both running
> Windows XP SP2, fully patched.
>
> I've given the users the short term workaround of start > run shutdown -a
> but would like to figure out what is causing this. Has anyone seen this
> issue before? The other odd thing seems to be that this only occurs when the
> systems are connected to the network, and it only started doing this after
> the systems were running for a week or two. They say they haven't installed
> any software on these systems either. I've had them reinstall the network
> drivers, but that only seemed to help for a bit. These systems were both set
> up with a clean install of an image after receiving them from Dell using UIU
> 3.0 and Ghost. I'm wondering if it's a driver issue and I should have the
> user go through and reinstall all of the drivers?
>
> Any help or insight would be greatly appreciated!

Start with clean Boot to determine the culprit and either uninstall it or
update it.
a Repair install of these machine from the image.
A through scan again will not hurt and run the AutoRuns.exe from Microsoft
to see in realtime the running processes in the background also FileMon a
grate tool to have.
Compare the Version of the services.exe on these town troublesome machine
with another working one to determine nothing tempered with them.?
HTH.
nass
-----
www.nasstec.co.uk

[tomas]

Ok, after doing this and a few other things...got to looking at it possibly
being a driver issue. After doing a reinstall of the drivers on this system
I'm now getting the following error:

Services and Controller App
Services and Controller application has encountered a problem and needs to
close.

When I look at the error report this is what it says:

szAppName: services.exe szAppVer:5.1.2600.2180 szModName:esent.dll
szModVer:5.1.2600.2780 offset:0001baec

After the driver reinstall, these machines are no longer getting the
countdown message. In look at esent.dll it appears this is just used for the
Windows automatic updates, and it does look like there may be a hotfix for
this: http://support.microsoft.com/kb/910437

I also found a couple of sites that mention this could be an isue with group
policy for a machine that was moved off of a domain to a workgroup, and the
local policy just needs to be reset. Has anyone seen this error message and
is it most likely related to Windows Update or a group policy problem?

Thanks!
Tomas


"nass" wrote:

>
>
> "tomas" wrote:
>
> > We're having some issues with a couple of our new computers, unfortunately
> > they are remote from my location so troubleshooting this error has been a bit
> > of a pain. The issue I am seeing is the following error notices:
> >
> > 1) The instruction at "0X606cbaec" referenced memory at "0X02a90328". The
> > memory could not be "read"
> >
> > if you click OK to terminate program then you get:
> >
> > 2) C:Windows\system32\services.exe terminated unexpectedly with status code
> > -1.
> >
> > and the computer shuts down.
> >
> > Both of these affected systems are running Symantec AV, with the latest
> > patch and fully updated. I oringally suspected some sore of a worm, and
> > Symantec nor the Kaspersky online scan found anything. They are both running
> > Windows XP SP2, fully patched.
> >
> > I've given the users the short term workaround of start > run shutdown -a
> > but would like to figure out what is causing this. Has anyone seen this
> > issue before? The other odd thing seems to be that this only occurs when the
> > systems are connected to the network, and it only started doing this after
> > the systems were running for a week or two. They say they haven't installed
> > any software on these systems either. I've had them reinstall the network
> > drivers, but that only seemed to help for a bit. These systems were both set
> > up with a clean install of an image after receiving them from Dell using UIU
> > 3.0 and Ghost. I'm wondering if it's a driver issue and I should have the
> > user go through and reinstall all of the drivers?
> >
> > Any help or insight would be greatly appreciated!
>
> Start with clean Boot to determine the culprit and either uninstall it or
> update it.
> a Repair install of these machine from the image.
> A through scan again will not hurt and run the AutoRuns.exe from Microsoft
> to see in realtime the running processes in the background also FileMon a
> grate tool to have.
> Compare the Version of the services.exe on these town troublesome machine
> with another working one to determine nothing tempered with them.?
> HTH.
> nass
> -----
> www.nasstec.co.uk

[tomas]

Just bumping this post again, still having issues with these PC's. Does it
usually take a while to get a response here?

