TechSpot

Services.exe keeps restarting my comp

By clothespinguy
Sep 21, 2006
Topic Status:
Not open for further replies.
  1. This is driving me nuts. I'm using my computer for work purposes and can't get anything done because it keeps restarting. I get a little message that says:

    "This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" and it gives me a 60 second countdown, then restarts. I know I can delay it with the shutdown -a command but even when I do that it just locks up in 60 seconds and personally I'd rather it just restarts.

    I've looked at the dump file (I've got it set to use the large one) but I'm not expert and I honestly can't tell what it's saying...it looks to me like it's a file called netevent.dll that keeps shuttind down and causing the process services.exe to quit.

    I've attached the system logs that were flagged as warnings/errors and I've attached the dump file.

    Any thoughts? I can't find the culprit...and when I do I don't know what to do to fix it (I heard you're not supposed to replace the netevent.dll). Ugh.

    Memory dump:
    --------------
    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    +fffffffff47d6928
    f47d6928 8a1401 mov dl,byte ptr [ecx+eax]

    TRAP_FRAME: f26dd558 -- (.trap fffffffff26dd558)
    ErrCode = 00000000
    eax=00000000 ebx=f47dc94a ecx=0101d000 edx=804e3e5f esi=00001000 edi=0101c000
    eip=f47d6928 esp=f26dd5cc ebp=f26dd5d8 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    f47d6928 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
    Resetting default scope

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: WindowsXP-KB919

    LAST_CONTROL_TRANSFER: from 8052202d to 805371aa

    STACK_TEXT:
    f26dd120 8052202d 0000008e c0000005 f47d6928 nt!KeBugCheckEx+0x1b
    f26dd4e8 804de403 f26dd504 00000000 f26dd558 nt!KiDispatchException+0x3b1
    f26dd550 804de3b4 f26dd5d8 f47d6928 badb0d00 nt!CommonDispatchException+0x4d
    f26dd560 804e3e5f 0007df20 00000007 0007e1d0 nt!Kei386EoiHelper+0x18a
    f26dd590 804e3e5f 0101d000 00000000 ffffffff nt!ZwQueryInformationFile+0x11
    f26dd5a8 0101c000 00001000 f47dc94a f26dd5d8 nt!ZwQueryInformationFile+0x11
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f26dd6b0 80603978 0000028c 85c9b020 00000001 0x101c000
    f26dd62c f47d88e8 85c9b020 01000000 01000218 nt!PspCreateThread+0x3a7
    f26dd6b0 80603978 0000028c 85c9b020 00000001 0xf47d88e8
    f26dd6b0 80603978 0000028c 85c9b020 00000001 nt!PspCreateThread+0x3a7
    f26dd7f4 80584c40 0007d894 001f03ff 00000000 nt!PspCreateThread+0x3a7
    f26dd86c 804dd99f 0007d894 001f03ff 00000000 nt!NtCreateThread+0x118
    f26dd86c 7c90eb94 0007d894 001f03ff 00000000 nt!KiFastCallEntry+0xfc
    0007df10 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiDispatchException+3b1
    8052202d cc int 3

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

    SYMBOL_NAME: nt!KiDispatchException+3b1

    FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

    BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

    Followup: MachineOwner


    ***Below are the 3 event logs of significance***

    Event Type: Warning
    Event Source: Dhcp
    Event Category: None
    Event ID: 1003
    Date: 9/21/2006
    Time: 8:32:25 PM
    User: N/A
    Computer: BLUE1
    Description:
    Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0011D8890AE0. The following error occurred:
    The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

    Data:
    0000: 79 00 00 00 y...


    Event Type: Warning
    Event Source: Tcpip
    Event Category: None
    Event ID: 4226
    Date: 9/21/2006
    Time: 8:34:27 PM
    User: N/A
    Computer: BLUE1
    Description:
    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

    Data:
    0000: 00 00 00 00 01 00 54 00 ......T.
    0008: 00 00 00 00 82 10 00 80 ....?..?
    0010: 01 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........


    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7023
    Date: 9/21/2006
    Time: 8:37:01 PM
    User: N/A
    Computer: BLUE1
    Description:
    The Computer Browser service terminated with the following error:
    This operation returned because the timeout period expired.
     
  2. clothespinguy

    clothespinguy TS Rookie Topic Starter

    one more thing...

    Forgot to mention...

