Several weeks ago, my company laptop started having some strange problems. I could no longer launch the Microsoft Developer Web Server (via Visual Studio->Debug). I later figured out that I couldn't execute any .NET application.

In speaking with Microsoft CLR specialist after reviewing my dmp files, he said

  1. When loaded into your process, 8 bytes at offset 0×168 into the .exe files are being set to 0. This is the issue that is causing the CLR to fail. These bits are set correctly in the file you provided to me.

  2. C:\Windows\System32\Detoured.dll is loaded into the process. This means to me that the detours library is being used on your machine to modify the behavior of these processes.

I have also figured out that when I boot into Safe Mode, then everything works.

Also, I've figured out that if I right click on an .NET executable, and choose "Run As" and enter my currently logged in user's credentials, then the application works. It just doesn't work, if I just double click on the app.

There's lots of system event messages and Dr. Watson type errors. Here's a few that I get:

When launching MS Developer Web Server from withing Visual Studio, the Message box pop-up says:

WebDev.WebServer40.exe has encountered a problem and needs
to close. We are sorry for the inconvenience.

VSHost system event log entries:

Event 1:
Application: MyWebSite.vshost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an internal error
in the .NET Runtime at IP 791A8BBD (79140000) with exit code 80131506.

Event 2:
Faulting application MyWebSite.vshost.exe, version 10.0.30319.1, 
stamp 4ba2084b, faulting module clr.dll, version 4.0.30319.1, 
stamp 4ba1d9ef, debug? 0, fault address 0x00068bbd.

System event log entries for running third-party apps:

Source: Application Popup
Description: Application popup: #APPNAME#.exe – Application Error : The 
application failed to initialize properly (0xc000007b). Click on OK 
to terminate the application.

Applications that I've built that uses .NET v4 Framework system event logs say:

Source: .NET Runtime
Framework Version: v4.0.30319
Description: The process was terminated due to an internal error in the 
.NET Runtime at IP 791A8BBD (7914000) with exit code 80131506.

Applications that I've built that uses .NET v2 Framework system event logs say:

Source: .NET Runtime
Description: .NET Runtime version 2.0.50727.3053 – Fatal Execution 
Engine Error (7A097706) (80131506)

Here's more details on my blog - including everything that I've tried so far and more details and narratives.

As far as restore points go, my oldest restore point is a few weeks ago, at which I still had this problem, so I don't think restoring that point will help much.

How can I figure out which process is causing the problem and then fix the computer?

  • 1
    Do you have a list of all running processes and all services running on the system? If you use Process Explorer to view all the loaded .dll files when the application crashes, that list would also be useful. Since safemode runs fine, there's a driver or process that's injecting code into your .Net applications which normally loads on startup. Oct 5, 2010 at 3:28
  • I've went through and stopped every service and killed every process that I can do without Windows rebooting, and I still have the same problems. If it's a background service or process, then I can't find it via task manager, process explorer, or Windows Services.
    – Jim W
    Oct 6, 2010 at 4:24
  • You could maybe find it using Autoruns : It could be a shell extension, service or even a codec.
    – harrymc
    Oct 6, 2010 at 10:19

3 Answers 3


Since you say that the problem doesn't happen in safe mode, it's clear that this is caused by an installed application, add-on or driver.

In view of the effort you have already invested in this project, I would advice to reformat the hard disk and reinstall XP, then reinstall all the products one-by-one, rebooting to check whether the problem has returned. Alternatively, you may uninstall products using Revo Uninstaller, but even Revo can miss a particularly sneaky installation.

Frankly, executable files being modified when launched have the smell of a viral infection, which is why I exceptionally recommend reformatting in this case.

  • The strange thing is that everything works fine when I use "Run As" and use my same creds. Also, it's only happening to .NET apps. I'm unsure if I can just reformat everything, since it's a corporate laptop with all of the corporate apps installed.
    – Jim W
    Oct 5, 2010 at 15:18
  • A corporate computer can usually be restored to an initial image. The RunAs is effectively puzzling, since XP doesn't have limited accounts like Vista & Win7. It is always possible for a bug in a legitimate application to cause more damage than a virus. In this case it would probably be some security product, as these do weird things. You might try disabling them and see.
    – harrymc
    Oct 5, 2010 at 15:36
  • I hate reverting to the reformat option. I'd love to figure this out in case it happens again. However, I was just told that my laptop's corporate lease has expired and I'm required to get a new laptop anyways. Looks like that might be the only option that works now.
    – Jim W
    Oct 8, 2010 at 15:28
  • Well, good riddance!
    – harrymc
    Oct 8, 2010 at 16:05

Your answer may have been in the first paragraph - remove Detours. Go to Add/Remove programs, find Detours, and remove it.

Detours: http://research.microsoft.com/en-us/projects/detours/

  • Detours isn't installed. It's in system32 directory as part of WinXp and in use by various Microsoft products including Visual Studio, Dr. Watson, etc. I tried removing it and it just led to more crashes of other apps and didn't fix the problem. That link is for other apps to use detours, if needed as a library.
    – Jim W
    Oct 6, 2010 at 0:17
  • @Jim W: Detours is not part of Windows XP, and it doesn't come with Visual Studio. "Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by re-writing the in-memory code for target functions." <-- your first quoted paragraph says that this is the cause of the problem you're having.
    – Mark Allen
    Oct 6, 2010 at 2:04
  • I've already tried removing detoured.dll (by renaming the file) and I still have the same problems (plus more problems).
    – Jim W
    Oct 6, 2010 at 4:17
  • @Jim W: Darn, sorry that didn't help. If it were my machine and I had to be the one to fix it, my next step would be to remove .NET reboot and then reinstall .NET again. Good luck.
    – Mark Allen
    Oct 7, 2010 at 18:29
  • 1
    @Jim W: Well, dang. Since it works in Safe Mode and it works if you authenticate again for some odd reason... does it work if you create a wholly new user on the same machine, log in as that user, and then attempt to run programs?
    – Mark Allen
    Oct 9, 2010 at 1:29

I would try using Dependency Walker. Profile your program and save the output. Boot to Safe Mode and profile again. Comparing the output may provide more information about when the program is being modified.

You could also try using WinDbg from the Debugging Tools for Windows. (That link is for driver developers, but I've used WinDbg for .NET programs.) To get the most debugging output, you'll need the Windows Symbol Package for XP as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .