Services.exe keeps restarting my comp

Status
Not open for further replies.

clothespinguy

Posts: 14   +0
This is driving me nuts. I'm using my computer for work purposes and can't get anything done because it keeps restarting. I get a little message that says:

"This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" and it gives me a 60 second countdown, then restarts. I know I can delay it with the shutdown -a command but even when I do that it just locks up in 60 seconds and personally I'd rather it just restarts.

I've looked at the dump file (I've got it set to use the large one) but I'm not expert and I honestly can't tell what it's saying...it looks to me like it's a file called netevent.dll that keeps shuttind down and causing the process services.exe to quit.

I've attached the system logs that were flagged as warnings/errors and I've attached the dump file.

Any thoughts? I can't find the culprit...and when I do I don't know what to do to fix it (I heard you're not supposed to replace the netevent.dll). Ugh.

Memory dump:
--------------
Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+fffffffff47d6928
f47d6928 8a1401 mov dl,byte ptr [ecx+eax]

TRAP_FRAME: f26dd558 -- (.trap fffffffff26dd558)
ErrCode = 00000000
eax=00000000 ebx=f47dc94a ecx=0101d000 edx=804e3e5f esi=00001000 edi=0101c000
eip=f47d6928 esp=f26dd5cc ebp=f26dd5d8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f47d6928 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: WindowsXP-KB919

LAST_CONTROL_TRANSFER: from 8052202d to 805371aa

STACK_TEXT:
f26dd120 8052202d 0000008e c0000005 f47d6928 nt!KeBugCheckEx+0x1b
f26dd4e8 804de403 f26dd504 00000000 f26dd558 nt!KiDispatchException+0x3b1
f26dd550 804de3b4 f26dd5d8 f47d6928 badb0d00 nt!CommonDispatchException+0x4d
f26dd560 804e3e5f 0007df20 00000007 0007e1d0 nt!Kei386EoiHelper+0x18a
f26dd590 804e3e5f 0101d000 00000000 ffffffff nt!ZwQueryInformationFile+0x11
f26dd5a8 0101c000 00001000 f47dc94a f26dd5d8 nt!ZwQueryInformationFile+0x11
WARNING: Frame IP not in any known module. Following frames may be wrong.
f26dd6b0 80603978 0000028c 85c9b020 00000001 0x101c000
f26dd62c f47d88e8 85c9b020 01000000 01000218 nt!PspCreateThread+0x3a7
f26dd6b0 80603978 0000028c 85c9b020 00000001 0xf47d88e8
f26dd6b0 80603978 0000028c 85c9b020 00000001 nt!PspCreateThread+0x3a7
f26dd7f4 80584c40 0007d894 001f03ff 00000000 nt!PspCreateThread+0x3a7
f26dd86c 804dd99f 0007d894 001f03ff 00000000 nt!NtCreateThread+0x118
f26dd86c 7c90eb94 0007d894 001f03ff 00000000 nt!KiFastCallEntry+0xfc
0007df10 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiDispatchException+3b1
8052202d cc int 3

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

SYMBOL_NAME: nt!KiDispatchException+3b1

FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

Followup: MachineOwner


***Below are the 3 event logs of significance***

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 9/21/2006
Time: 8:32:25 PM
User: N/A
Computer: BLUE1
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0011D8890AE0. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Data:
0000: 79 00 00 00 y...


Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 9/21/2006
Time: 8:34:27 PM
User: N/A
Computer: BLUE1
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 9/21/2006
Time: 8:37:01 PM
User: N/A
Computer: BLUE1
Description:
The Computer Browser service terminated with the following error:
This operation returned because the timeout period expired.
 
one more thing...

Forgot to mention...

Ran all kinds of utilities from spyware progs to things like mightyPC or whatever and of the dozens of different scans they found nothing. Not even the malicious software removal tool. My comp seems to be clean, I'm thinking the error is some sorta conflict.
 