    Ran all kinds of utilities from spyware progs to things like mightyPC or whatever and of the dozens of different scans they found nothing. Not even the malicious software removal tool. My comp seems to be clean, I'm thinking the error is some sorta conflict.
     
  3. clothespinguy

    clothespinguy TS Rookie Topic Starter

    A few more status codes

    With that same error I've gotten 2 other status codes:
    -2147483641 and
    -1073741819

    That's along with the original code 204. Does that help?? Please someone give me some help here cuz microsoft knows nothing about this problem.
     
  4. kjaggu

    kjaggu TS Rookie

    I am facing the same problem. Can you guys please help me, as my work is getting hampered by the same.

    Please...
     
  5. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,916   +9

    You should at least disable "Server" and "Computer Browser" services, unless you're sure you need them (you won't if you're not sharing files / printers on a local network).

    If you're getting the TCP/IP warning about concurrent TCP connect attempts, you should reconfigure your networking applications. Usually this means some sort of p2p application, and they have "advanced" options for limiting the number of (half open) connections per some time interval.
     
  6. clothespinguy

    clothespinguy TS Rookie Topic Starter

    p2p?

    Thanks for finally posting...believe it or not this problem is STILL not solved. I am getting the TCP connect attempts warning. Not sure what p2p programs I should be looking for...I don't use anything like messengers or NetMeeting or anything. What progs are you talking about?


     
  7. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,916   +9

    BitTorrent clients, KaZaA, LimeWire, eDonkey, that kind of.
     
  8. clothespinguy

    clothespinguy TS Rookie Topic Starter

    idle

    Not sure if this matters...but I've noticed I don't get the restart countdown when my computer is busy doing things like defragging, uploading to the net, virus scanning, rendering video, or anything like that. But it does tend to restart a lot when I'm surfing the net, working in Word or editing video, listening to MP3's, or just sitting there idle.
    Does that tell you anything?
     
  9. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,916   +9

    Not really, only that it could be related to power management. Do you have Cool'n'Quiet enabled (if you have an AMD64 processor) or something like that? Have you tried updating mainboard chipset drivers?
     
  10. jobeard

    jobeard TS Ambassador Posts: 13,426   +317

    this looks like failing attempts to access your system forced a stack overflow.

    you do have a firewall and it is enabled and properly configured???
     
  11. clothespinguy

    clothespinguy TS Rookie Topic Starter

    firewall

    I have windows firewall (the one included with XP pro) but actually that was part of the problem I noticed. About a month ago when this all started it wouldn't turn on or even let me see the properties for it. I think that's fixed now (after some knowledgebase tutorials). Also, windows update will not work...the 'windows installer 3.1' won't install and I can't get any updates from the site to work, they all just immediately restart the comp. I'm thinking this is all connected somehow.
     
     
  12. jobeard

    jobeard TS Ambassador Posts: 13,426   +317

  13. clothespinguy

    clothespinguy TS Rookie Topic Starter

    hijack this logfile

    Joe,
    OK, attached is the log from hijackthis. Thank you for helping on this!
     

    Attached Files:

  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    clothespinguy: Your HJT log is clean.

    kjaggu: your system is infected with a variety of nasties. I have therefore moved your last post to it`s own thread in our security and the web forum and given you some instructions to follow.

    Regards Howard :)
     
  15. clothespinguy

    clothespinguy TS Rookie Topic Starter

    any other ideas? I'd hate to have to reinstall windows cuz I'm up to my ears in work and it'd set me back pretty far if I had to reinstall all my progs. Ugh.
     
  16. jobeard

    jobeard TS Ambassador Posts: 13,426   +317

    immediate actions:
    download these

    now:
    1. disconnect from the Internet
    2. Now Install the downloads
      Sypwareblaster to black list man ActiveX components
      Spybot
      AVG
    3. Enable your firewall this *MUST* work
      if it will not come active, run Spybot,Sypwareblaster, & AVG immediately and update later
    4. reconnect to the internet
    5. Update Spybot, Sypwareblaster, & AVG ; run immediately and update at least monthly
    6. Run Microsoft Security Updates (using IE)

    Highly recommend
    • Install Firefox and make it your default browser, using IE only for Microsoft updates
    • Disable and stop using all IM services; these are security risks. If these are
      important to you, at least STOP the autostart at boot time,
      use them as necessary and then stop the service when done --
      do not allow them to run unattended
     
  17. clothespinguy

    clothespinguy TS Rookie Topic Starter

    internet

    OK, new info. I just found out the other day that my computer runs perfectly fine when the internet is disconnected. It was pure dumb luck to find this out because we had a storm that knocked out the net and I noticed nothing happened. Since then I've been working with the cord pulled out and everything is fine.

