Rermoving Event ID 1000 ( WS03)

[soheil]

hello,

i have got this event ID 1000 ( application error) about a week. SVCHOST.exe stop responding and all server's critical service stop automaticlly like : DNS, DHCP, RRAS, File and printer shairing and so. by restarting OS every thing goes well about 2-3 houre again SVCHOST.exe freez ????

'''''''''''''''''''''''''''

Event Type: Error

Event Source: Application Error

Event Category: (100)

Event ID: 1000

Date: 11/10/2008

Time: 5:47:58 PM

User: N/A

Computer: KASPERSKY

Description:

Faulting application svchost.exe, version 5.2.3790.3959, faulting module unknown, version 0.0.0.0, fault address 0x7ffa4512.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 73 76 63 ure svc

0018: 68 6f 73 74 2e 65 78 65 host.exe

0020: 20 35 2e 32 2e 33 37 39 5.2.379

0028: 30 2e 33 39 35 39 20 69 0.3959 i

0030: 6e 20 75 6e 6b 6e 6f 77 n unknow

0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.

0040: 30 20 61 74 20 6f 66 66 0 at off

0048: 73 65 74 20 37 66 66 61 set 7ffa

0050: 34 35 31 32 4512

''''''''''''''''''''''''''''''''

any idea ?

[cluberti]

Right - the network services svchost (netsvcs) has crashed, which will take down all services running inside it. Most should restart, but at least one (the server service) will not until the system is rebooted - because srv.sys is the driver the server service loads into the system, and when a crash in the service occurs the srv.sys driver does not get unloaded. It is still running, but no longer talking to the server service - and for security reasons, only one copy can be running at any time, meaning it can no longer be unloaded and reloaded, thus the reboot requirement.

What I would suggest is a userdump dump of the svchost.exe process crashing:

1. Download the userdump executable, located here:

http://www.microsoft.com/downloads/details...;displaylang=en

2. Double-click the downloaded .exe file to extract the userdump installation files. By default, these will extract to C:\kktools\userdump8.1. Please click "Yes", then "Unzip" to extract the files.

3. Double-click the "setup.exe" file located in C:\kktools\userdump8.1\x86 to install the userdump utility. Please select the defaults when possible, and make certain to select the "Enable dump on process termination" feature when prompted.

NOTE: You may need to reboot the machine at this point for the installation to complete successfully.

4. Create a folder called C:\userdump.

5. Once installed, you will find a new icon in your control panel called "Process Dump". Please open this utility.

6. When the userdump window opens, please click the "New" button.

7. Please enter "svchost.exe" in the "Application name:" dialog box, and click "OK".

8. Click on the new listing for "svchost.exe", and click the "Rules" button.

9. Select the "Use custom rules" radio button.

10. Type "C:\userdump" in the "Dump file folder" dialog box.

11. Click the "Monitor Process Exit" box

12. Change the "MiniDump Type" to "Complete".

13. Click the "OK" button.

14. Click the "Apply" button, then click "OK".

The next time svchost.exe crashes, it should create a .dmp file (or series of .dmp files) in C:\userdump.