A few more status codes

With that same error I've gotten 2 other status codes:
-2147483641 and
-1073741819

That's along with the original code 204. Does that help?? Please someone give me some help here cuz microsoft knows nothing about this problem.
 
I am facing the same problem. Can you guys please help me, as my work is getting hampered by the same.

Please...
 
You should at least disable "Server" and "Computer Browser" services, unless you're sure you need them (you won't if you're not sharing files / printers on a local network).

If you're getting the TCP/IP warning about concurrent TCP connect attempts, you should reconfigure your networking applications. Usually this means some sort of p2p application, and they have "advanced" options for limiting the number of (half open) connections per some time interval.
 
p2p?

Thanks for finally posting...believe it or not this problem is STILL not solved. I am getting the TCP connect attempts warning. Not sure what p2p programs I should be looking for...I don't use anything like messengers or NetMeeting or anything. What progs are you talking about?


Mictlantecuhtli said:
If you're getting the TCP/IP warning about concurrent TCP connect attempts, you should reconfigure your networking applications. Usually this means some sort of p2p application, and they have "advanced" options for limiting the number of (half open) connections per some time interval.
 
idle

Not sure if this matters...but I've noticed I don't get the restart countdown when my computer is busy doing things like defragging, uploading to the net, virus scanning, rendering video, or anything like that. But it does tend to restart a lot when I'm surfing the net, working in Word or editing video, listening to MP3's, or just sitting there idle.
Does that tell you anything?
 
Not really, only that it could be related to power management. Do you have Cool'n'Quiet enabled (if you have an AMD64 processor) or something like that? Have you tried updating mainboard chipset drivers?
 
clothespinguy said:
***Below are the 3 event logs of significance***

Event Type: Warning
Event Source: Dhcp
...
Computer: BLUE1
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0011D8890AE0. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Event Type: Warning
Event Source: Tcpip
...Computer: BLUE1
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Type: Error
Event Source: Service Control Manager
...Computer: BLUE1
Description:
The Computer Browser service terminated with the following error:
This operation returned because the timeout period expired.
this looks like failing attempts to access your system forced a stack overflow.

you do have a firewall and it is enabled and properly configured???
 
firewall

I have windows firewall (the one included with XP pro) but actually that was part of the problem I noticed. About a month ago when this all started it wouldn't turn on or even let me see the properties for it. I think that's fixed now (after some knowledgebase tutorials). Also, windows update will not work...the 'windows installer 3.1' won't install and I can't get any updates from the site to work, they all just immediately restart the comp. I'm thinking this is all connected somehow.
 
hijack this logfile

Joe,
OK, attached is the log from hijackthis. Thank you for helping on this!
 

Attachments

  • hijackthis.log
    4.5 KB · Views: 6
clothespinguy: Your HJT log is clean.

kjaggu: your system is infected with a variety of nasties. I have therefore moved your last post to it`s own thread in our security and the web forum and given you some instructions to follow.

Regards Howard :)
 
any other ideas? I'd hate to have to reinstall windows cuz I'm up to my ears in work and it'd set me back pretty far if I had to reinstall all my progs. Ugh.
 
immediate actions:
download these

now:
  1. disconnect from the Internet
  2. Now Install the downloads
    Sypwareblaster to black list man ActiveX components
    Spybot
    AVG
  3. Enable your firewall this *MUST* work
    if it will not come active, run Spybot,Sypwareblaster, & AVG immediately and update later
  4. reconnect to the internet
  5. Update Spybot, Sypwareblaster, & AVG ; run immediately and update at least monthly
  6. Run Microsoft Security Updates (using IE)

Highly recommend
  • Install Firefox and make it your default browser, using IE only for Microsoft updates
  • Disable and stop using all IM services; these are security risks. If these are
    important to you, at least STOP the autostart at boot time,
    use them as necessary and then stop the service when done --
    do not allow them to run unattended
 
internet

OK, new info. I just found out the other day that my computer runs perfectly fine when the internet is disconnected. It was pure dumb luck to find this out because we had a storm that knocked out the net and I noticed nothing happened. Since then I've been working with the cord pulled out and everything is fine.

