COM SURROGATE keeps shutting down!

[Woomera]

windows keeps alerting me that comsurrogate is crashed and shut down(dllhost) with these details:

Problem signature:

Problem Event Name: APPCRASH

Application Name: DllHost.exe

Application Version: 6.0.6000.16386

Application Timestamp: 4549b14e

Fault Module Name: StackHash_1703

Fault Module Version: 0.0.0.0

Fault Module Timestamp: 00000000

Exception Code: c0000005

Exception Offset: 00a1b5ed

OS Version: 6.0.6000.2.0.0.256.1

Locale ID: 1033

Additional Information 1: 1703

Additional Information 2: 2264db07e74365624c50317d7b856ae9

Additional Information 3: 1344

Additional Information 4: 875fa2ef9d2bdca96466e8af55d1ae6e

anyone knows the reason?

[cluberti]

Not necessarily, but if you install the User Mode Process Dumper tool and create a rule to monitor dllhost.exe, we can probably analyze the .dmp file that will be created the next time it crashes.

[Woomera]

ok that tool doesnt support windows vista System requierment .but i can run it using command line but it only dump the current status.

did i miss anything?

[cluberti]

Ah, forgot about that. We'll have to use adplus:

First, install the "Debugging Tools for Windows" from:

http://www.microsoft.com/whdc/devtools/deb...ng/default.mspx

Once these tools are installed, do the following:

1. Create a directory called c:\adplus

2. Open a command prompt and change to the directory where you installed the debugging tools. By default, this is "C:\Program Files\Debugging Tools for Windows"

3. Type the following command in the command prompt:

cscript adplus.vbs -crash -pn dllhost.exe -o c:\adplus

This should generate a crash dump of dllhost.exe in C:\adplus that can be analyzed via windbg or cdb the next time you get a crash. If you don't feel comfortable doing it, I can do it if you PM me.

[duceyaj]

i had this error when i had nero installed. the nero codecs interfere with vista making thumbnails for folders that contain videos.

[Spooky]

I had this same problem with nero installed.

[ripken204]

c:\program files\common files\ahead\dsfilter\nevideo.ax

rename that file to

c:\program files\common files\ahead\dsfilter\nevideo1.ax

worked for me

[Woomera]

heh funny after it happened and i posted this topic it never happened again.i wonder what i was doing and what programs were ruuning at that time...

[Spooky]

Maybe it heard that the MSFN crew was on the case and that you had posted here, and it feared what would happen and decided to stop acting up.

Who knows

heh funny after it happened and i posted this topic it never happened again.i wonder what i was doing and what programs were ruuning at that time...

[Woomera]

lol?

its funny though it sometimes say that kaspersky crashed and i click on close the program but its still running.

[cluberti]

@spooky - LOL

[Spooky]

I forgot to post this earlier, so to be complete, this problem can be caused by nero or divx. Look at this link for a fix:

http://forums.microsoft.com/MSDN/ShowPost....80&SiteID=1

[ripken204]

ya, what i posted above was the fix. it happened to me whenever i clicked on an avi file or a folder with an avi file inside of it.

[Woomera]

ok i dumped it during 2 time crashes.ill pm u with the link to file CLUBERTI.

Note:it happened when i tried to watch some mpeg files from a cd that my WMP crashed then i tried copying them to HDD and i was downloading a file from opera and browsing with firefox.

[cluberti]

Well, we've got a real problem - dllhost is crashing, but it's doing a 1st chance exception waiting on a thread that's already terminated (and isn't in the dump). Here's what I was able to cull from the dump.

Here's the active thread in the dump - notice that we're waiting on a critical section in ntdll.dll (an API .dll, so anything could have called this, unfortunately):

ChildEBP RetAddr Args to Child

0362f67c 776206a0 775fb18c 00000208 00000000 ntdll!KiFastSystemCallRet

0362f680 775fb18c 00000208 00000000 00000000 ntdll!NtWaitForSingleObject+0xc

0362f6e4 775fb071 00000000 00000000 00000000 ntdll!RtlpWaitOnCriticalSection+0x154

0362f70c 775faa3d 77685340 0362ce32 7ffd8000 ntdll!RtlEnterCriticalSection+0x152

0362f7a0 775fa954 0362f82c 0362c19a 00000000 ntdll!LdrpInitializeThread+0x71

0362f808 775fa980 0362f82c 775c0000 00000000 ntdll!_LdrpInitialize+0x21d

0362f818 00000000 0362f82c 775c0000 00000000 ntdll!LdrInitializeThunk+0x10

And here's the dump of the actual critical section data that was in the dump - notice that the owning thread is c64, but as I stated before, it's terminated already so I cannot see what the heck it is:

dt ntdll!_RTL_CRITICAL_SECTION 77685340
   +0x000 DebugInfo		: 0x776857a0 _RTL_CRITICAL_SECTION_DEBUG
   +0x004 LockCount		: -10
   +0x008 RecursionCount   : 2
   +0x00c OwningThread	 : 0x00000c64 
   +0x010 LockSemaphore	: 0x00000208 
   +0x014 SpinCount		: 0

dt ntdll!_RTL_CRITICAL_SECTION_DEBUG 776857a0   +0x000 Type			 : 0
   +0x002 CreatorBackTraceIndex : 0
   +0x004 CriticalSection  : 0x77685340 _RTL_CRITICAL_SECTION
   +0x008 ProcessLocksList : _LIST_ENTRY [ 0x77687248 - 0x77685318 ]
   +0x010 EntryCount	   : 0
   +0x014 ContentionCount  : 5
   +0x018 Flags			: 0
   +0x01c CreatorBackTraceIndexHigh : 0
   +0x01e SpareUSHORT	  : 0

   Critical Section is LOCKED, with 1 Waiters

So, it's your typical critsec abandon crash, but the dump isn't entirely of help (it shows the crash, but not the culprit who caused it). Thankfully adplus gathers log data, and I did find that the crashed dllhost was started with the GUID {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}, and the other dllhost was started with the GUID {CD84562B-B3E6-4D39-9E4F-9C1A1FCE4DA7}, neither of which I can find any information about. Perhaps you can search your registry and see what these GUIDs correspond to (especially the first one)? A dllhost.exe process won't be spawned by a Microsoft app, so perhaps the GUID will tell us who spawned the dllhost, and that will likely tell us who owns the component that caused the critical section abandon and crash of dllhost (since you were doing WM stuff I'd say it's a codec, but I can't be entirely certain).