svchost.exe error: "0x745f2780" referenced memory at "0x00000000"

[CogX]

Application popup: svchost.exe - Application Error : The instruction at
"0x745f2780" referenced memory at "0x00000000". The memory could not be
"read".

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This happened on only two out of ~380 systems back after the August 2006
patch day, but now it is happening on three dozen more of them after
September 2006 patch day. Everytime I think I have figured out what might
be the problem, another system and some more testing blows my current
working hypothesis out of the water.

The only common point is that I point AU to a central WSUS
server and I will point out I never had these errors or these problems
before SP1 was applied to the WSUS server this summer and thus the wuau*.*
client files were updated to version 5.8.0.2607, instead of the usual
5.8.0.2469 version I never had a problem with. However, everyone on these
groups are always quick to defend WSUS SP1 and say there is no possible way
it is the cause of the problems, but then I have yet to find any of them
ever reply with any hint of what the actual cause of these errors are nor
provide a solution.

When does this error happen? Sometimes the popup will even show *before* a
user login, but usually a person logs on soon after the boot up at which
point it appears to be the case that it is happening a few seconds after
logon.

In any case, one interesting thing to note is to NOT click on the "Send
error report" nor the "Don't send", because once one does, the system
pretty much locks up to the point of being useless and a hard hold-down-
the-power-button reboot is really all that can be done. If one just leaves
that error box up, though, the system can still be used.

If one sees the automatic updates yellow taskbar icon and installs the
pending updates, on most systems they will install, but on a few the first
update just hangs and again all you can do is a hard reboot. Here's the
kicker, doesn't matter which patch is the first patch AU will install, at
least I've ruled out three of the seven pending updates so far.

Also, not every system that gets the initial svchost error will hang or
error on installing the pending AU updates. Some do hang on installing
whatever the first pending update is and a hard reboot is all that can be
done at that point. Some were left as long as 5 hours with no change, so I
think we can assume that is an infinite loop condition. Now, on some
where the initial svchost error box was closed, sometimes the system is
responsive enough to still try to install the pending AU updates, but then
the first patch throws another svchost error and things are again locked
up and waiting for a hard reboot.

Note that these are systems which were fully patched before the August
patches and now before the September patches. These systems already had
the ancient KB894391 patch installed and I even tried to install it again,
anyway, even though clearly that shouldn't be applicable nearly a year
later. Oddly, although a reboot after installing it on a system that
already had it didn't throw the svchost error upon boot, when I went to
install the pending AU patches, the first one then caused the svchost
error and... hard reboot time.

Now, what *appears* to have helped me dig my way out of this, although I
can't see how this really was any actual solution, but someone had
mentioned on one of the posts that they were having the same svchost
errors starting last month also connecting to a WSUS SP1 server and by not
approving Office-related patches it cleared things up. Well, that also
*appears* to have helped me as well, once I no longer approved the
Publisher 2003 patch nor the Outlook Junk Mail update. Note that some of
these problem systems do have Publisher 2003, others do not, although just
having Office 2003 installed at all will make the Publisher 2003 available
in AU.

Helped in that the initial svchost error no longer is coming up, based on
a few more systems I visited after making that change. However, these
systems had *already* downloaded those Office updates anyway and had them
pending to install. So, as was the case before, some systems they install
and on others the first update - whichever update happens to be first on
the list -throws the svchost error.

Again, no repeatable logic I have been able to find, I just go to each
system and it behaves differently. The only solution is to install the
updates manually either from the individual downloads or to go to
Microsoft Updates through IE. That of course defeats the entire purpose
of Automatic Updates, WSUS or no WSUS. I'm going to take some of the
systems and no longer point them to the WSUS SP1 server and we'll see if
next month when patch day comes whether they are saved from these issues.
Given that the same svchost error above has happened after two different
patch days, it stands to reason this will happen again on some systems
next month too.

(Disclaimer: Yes, I typed this really fast and didn't proof-read it, I
would if I didn't have all of these systems to patch manually because AU
is useless on them.)

[frogger90]

Just this morning, the exact same error came up on my computer. I'm
running XP Media Center -- latest. I always leave my computer on and no
updates have been installed in the last 3-4 weeks.