So this is telling me that you were right about the open ports and all that. I don't have any P2P progs running but here's what I've got on my firewall exceptions list:
Adobe GoLive (yes)
AOL Messenger (yes) <--though its not on my startup list
avgamsvr.exe (yes)
avgcc.exe (yes)
avginet.exe (yes)
Battlefront (yes)
File & Printer Sharing (yes)
Incoming Connection VPN L2TP (no)
Incoming Connection VPN PPTP (no)
IP Security (IPsec -IKE) (no)
iTunes (yes)
DirectPlay8 Server (no)
DirectX Diag. Tool (no)
MS Management Console (yes)
Remote Assistance (yes)
Remote Desktop (no)
UPnP Framework (no)
webgrab32 (no)
Windows Messenger (yes)
WS_FTP 95 (yes)

*all (yes)'s are checked on the exceptions list, (no)'s are not checked.
 
I've been keeping an eye on this for a while since I'm having the same problem, amongst a whole load of others...just want to check, are all your system files intact? I'm missing some which I need to reinstall when the cds arrive, it might be good to know if it's caused by that.
To check go to "Run", then type "sfc /scannow". Obviously you don't have to, but it might help one or both of us... I'm getting a little desperate for ideas. Thanks.
 
I'm out of town right now but I'll check it when I get back. Have you noticed that your computer is fine with the net disconnected? That's the only way I can run my machine normally now.
I think I was missing files before because I had to reinstall windows firewall and right now my windows update doesn't work...if I try to run any sort of microsoft update then my computer immediately reboots without warning. It is definitely a pain.
 
You're having a problem with windows updates too? Mine just bluescreens every time, although I managed to install two new ones recently, which was weird...
I think services.exe is supposed to help the internet services work, so I'm guessing it doesn't do anything when the internets not connected? I'll let you know if installing my windows files changes anything anyway, the cds should be here by thursday if Dell keep their word. Good luck with it whatever happens.
(*Dreamy, idealistic look*) Maybe one day computers will work...
 
Got a friend with this problem

Got a friend who has this problem right now I am doing a malware removal, hijackthis, spysweaper, AVG and MS malware removal tool but after reading this I dont think that is going to help, he has the exact same problem and it does not occure when he is disconected from the net, have any of you tryed http://support.microsoft.com/kb/318447 yet? I dont know if that will work and it is for win 2k.
 
Not_too_happy said:
the cds should be here by thursday if Dell keep their word.


Hah I do tech support for dell, the cds often ariva a day after (depending when you requested them) however there are some brain dead agents there who somehow manage to screw up a dispatch.
 
Fixed!!

YES! My computer is finally fixed and I'm posting the answer I discovered since no one here or anywhere else knew what the problem was. As you know, the symptoms were that my firewall was broke, my windows update stopped working, and my computer would constantly restart with a message saying that "services.exe has stopped responding" and the computer would restart in 60 seconds with a countdown. This problem I noticed didn't happen when the internet was unplugged. Anyway, I scanned for viruses and spyware and thought it was all clean (3 different spyware progs showed a clean scan). But I ran Webroot spyware software it showed 2 traces of something called "atomiclog" which had 4/5 bars showing it was a dangerous system monitor utility. I didn't feel like paying for webroot to fix it, so I did the following steps and now my computer no longer restarts. As far as I know my windows update still doesn't work but at least I can use my comp normally now. Here's how to fix it if you have the same problem: http://www.scanspyware.net/info/AtomicLog.htm
 
Nothing from Dell on the CDs yet, unfortunately. No trace of Atomiclog on my PC that I can find either, glad to hear you've fixed it though! I'll scan again in Safe Mode etc if I get the time.
 
Status
Not open for further replies.
Back