    So this is telling me that you were right about the open ports and all that. I don't have any P2P progs running but here's what I've got on my firewall exceptions list:
    Adobe GoLive (yes)
    AOL Messenger (yes) <--though its not on my startup list
    avgamsvr.exe (yes)
    avgcc.exe (yes)
    avginet.exe (yes)
    Battlefront (yes)
    File & Printer Sharing (yes)
    Incoming Connection VPN L2TP (no)
    Incoming Connection VPN PPTP (no)
    IP Security (IPsec -IKE) (no)
    iTunes (yes)
    DirectPlay8 Server (no)
    DirectX Diag. Tool (no)
    MS Management Console (yes)
    Remote Assistance (yes)
    Remote Desktop (no)
    UPnP Framework (no)
    webgrab32 (no)
    Windows Messenger (yes)
    WS_FTP 95 (yes)

    *all (yes)'s are checked on the exceptions list, (no)'s are not checked.
     
  18. Not_too_happy

    Not_too_happy TS Rookie

    EDIT: Posted twice, oops.
     
  19. Not_too_happy

    Not_too_happy TS Rookie

    I've been keeping an eye on this for a while since I'm having the same problem, amongst a whole load of others...just want to check, are all your system files intact? I'm missing some which I need to reinstall when the cds arrive, it might be good to know if it's caused by that.
    To check go to "Run", then type "sfc /scannow". Obviously you don't have to, but it might help one or both of us... I'm getting a little desperate for ideas. Thanks.
     
  20. clothespinguy

    clothespinguy TS Rookie Topic Starter

    I'm out of town right now but I'll check it when I get back. Have you noticed that your computer is fine with the net disconnected? That's the only way I can run my machine normally now.
    I think I was missing files before because I had to reinstall windows firewall and right now my windows update doesn't work...if I try to run any sort of microsoft update then my computer immediately reboots without warning. It is definitely a pain.
     
  21. Not_too_happy

    Not_too_happy TS Rookie

    You're having a problem with windows updates too? Mine just bluescreens every time, although I managed to install two new ones recently, which was weird...
    I think services.exe is supposed to help the internet services work, so I'm guessing it doesn't do anything when the internets not connected? I'll let you know if installing my windows files changes anything anyway, the cds should be here by thursday if Dell keep their word. Good luck with it whatever happens.
    (*Dreamy, idealistic look*) Maybe one day computers will work...
     
  22. marlon_amersi

    marlon_amersi TS Rookie

    Got a friend with this problem

    Got a friend who has this problem right now I am doing a malware removal, hijackthis, spysweaper, AVG and MS malware removal tool but after reading this I dont think that is going to help, he has the exact same problem and it does not occure when he is disconected from the net, have any of you tryed http://support.microsoft.com/kb/318447 yet? I dont know if that will work and it is for win 2k.
     
  23. marlon_amersi

    marlon_amersi TS Rookie


    Hah I do tech support for dell, the cds often ariva a day after (depending when you requested them) however there are some brain dead agents there who somehow manage to screw up a dispatch.
     
  24. clothespinguy

    clothespinguy TS Rookie Topic Starter

    Fixed!!

    YES! My computer is finally fixed and I'm posting the answer I discovered since no one here or anywhere else knew what the problem was. As you know, the symptoms were that my firewall was broke, my windows update stopped working, and my computer would constantly restart with a message saying that "services.exe has stopped responding" and the computer would restart in 60 seconds with a countdown. This problem I noticed didn't happen when the internet was unplugged. Anyway, I scanned for viruses and spyware and thought it was all clean (3 different spyware progs showed a clean scan). But I ran Webroot spyware software it showed 2 traces of something called "atomiclog" which had 4/5 bars showing it was a dangerous system monitor utility. I didn't feel like paying for webroot to fix it, so I did the following steps and now my computer no longer restarts. As far as I know my windows update still doesn't work but at least I can use my comp normally now. Here's how to fix it if you have the same problem: http://www.scanspyware.net/info/AtomicLog.htm
     
  25. Not_too_happy

    Not_too_happy TS Rookie

    Nothing from Dell on the CDs yet, unfortunately. No trace of Atomiclog on my PC that I can find either, glad to hear you've fixed it though! I'll scan again in Safe Mode etc if I get the time.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.