On a weird note, somehow it lost reference to my sound card, although
it showed up in Device manager, my system (media player and Windows)
did not recognize any sound card being installed.

I rebooted the computer and once again got audio, but then less than 2
minutes later, svchost.exe "0x745f2780" referenced memory at
"0x00000000" error occured again. This locked up Outlook, Messenger and
Task Manager and I was unable to shutdown or open any programs -- start
menu functioned, but no programs opened.

Had to perform warm reboot, got into Windows and 30 seconds later same
error appeared again. I see no evidence of Virii, my computer is 100%
up to date and I have not installed any programs nor downloaded any
files, nor visited any suspicious websites in the last month.

We did have Publisher 2003 and Outlook 2003 open over the last several
days while printing out 120+ brochures.

Any help in troubleshooting is greatly appreciated.
Thanks!

[frogger90]

Just found a potential fix from another post.
http://swigartconsulting.blogs.com/tech_blender/2006/07/index.html

[CogX]

"frogger90" <jsco...@hotmail.com> wrote in
news:1158253604.5...@m73g2000cwd.googlegroups.com:

> Just found a potential fix from another post.
> http://swigartconsulting.blogs.com/tech_blender/2006/07/index.html
>
>

Well, after hours of doing methodical testing on several of my systems with
this problem, I still couldn't pin the problem down to one thing.
However, at the end of the evening I did get one where even after I had all
pending updates finally installed, verified it by going to the Microsoft
Update web site, each login after a yet another reboot was STILL throwing
svchost.exe errors. So, on all the other systems I had visited that seemed
to clear up the errors once all the pending updates were installed
apparently wasn't good enough for this system.

The only thing I was able to do to get that FULLY PATCHED system to stop
still throwing svchost.exe errors after every boot was to...

net stop wuauserv
net stop bits
del /q /s %windir%\SoftwareDistribution

... and reboot one last time. I rebooted three more times just to make
sure it was gone and it appears to be fine now. Sadly, I now
apparently have to do this on 20+ more systems. So much for "automatic"
updates. :<

[Craig]

I think this is a problem with automatic updates MS-BIT and virus checkers being unable to unload or terminate svchost.exe correctly, i know you are using WSUS server but correct me if im wrong but they are based on the same code(or they are the same) as a stand alone XP machine's automatic updates, with the virus checker enabled and automatic updates on OCT patches where down loaded and i chose to install on shutdown to my shock! ok not shock more like expected disapointment i got svchost error whilist installing the first update, upon reboot i get as above error's, lucky for me i mirrored my hdd before i applied this update ( a practice i have gotten into since supporting the SP2 update and having had 50% of my companys customers expereincing serious problems upon reboot)
Then once all was working fine back to an identical OS as i had before i applied the updates, i disabled my virus scanner applied updates and guess what no problems, saying that this may be relevant to only non-WSUS as not all your machines do this as you stated and i know disabling virus scanners on you scale is not a wise move, all i hope is this points you in the right direction!

spelling is not the best but hey who said i perfect :P

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

[BigAl]

I was relieved when I saw your post about the same issue I have been dealing with for months. I too believe it is related to WSUS SP1, or the timing sure is extremely coincidental.

Very well written analysis of the situation. Are you running Windows Defender at all?

Thanks,

ajh

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

[Tom Willett]

To whom are you replying and about what?

<BigAl> wrote in message news:200610121...@dickinson-wright.com...

[BigAl]

<Re: Misery Loves Company - Tom Willett>

<To whom are you replying and about what?>

svchost.exe error: "0x745f2780" referenced memory at "0x00000000" - Reply
14-Sep-06 10:37:01

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Roman S]

Here's your fix...you'll need to contact microsoft to get the patch...

http://support.microsoft.com/kb/916089

[bradtilley]

I noticed today that only machines with Intel Core Duo processors were affected by this in our shop. We had four today.

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

[mtsurf]

I have used this on the machines that are getting the error and it
seems to have fixed the error.

USE REGEDIT AND GO TO THE FOLLOWING KEY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER.
with the explorer key highlighted, create another key (a subkey) by
clicking Edit, New, and Key. Type AlwaysUnloadDLL to name the key,
press ENTER double-click its default value, type 1 in the value field,
and click OK. Close REGEDIT then reboot the computer.

