svchost.exe is crashing

I came in this morning (and not for the first time) and found a dialog box on my screen saying "svchost.exe has caused an exception. Would you like to debug this?"

Fortunately, it gives the PID. Using tasklist /svc I see this instance of svchost is running the following:

svchost.exe 1684 AudioSrv, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, helpsvc, HidServ, LanmanServer, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, srservice, TapiSrv, Themes, TrkWks, w32time, winmgmt, wscsvc, wuauserv

After this happens the most noticeable thing I am missing is audio. My system doesn't think it has audio hardware anymore.

Any ideas on what could be causing svchost to crash or how to go about narrowing it down?

System:

• Win XP SP3
• Dell Latitude E5500

4 Answers

Lots of things cause svchost to crash. Svchost is a container for running several system services, and sometimes it's not very clear which service caused the crash.

You'll need to find out more information before you can diagnose the issue. Check the application/system log for errors and warnings. Usually these can be referenced on Microsoft Help and Support with details, cause and resolutions.

Microsoft has a KB about troubleshooting service crashes.

From

To isolate each service into its own process:

sc config SERVICE type= own

Event Viewer errors can be useful in figuring out which svchost is crashing. Tasklist /SVC or Process Explorer can be helpful in narrowing down things also before isolating the suspect services.

The blog article has another method which is bit more involved. (Best to do new system restore snapshot before trying that)

sc config SERVICE type= share

to restore things back to normal.

One way to dump the process:

There are several ways to dump a particular service:

1. Use Debug Diagnostic Tool (DebugDiag) 1.2.

2. Use the following batch file:

   FOR /F "tokens=2 delims=," %%A IN ('tasklist /svc /FI "services eq winmgmt" /NH /FO csv') DO SET PID=%%~A
   adplus.exe -hang -p %PID% -o c:\dumps

(requires Debugging Tools for Windows installed, for the adplus.exe or vbs) The blog contains also another tool.

The symptom of not having audio could be an indication of a hardware failure. This type of problem could also be the result of malware taking over your soundcard and using it as a listening device. I would look this one over very carefully.

Simply updating the audio driver is worth a shot. I would also recommend using process explorer to get a better look into what is happening at the time of the crash.

Process Explorer Download

There are chances of overheating, problem with the system files, settings and some other issues discussed below. Please try the following solutions.

Cause #1: Overheating

I assume there is a possibility of your computer overheating. Check the CPU temperature from your BIOS screen as follows:

1. Restart your PC.
2. Press F2 or Del key repeatedly until the BIOS Configuration Screen appears.
3. Go through different tabs and check the Processor Temperature. If it is higher than 60, it indicates an overheating issue. If it is lesser, there may be other reasons as well.
4. In case of overheating, apply the thermal paste on your processor. Replace your fans as they are probably not working properly. Clean-out all the motherboard and other components properly.

Cause #2: System Settings

1. Click Start, type "System Restore" in the Search Box.
2. Press Enter.
3. Restore your PC to an earlier state.
4. From the Internet download ZombieSoftFix. Fix DirectX/ DLLs.
5. Reboot your PC when you're finished repairing it.

Cause #3: Disable Conflicting Services

1. Click Start, type "services.msc"
2. Press Enter.
3. Uncheck and disable all Non-Microsoft services