For a while now, I have been getting an intermittent crash of
SVCHOST.EXE on boot in Windows XP. Because it is intermittent, I cannot reliably reproduce it, nor can I narrow down when it started, and because it is
SVCHOST, I cannot determine which service is the one crashing because the dialog is created by
CSRSS.EXE, not any of the instances of
One thing I know for sure is that if I dismiss the below dialog that pops up when it happens, then the whole system hangs completely, but if I leave the dialog alone, I can continue to work and use the OS as normal, however upon shutting down (at which time the dialog is inevitably closed), the system hangs, resulting in a needed reset.
I used Anonymous Coward’s suggestion of setting each service to use its own instance of
SVCHOST instead of a shared one, and found to my surprise that the crashing process was not one of the
SVCHOST instances. It was
Now I’m left trying to figure out why
CSRSS crashes sometimes (the vast majority of searches that include filenames just return those worthless basic analysis pages), but I’m not sure how to debug such an integral part of the system short of a messy kernel debugger. (I’ll point out that the system does not BSOD, so there is no dump generated.)
One thing of not is that the addresses seem to always be the same. It has happened about a dozen or so times and the offending instruction is always at
0x76dea383 that tries to read memory at
0x00000000. Obviously the target memory address is useless, but I’m sure there must be a way to use the source address somehow.
What I have tried when this happens is to close every process and stop every service possible. Unfortunately, that does not help narrow down the cause because the dialog remains displayed because it is created by
csrss which cannot be stopped without completely taking down the whole OS.
I have tried figuring out which service is responsible without success. For example, the last time that it happened, I stopped every single service that was possible (and a few that are not normally possible), quit every single app, killed Explorer, and basically stripped the system down to the bare minimum (there were maybe 10 processes left, using ~111MB of RAM and 0% CPU), but it still hung once the dialog was closed. This makes me suspect that it is one of the critical system services, though if it were, then why would the system keep running in the meantime?
Does anyone of a way I can debug this? For example, can anyone think of a way to determine the instance of
SVCHOST associated with the error? I checked the Event Log and Process Explorer but could find nothing to help pinpoint it. Is there something I can do with the memory address?
(Yes, I’ve Googled this and found numerous mentions of the Windows Update service, but it is not that because
BITS are disabled by default. And no, I cannot do the disable-all-services-and-enable-one-by-one method of testing because if it is one of the critical system services, then Windows won’t run at all.)