XP should now empty the DLLs from the cache memory

[mtsurf]

I have used this on the machines that are getting the error and it
seems to have fixed the error.

USE REGEDIT AND GO TO THE FOLLOWING KEY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER.
with the explorer key highlighted, create another key (a subkey) by
clicking Edit, New, and Key. Type AlwaysUnloadDLL to name the key,
press ENTER double-click its default value, type 1 in the value field,
and click OK. Close REGEDIT then reboot the computer.

XP should now empty the DLLs from the cache memory

[CogX]

=?Utf-8?B?Um9tYW4gUw==?= <Rom...@discussions.microsoft.com> wrote in
news:07A3C04E-5FD1-4893...@microsoft.com:

> Here's your fix...you'll need to contact microsoft to get the patch...
>
> http://support.microsoft.com/kb/916089
>
> "CogX" wrote:

I did request it now going on 36 hours ago and still no reply from
Microsoft whether or not they will give it to me. The last time I tried to
get a hotfix, they didn't give it to me either. This entire private hotfix
thing really ticks me off. There are actually three other recent KB
articles about recent private hotfixes which I'm quite sure we've had the
symptoms on at least some of our 450+ XP PCs, but when contacting MS
support they don't want to give out the hotfix, it really gets old.

At this point, given the hours of frustration this has caused me since the
end of July, assuming they even give me the hotfix, I wouldn't be surprised
at all if it didn't fix my problem, although yesterday I did start getting
faults in svchost which actually stated the fault was in MSI.DLL, when
doing either Automatic Updates or then when I went to the Microsoft Updates
web site.

[CogX]

Happens on single-core Pentium 4s in my shop (Dell Optiplex and Dimension
models).

One question for ya, do you install Office 2003, but _not_ Outlook?
Do you remove Outlook Express from the Add/Remove components?

I'm trying to figure out if there is something fairly unique we do, that
the masses do not. At first I was sure it was a AV problem, due to testing
on my systems, but then other people having the same exact problem say they
have it without any AV software installed at all (we use Symantec AV 10.)

[Markus F]

Hallo,
I installed the Patch 916089, but it didn´t solved my Problem. Only
the Errormessage changed to the following:

Fehlgeschlagene Anwendung svchost.exe, Version 0.0.0.0,
fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse
0x00000000.

After 3 reboots the Error has gone, but i think with the next Updates
the Error will be back.
Has anyone got the same experiences ?

Markus F

[BigAl]

I've been testing it since Thursday and it seems to have fixed all of our svchost.exe issues. I've rolled it out to 550+ machines without any issues.

Not sure how you're requesting the HotFix, but they should stay on the phone with you until you have it in your in your Inbox or have it downloaded.

ajh

[CogX]

"Markus F" <ops-te...@oce.com> wrote in
news:1161257254.4...@i42g2000cwa.googlegroups.com:

Yes, once I get all of the pending updates installed manually, I then get
this different svchost.exe fault in module "unknown" at 0x0000000 and
nothing I can think of to do can make it go away. I've disabled several
services, including wuauserv, bits, and termservice and it still comes up
after login, no matter what I've tried so far. I didn't disable every
service svchost.exe loads, yet, because it takes *hours* to do that kind of
testing and I don't have that much time to CONTINUE to waste on this
stupidity. After 3 hours without finding any reason for that fault, I just
have to reimage that system and wait to see how much "fun" 11/14 will be,
when it will absolutely happen across several of my computers yet again.

Again, what changed?? These systems have been in use since July 2004,
patched successfully month after month, and then starting in July 2006 all
of a sudden these svchost faults starting up at random across a small, but
significant percentage of my PCs. :(

[CogX]

Nope, not running Windows Defender. We do use Symantec AV, but then that
has always been installed and these computers having the problem have been
in use since July 2004 - actually some of them since April 2004 - with SAV
installed and patched every month without problems, until whatever changed
in July 2006. If it isn't related to some other XP update, then one really
just has to think it is a WSUS SP1 issue, but then people are saying they
have these same exact errors and don't connect to WSUS so then we are right
back to asking what changed this summer and why does it only happen to a
small number of us?