"tomas" wrote:

> Ok, after doing this and a few other things...got to looking at it possibly
> being a driver issue. After doing a reinstall of the drivers on this system
> I'm now getting the following error:
>
> Services and Controller App
> Services and Controller application has encountered a problem and needs to
> close.
>
> When I look at the error report this is what it says:
>
> szAppName: services.exe szAppVer:5.1.2600.2180 szModName:esent.dll
> szModVer:5.1.2600.2780 offset:0001baec
>
> After the driver reinstall, these machines are no longer getting the
> countdown message. In look at esent.dll it appears this is just used for the
> Windows automatic updates, and it does look like there may be a hotfix for
> this: http://support.microsoft.com/kb/910437
>
> I also found a couple of sites that mention this could be an isue with group
> policy for a machine that was moved off of a domain to a workgroup, and the
> local policy just needs to be reset. Has anyone seen this error message and
> is it most likely related to Windows Update or a group policy problem?
>
> Thanks!
> Tomas
>
>
> "nass" wrote:
>
> >
> >
> > "tomas" wrote:
> >
> > > We're having some issues with a couple of our new computers, unfortunately
> > > they are remote from my location so troubleshooting this error has been a bit
> > > of a pain. The issue I am seeing is the following error notices:
> > >
> > > 1) The instruction at "0X606cbaec" referenced memory at "0X02a90328". The
> > > memory could not be "read"
> > >
> > > if you click OK to terminate program then you get:
> > >
> > > 2) C:Windows\system32\services.exe terminated unexpectedly with status code
> > > -1.
> > >
> > > and the computer shuts down.
> > >
> > > Both of these affected systems are running Symantec AV, with the latest
> > > patch and fully updated. I oringally suspected some sore of a worm, and
> > > Symantec nor the Kaspersky online scan found anything. They are both running
> > > Windows XP SP2, fully patched.
> > >
> > > I've given the users the short term workaround of start > run shutdown -a
> > > but would like to figure out what is causing this. Has anyone seen this
> > > issue before? The other odd thing seems to be that this only occurs when the
> > > systems are connected to the network, and it only started doing this after
> > > the systems were running for a week or two. They say they haven't installed
> > > any software on these systems either. I've had them reinstall the network
> > > drivers, but that only seemed to help for a bit. These systems were both set
> > > up with a clean install of an image after receiving them from Dell using UIU
> > > 3.0 and Ghost. I'm wondering if it's a driver issue and I should have the
> > > user go through and reinstall all of the drivers?
> > >
> > > Any help or insight would be greatly appreciated!
> >
> > Start with clean Boot to determine the culprit and either uninstall it or
> > update it.
> > a Repair install of these machine from the image.
> > A through scan again will not hurt and run the AutoRuns.exe from Microsoft
> > to see in realtime the running processes in the background also FileMon a
> > grate tool to have.
> > Compare the Version of the services.exe on these town troublesome machine
> > with another working one to determine nothing tempered with them.?
> > HTH.
> > nass
> > -----
> > www.nasstec.co.uk

[pd1w]

tomas, have you resolved this issue?

I've got a similar issue. I get the "Services and Controller App
Services and Controller application has encountered a problem and
needs to close. " And I get the exact same error report:

"szAppName: services.exe szAppVer:5.1.2600.2180 szModName:esent.dll
szModVer:5.1.2600.2780 offset:0001baec "

This is a NEW Dell XP machine (Latitude D630). I've only been working
with the computer for 5 days... I also updated some drivers and got
rid of the count-down thing.

Shortly after the error message appears, however the computer locks
and I have to do a hard re-boot. Any info would be helpful!

Thanks!!!

[tomas]

pd1w:

Hello, I'm just curious, was your system just recently on an Active
Directory domain and then removed? If so that's what my issue was related
to. If this is the case with you, let me know and I can post what I did to
fix it.

Also, we have some of the D630 laptops here and we noticed they are really
picky about the order the drivers are installed because of the Biometric
scanner and the Wave software that goes with it.

Tomas

"pd1w" wrote:

> tomas, have you resolved this issue?
>
> I've got a similar issue. I get the "Services and Controller App
> Services and Controller application has encountered a problem and
> needs to close. " And I get the exact same error report:
>
> "szAppName: services.exe szAppVer:5.1.2600.2180 szModName:esent.dll
> szModVer:5.1.2600.2780 offset:0001baec "
>
> This is a NEW Dell XP machine (Latitude D630). I've only been working
> with the computer for 5 days... I also updated some drivers and got
> rid of the count-down thing.
>
> Shortly after the error message appears, however the computer locks
> and I have to do a hard re-boot. Any info would be helpful!
>
> Thanks!!!
>
>

[dkrnek]

Hi there!

Tomas ... I have the same problem. And as you figured it out it is probably the domain - workgroup transit problem.

The Server 2003 was removed from the network and so was the domain from a computer connected to it.

I was looking for an advice how to restart local policy (if that is the case), but Im not such an expert to manage it (or to know what exactly am I doing). The data on the computer must be intact. So I rather ask twice and act once! :)

Can you help me?

Have a nice day!
DN