# Svchost.exe has stopped working.



## Rand0Command- (Mar 22, 2013)

Hello, I am new to this website however had a question regarding svchost.exe crashing. I am fixing a friend of mines laptop, ended up having to format and reinstall Vista home basic 32 bit. Its a pretty old toshiba satellite model L305-s5955. I am very tech savy and have never run into a PC problem i couldnt fix be it hardware or software, however i cant stand Manufactured PC's or notebooks due to their "touchyness" when it comes to certain hardware etc. My problem is after doing a fresh install of Windows, and loading the drivers (from the toshiba website) pertaining to this particular model, i encountered svchost.exe stops working and the explorer loses it's aero look. I believe i have narrowed the problem down to the wifi driver, seeing as how after 3 clean re-installs of the OS (due to a BSOD that caused a restart and occured everytime the bios was done booting) the problem only seems to occur after i install the Realtek wifi driver. I have looked at the event log but cannot seem to definitively say this is what is causing the problem. i figure it may be pertinent to also mention one of the logs in the event viewer mentioned ntldr.dll in one of the crashes related to svchost.exe. However this was before i did the clean reinstall and may not have anything to do with it, but i cant say for sure. I have not had a BSOD happen on this third reinstall yet, so i do not have a "dump" of what caused the BSOD, just the log regarding svchost.exe, which happens before said BSOD. Any help would be greatly appreciated because this is very frustrating and ive spent 3 days now rooting around trying to see if maybe the chipset driver, graphics driver, or wifi driver may have been the wrong one or possibly the wrong version or something similar.
Here is the basic info about the laptop i am currently working on.


· OS - Vista
· x86 (32-bit)
· What was original installed OS on system? Vista Home Basic
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer) Full Retail Version activated with key on tag on bottom of laptop
· Age of system (hardware) not entirely sure
· Age of OS installation - have you re-installed the OS? yes three times, latest install was today (march 22 12:00 AM

· CPU- Intel Celeron 900 @2.2GHz
· Video Card- Mobile Intel GL4500M
· MotherBoard- Intel Chipset 4500 Express
· Power Supply - Not sure

· System Manufacturer Toshiba
· Exact model number Satellite L305-s5955 part number PSLB8U-13T038


Here is the even log regarding the crash of said process. 

Log Name: Application
Source: Application Error
Date: 3/22/2013 12:15:34 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Linda-PC
Description:
Faulting application svchost.exe, version 6.0.6001.18000, time stamp 0x47918b89, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000420, fault offset 0x00013ce2, process id 0xad0, application start time 0x01ce26b3ccfeaae3.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-03-22T04:15:34.000Z" />
<EventRecordID>369</EventRecordID>
<Channel>Application</Channel>
<Computer>Linda-PC</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.0.6001.18000</Data>
<Data>47918b89</Data>
<Data>unknown</Data>
<Data>0.0.0.0</Data>
<Data>00000000</Data>
<Data>c0000420</Data>
<Data>00013ce2</Data>
<Data>ad0</Data>
<Data>01ce26b3ccfeaae3</Data>
</EventData>
</Event>

Any other information i will be happy to provide. Any help is surely amazingly appreciated, im close to burning this old POS haha :angry:


----------



## Rand0Command- (Mar 22, 2013)

I wanted to add that i was going through my event log...and noticed again one of the errors, where a faulting module was ntdll.dll...NOT ntldr.dll...i just wanted to clarify that i mentioned the wrong driver


----------



## VirGnarus (Jun 28, 2010)

Well, indeed a service host process is crashing, so we'll have to find what service host process is doing it and then determine what services it is hosting to get an idea. I cannot tell just from this single syslog entry alone, but I can tell it's caused by an assertion failure (c0000420), which is a pretty generic error so that doesn't tell us much. It just means the code (whatever code that is) was expecting one thing, and got another.

Btw, this entry isn't for a BSOD, it's for an application crash. While tripping up certain processes can indeed cause a BSOD, this is just displaying an appcrash, which in itself does not produce a BSOD (it can _trigger_ one, but not actually create one itself). TBH, there's not much to go on this. This svchost crash may be producing your BSODs or may be unrelated, and even if it is responsible for the BSODs, that just means we're dealing with a critical svchost that needs to stay alive for Windows to work, which doesn't narrow things down much. 

Bring us crashdumps, as those are more likely to help us here, or just provide us the whole syslog, as instructed here. At the very least it will provide us better context on the problem.


----------



## Rand0Command- (Mar 22, 2013)

Thank you very much for your reply. I am trying to follow the steps you mentioned, ive created a diagnostics report saved to html, however the file BSOD_Windows7_Vista_v2.64_jcgriff2.exe i cant seem to run. I get the error a device attached to the system is not functioning. Ive never let a problem get this deep before i was able to solve it, but ive followed the steps as far as i could in regards to creating a syslog. Does windows create a crashdump without going to a BSOD? If so where would i find that if it would help you out more, if one is even generated? Or should i setup, and attempt to get a BSOD and provide you with the dump from that?


----------



## VirGnarus (Jun 28, 2010)

The steps to save the syslog are fairly simple, which is to open the event viewer, right click the type of log (e.g. application, system, etc.) that you wanna save, and just select "Save All Events As" and save it as an .evtx file or whatever, then zip and send over. Preferably the App and System logs would be best. 

As for crashdumps, no, it doesn't. There are appcrash dumps that can be produced during an application crash like what svchost.exe is experiencing, provided the system was stable enough to produce the crashdump at the time. They can sometimes show up in the oddest places, however, and may not even be made at all. I reckon doing a search in both Windows and Users directories for .dmp files would suffice. Often if it's an appcrash, the name of the app (in this case svchost) will appear in the filename.


----------



## VirGnarus (Jun 28, 2010)

Oh, and if you wanna help it along with making appcrash dumpfiles, try adding/adjusting the registry value as described here.


----------



## Rand0Command- (Mar 22, 2013)

Awesome again thank you so much, as odd (or not odd) as this may sound i believe i may have solved the problem by turning off Windows Aero! This laptop only has 2Gb of RAM and a 128MB video card, i noticed that when i got the Svchost "crash" the desktop would revert to the non windows aero look with the classic start bar, menu etc. So i figured i would just go ahead and turn it off, did a restart and no svchost crash and i have had it on about 20 mins, when before the svchost process would stop within the first 10 to 15 seconds after windows booting. If the problem persists then I will follow the steps you mentioned, but so far so good! Thank you for your time, I really appreciate all the help you've given me and I surely wont go anywhere else if god forbid I run into another problem ^.^


----------



## VirGnarus (Jun 28, 2010)

Makes me wonder why the assertion failure was popping up, then. Perhaps it was expecting VRAM greater than a certain number and wasn't getting it! Though, I'm concerned that you may have resolved the symptoms, but the underlying issue still remains, like the graphics controller is actually having problems and Aero was just triggering it, or some other more critical situation. No matter, if you're satisfied with these results, then consider it solved.


----------

