Woomera Posted December 17, 2006 Share Posted December 17, 2006 windows keeps alerting me that comsurrogate is crashed and shut down(dllhost) with these details:Problem signature: Problem Event Name: APPCRASH Application Name: DllHost.exe Application Version: 6.0.6000.16386 Application Timestamp: 4549b14e Fault Module Name: StackHash_1703 Fault Module Version: 0.0.0.0 Fault Module Timestamp: 00000000 Exception Code: c0000005 Exception Offset: 00a1b5ed OS Version: 6.0.6000.2.0.0.256.1 Locale ID: 1033 Additional Information 1: 1703 Additional Information 2: 2264db07e74365624c50317d7b856ae9 Additional Information 3: 1344 Additional Information 4: 875fa2ef9d2bdca96466e8af55d1ae6eanyone knows the reason? Link to comment Share on other sites More sharing options...
cluberti Posted December 17, 2006 Share Posted December 17, 2006 Not necessarily, but if you install the User Mode Process Dumper tool and create a rule to monitor dllhost.exe, we can probably analyze the .dmp file that will be created the next time it crashes. Link to comment Share on other sites More sharing options...
Woomera Posted December 17, 2006 Author Share Posted December 17, 2006 ok that tool doesnt support windows vista System requierment .but i can run it using command line but it only dump the current status.did i miss anything? Link to comment Share on other sites More sharing options...
cluberti Posted December 17, 2006 Share Posted December 17, 2006 Ah, forgot about that. We'll have to use adplus:First, install the "Debugging Tools for Windows" from:http://www.microsoft.com/whdc/devtools/deb...ng/default.mspxOnce these tools are installed, do the following:1. Create a directory called c:\adplus2. Open a command prompt and change to the directory where you installed the debugging tools. By default, this is "C:\Program Files\Debugging Tools for Windows"3. Type the following command in the command prompt:cscript adplus.vbs -crash -pn dllhost.exe -o c:\adplusThis should generate a crash dump of dllhost.exe in C:\adplus that can be analyzed via windbg or cdb the next time you get a crash. If you don't feel comfortable doing it, I can do it if you PM me. Link to comment Share on other sites More sharing options...
duceyaj Posted December 17, 2006 Share Posted December 17, 2006 i had this error when i had nero installed. the nero codecs interfere with vista making thumbnails for folders that contain videos. Link to comment Share on other sites More sharing options...
Spooky Posted December 17, 2006 Share Posted December 17, 2006 I had this same problem with nero installed. Link to comment Share on other sites More sharing options...
ripken204 Posted December 18, 2006 Share Posted December 18, 2006 c:\program files\common files\ahead\dsfilter\nevideo.axrename that file to c:\program files\common files\ahead\dsfilter\nevideo1.axworked for me Link to comment Share on other sites More sharing options...
Woomera Posted December 18, 2006 Author Share Posted December 18, 2006 heh funny after it happened and i posted this topic it never happened again.i wonder what i was doing and what programs were ruuning at that time... Link to comment Share on other sites More sharing options...
Spooky Posted December 18, 2006 Share Posted December 18, 2006 Maybe it heard that the MSFN crew was on the case and that you had posted here, and it feared what would happen and decided to stop acting up. Who knows heh funny after it happened and i posted this topic it never happened again.i wonder what i was doing and what programs were ruuning at that time... Link to comment Share on other sites More sharing options...
Woomera Posted December 18, 2006 Author Share Posted December 18, 2006 lol? its funny though it sometimes say that kaspersky crashed and i click on close the program but its still running. Link to comment Share on other sites More sharing options...
cluberti Posted December 18, 2006 Share Posted December 18, 2006 @spooky - LOL Link to comment Share on other sites More sharing options...
Spooky Posted December 19, 2006 Share Posted December 19, 2006 I forgot to post this earlier, so to be complete, this problem can be caused by nero or divx. Look at this link for a fix:http://forums.microsoft.com/MSDN/ShowPost....80&SiteID=1 Link to comment Share on other sites More sharing options...
ripken204 Posted December 19, 2006 Share Posted December 19, 2006 ya, what i posted above was the fix. it happened to me whenever i clicked on an avi file or a folder with an avi file inside of it. Link to comment Share on other sites More sharing options...
Woomera Posted December 19, 2006 Author Share Posted December 19, 2006 ok i dumped it during 2 time crashes.ill pm u with the link to file CLUBERTI.Note:it happened when i tried to watch some mpeg files from a cd that my WMP crashed then i tried copying them to HDD and i was downloading a file from opera and browsing with firefox. Link to comment Share on other sites More sharing options...
cluberti Posted December 20, 2006 Share Posted December 20, 2006 Well, we've got a real problem - dllhost is crashing, but it's doing a 1st chance exception waiting on a thread that's already terminated (and isn't in the dump). Here's what I was able to cull from the dump.Here's the active thread in the dump - notice that we're waiting on a critical section in ntdll.dll (an API .dll, so anything could have called this, unfortunately):ChildEBP RetAddr Args to Child 0362f67c 776206a0 775fb18c 00000208 00000000 ntdll!KiFastSystemCallRet0362f680 775fb18c 00000208 00000000 00000000 ntdll!NtWaitForSingleObject+0xc0362f6e4 775fb071 00000000 00000000 00000000 ntdll!RtlpWaitOnCriticalSection+0x1540362f70c 775faa3d 77685340 0362ce32 7ffd8000 ntdll!RtlEnterCriticalSection+0x1520362f7a0 775fa954 0362f82c 0362c19a 00000000 ntdll!LdrpInitializeThread+0x710362f808 775fa980 0362f82c 775c0000 00000000 ntdll!_LdrpInitialize+0x21d0362f818 00000000 0362f82c 775c0000 00000000 ntdll!LdrInitializeThunk+0x10And here's the dump of the actual critical section data that was in the dump - notice that the owning thread is c64, but as I stated before, it's terminated already so I cannot see what the heck it is:dt ntdll!_RTL_CRITICAL_SECTION 77685340 +0x000 DebugInfo : 0x776857a0 _RTL_CRITICAL_SECTION_DEBUG +0x004 LockCount : -10 +0x008 RecursionCount : 2 +0x00c OwningThread : 0x00000c64 +0x010 LockSemaphore : 0x00000208 +0x014 SpinCount : 0dt ntdll!_RTL_CRITICAL_SECTION_DEBUG 776857a0 +0x000 Type : 0 +0x002 CreatorBackTraceIndex : 0 +0x004 CriticalSection : 0x77685340 _RTL_CRITICAL_SECTION +0x008 ProcessLocksList : _LIST_ENTRY [ 0x77687248 - 0x77685318 ] +0x010 EntryCount : 0 +0x014 ContentionCount : 5 +0x018 Flags : 0 +0x01c CreatorBackTraceIndexHigh : 0 +0x01e SpareUSHORT : 0 Critical Section is LOCKED, with 1 WaitersSo, it's your typical critsec abandon crash, but the dump isn't entirely of help (it shows the crash, but not the culprit who caused it). Thankfully adplus gathers log data, and I did find that the crashed dllhost was started with the GUID {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}, and the other dllhost was started with the GUID {CD84562B-B3E6-4D39-9E4F-9C1A1FCE4DA7}, neither of which I can find any information about. Perhaps you can search your registry and see what these GUIDs correspond to (especially the first one)? A dllhost.exe process won't be spawned by a Microsoft app, so perhaps the GUID will tell us who spawned the dllhost, and that will likely tell us who owns the component that caused the critical section abandon and crash of dllhost (since you were doing WM stuff I'd say it's a codec, but I can't be entirely certain). Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now