[CogX]

"mtsurf" <mtsu...@bresnan.net> wrote in
news:1161187271.1...@k70g2000cwa.googlegroups.com:

> I have used this on the machines that are getting the error and it
> seems to have fixed the error.
>
> USE REGEDIT AND GO TO THE FOLLOWING KEY
> HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER.
> with the explorer key highlighted, create another key (a subkey) by
> clicking Edit, New, and Key. Type AlwaysUnloadDLL to name the key,
> press ENTER double-click its default value, type 1 in the value field,
> and click OK. Close REGEDIT then reboot the computer.
>
> XP should now empty the DLLs from the cache memory

Well, I tried this, but it didn't help me.
Also, I researched it and according to the MSDN web pages, this setting was
no longer used after NT 4.0 and earlier, so it would seem that you just
happened to have a coincidence that your errors went away after you did
that and rebooted.

[Brad]

I got no response from Microsoft via email so I called the local toll free
help number and got thru to a nice chap (with an Indian accent) who gave me
the FTP download site and the required password. I installed the patch and
now my computer is much faster, and no svchost error--but I still have Auto
Updates turned off as a precaution!

Thanks to Roman S for the solution--I bet there are a hugh number of users
who are suffering this problem, with insufficient knowledge to know what to
do. I know I wasted two and a half days until I found this hotfix--all the
time thinking I had a virus, or had done something wrong myself, when it was
a genuine MS Update that had caused the error.>

[pauldalton]

One thing i found which worked and did not require the hotfix:

click Start > Run, type msiexec /regserver in the run box, click OK.
Reboot and retry the updates...from what i have read, people have had mixed results with this solution, but it worked for me :o)

[DavidS]

Note in the KB article that it calls for the Microsoft Windows Installer 3.1
v2 (3.1.4000.2435) as a prerequisite to the hotfix. We had tried the hotfix
with no success until we applied the MSI update.

[marco]

thanks for sharing the hotfix link

has anyone else managed to get hold of the hotfix???, atleast can eliminate this being a virus.

any help very much appreciated, really freakin frustrating....lol

[Marco]

had to go into safe mode, eventually discovered that disabling the mcafee services, solved my problem.

i have no idea why it wont run on this new dual-core machine on xp....

anyway thats solved my problem 4-5hrs later....lol

BRA, apologies it seems that hotfix has a passord that resets a day later.

Hope this helps someone.

[Stephan]

Much love and thanks for posting the fix to that very pesky svchost error. I contacted Microsoft for the hotfix and life is back to normal. I have disabled autoupdates because I know that it caused the problem. I had just updated both of my system with the latest updates and after the reboot, it was ON AND POPPING!!!

THANKS AGAIN!!!!!

BTW: This in now my favorite website for problem solving!

RE: svchost.exe error: "0x745f2780" referenced memory at "0x00000000" - Roman
17-Oct-06 12:15:02

Here's your fix...you'll need to contact microsoft to get the patch...

http://support.microsoft.com/kb/916089

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

[Jim]

I got this problem on my home PC. Can anyone help to post the patch somewhere or forward me a copy (jimn...@yahoo.com.sg)?

Thanks.

[Ant-o]

Just contacted Microsoft regarding the hotfix but they only have one for XP
versions 2003 or later. That didn't help me much as I have 2002 but I did
manage to fix it by

1) Turn off AU (without closing the error window) and restart your computer.
This gets rid of the message.

2) I then turned AU back on, restarted and it was fine. Fixed itself!

Hope this helps the earlier Xp users

[mdowling]

I run a single XP SP2 machine, which is a Pentium Core Duo. I
experienced nearly all of the symptoms noted above. I disabled virus
checking and AU and installed updates from the AU website. Now I run
with all virus checking enabled but with AU set to download and notify
- *not *to install automatically. Thanks to all previous correspondents
for helping me fix this!

--
mdowling
------------------------------------------------------------------------
mdowling's Profile: http://forums.techarena.in/member.php?userid=20870
View this thread: http://forums.techarena.in/showthread.php?t=587276

http://forums.techarena.in

[Ray]

Hey,

We are in the same boat as you right now. You described it to perfection. Just to fill yoou in, the problem is not your WSUS server I can guarantee that because I do not use a WSUS server, I update directly from Microsofts Update server. We have been blaming Dell because the issue started to appear on Gx620 Small form units only between June and August of 2006. Dell came in because we thought there was a system issue. They replaced ram and they repalced motherboards in these units and still the problem persists. Occasionally the memory addresses are different whe the errors get thrown, but the number shown in the subject line 0x745f2780 always appears in the beginning. We have been on Dell about this to the point wehre they sent me replacement units Optiplex 754 small form units to replace what we thought were defective gx620 units, two days after installing the new Optiplex 745 I am faced with the identical errors. I have to ask if this is Microsofts way of Marketing Vista? or is there really a problem with small form Dell 620 units and Optiplex 745 small form units? We replaced 1 gx620 unit in October with a Optiplex 745 Minitower, and the issue has not returned on that unit. It is not a small form unit. What type of units are you using?

[Rogier]

This one really solves the issue:

http://swigartconsulting.blogs.com/tech_blender/2006/07/index.html

UPDATE: This post has received a ton of comments. One, in particular, suggests an easier fix for this problem:

1.Go 2 the start menu
2.Right click "my computer"
3.Click "properties" then the "automatic updates"
tab
4.Choose "turn off automatic updates"
5.Reboot your computer
6.Go back to start menu and in all programs go to "windows update" you have to be connected to the internet.
7.Manually update windows.
8.Turn your automatic updates back on.

I have also had a number of people comment that the problem reappears after some time. The recommended fix, if the problem reappears, is to turn off automatic updates, and just manually go to Windows Update periodically and update your machine.

[Bill]

Only one scenario here fo Norton AV. Do not allow Norton Internet Security 2006 to fix the fact that you have Auto Update (AU)turned off. This is when the problem is generated. Either follow the instructions above for turning AU on/off or switch your AV software.

boot up, leave the fault pop up on, turn off AU, shut down boot up, ignore Norton IS 2006 fix - problem gone? you may wish to turn AU back on its up to you

[montanarobert]

Thanks for the fix,i can finally get rid of this headache and get some sleep!!!!!

[Tom Willett]

What fix?
What's with you eggheadcafe people?
Start new subject lines, and don't even reference anything from previous
posts?
Nobody knows what you're talking about.

<montanarobert> wrote in message news:2007222192023...@cox.net...

[david]

Good morning

I have exactly the same problem that you have so I was wondering if you were able to fix this problem

Many thanks

David

[Tom Willett]

What same problem?
Egghead strikes again.

<david> wrote in message news:200742045632...@morganstanley.com...

[MowGreen [MVP]]

You don't know ? We're supposed to be mindreaders and clairvoyants,
Tom <w>

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

[Tom Willett]

Steve: These Eggheaders are being misled at the cafe as to how a newsgroup
works ;-)

Tom

"MowGreen [MVP]" <mowg...@nowandzen.com> wrote in message
news:%239jTWx4...@TK2MSFTNGP04.phx.gbl...

[Robert Aldwinckle]

"Tom Willett" <tomp...@mvps.invalid> wrote in message
news:eBxA6W5g...@TK2MSFTNGP03.phx.gbl...

> Steve: These Eggheaders are being misled at the cafe as to how a newsgroup
> works ;-)

They certainly aren't aware that many users only have caches of messages
or at most limited archives.

Perhaps their archive is based on thread length? <eg>
(51 posts and counting)

http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?&query=egghead+david+willett&lang=en&cr=US&guid=&sloc=en-us&dg=microsoft.public.windowsupdate&p=1&tid=65340e6c-fdb8-4584-9535-1eb0561910e2&mid=65340e6c-fdb8-4584-9535-1eb0561910e2

(web interface search of this newsgroup for
david egghead willett
)

Note there is no way to represent both a thread and its search using the
web interface. In order to get the same search result that I started with
you will have to use the above search terms, which hopefully will stay
unique long enough for you to see the whole thread listed by itself again,
if desired.

As usual the post which got the most votes, thus causing the web interface
to retain this rather useless "discussion" was the opening post.
How can a "Question" be voted on as being "helpful"?

BTW buried in all the Me too! posts there are actually some "solutions".
<snicker/>

FYI

Robert
---