Fixed: Lansweeper Service Crashing SVCHOST

[_JasonB_]

I have the most current release of LANSweeper running on my Windows Server 2008 R2 server. Periodically svchost.exe crashes resulting in an eventual reboot of the LANSweeper server.

I've read the following threads

http://www.lansweeper.com/forum/yaf_postst2896p2_2008-R2-Lansweeper-Service.aspx

http://www.lansweeper.com/forum/yaf_postsm17158_RPC-Error-shutting-down-server.aspx

But have not taken any action at this point because I didn't see any confirmation that the suggested hotfixes corrected the issue.

Additionally, I have installed SP1 with the hope that it would stabilize the system but it has not.

[Hemoco]

If you are affected by this problem:

1) install the latest service pack of the operating system.
2) install http://support.microsoft.com/kb/2401588

[Hemoco]

Please contact us by e-mail for this problem

[_JasonB_]

I think that hotfix must be part of SP1. I downloaded it and tried to apply it however the install program said that the "update is not applicable to your computer".

System has rebooted twice so far today.

[Hemoco]

Did you try http://support.microsoft.com/kb/982293
It looks like this one is not in SP1

[_JasonB_]

Ok, upgraded to the latest version yesterday. Server has rebooted 3 times today so the problem is still there. Any suggestions?

[_JasonB_]

OK, so maybe I'm not running the newest version of the service:(...I'm actually running 4.1.0.12. Is updating the service just a matter of downloading the latest version, stopping the existing service, replacing the file, then restarting the service?

There really isn't anything definitive in the event logs that I can find. However, I do see a appcrash log located at C:\ProgramData\Microsoft\Windows\WER\ReportQueue each time the system reboots. I don't think there is much that will be useful in that log file but I have listed it below


Version=1
EventType=APPCRASH
EventTime=129432055934668750
ReportType=2
Consent=1
ReportIdentifier=222e349b-41b8-11e0-97da-005056930068
IntegratorReportIdentifier=222e349a-41b8-11e0-97da-005056930068
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=svchost.exe
Sig[1].Name=Application Version
Sig[1].Value=6.1.7600.16385
Sig[2].Name=Application Timestamp
Sig[2].Value=4a5bc3c1
Sig[3].Name=Fault Module Name
Sig[3].Value=termsrv.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.1.7601.17514
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4ce7c9e8
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=000000000000b3d7
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.272.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=fcb8
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=fcb8c40acfc28ea0e3cdb0bb09bac676
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=43f7
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=43f7640a65502c4751abe6776e250fca
UI[2]=C:\Windows\System32\svchost.exe
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=Host Process for Windows Services stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\Windows\System32\svchost.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\system32\kernel32.dll
LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\system32\msvcrt.dll
LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[6]=C:\Windows\system32\RPCRT4.dll
LoadedModule[7]=C:\Windows\system32\ole32.dll
LoadedModule[8]=C:\Windows\system32\GDI32.dll
LoadedModule[9]=C:\Windows\system32\USER32.dll
LoadedModule[10]=C:\Windows\system32\LPK.dll
LoadedModule[11]=C:\Windows\system32\USP10.dll
LoadedModule[12]=C:\Windows\system32\IMM32.DLL
LoadedModule[13]=C:\Windows\system32\MSCTF.dll
LoadedModule[14]=C:\Windows\System32\CRYPTBASE.dll
LoadedModule[15]=C:\Windows\system32\ADVAPI32.dll
LoadedModule[16]=c:\windows\system32\termsrv.dll
LoadedModule[17]=c:\windows\system32\ICAAPI.dll
LoadedModule[18]=C:\Windows\system32\WS2_32.dll
LoadedModule[19]=C:\Windows\system32\NSI.dll
LoadedModule[20]=C:\Windows\system32\CLBCatQ.DLL
LoadedModule[21]=C:\Windows\system32\OLEAUT32.dll
LoadedModule[22]=C:\Windows\System32\CRYPTSP.dll
LoadedModule[23]=C:\Windows\system32\rsaenh.dll
LoadedModule[24]=C:\Windows\System32\RpcRtRemote.dll
LoadedModule[25]=C:\Windows\system32\lsmproxy.dll
LoadedModule[26]=C:\Windows\System32\slc.dll
LoadedModule[27]=C:\Windows\System32\REGAPI.dll
LoadedModule[28]=C:\Windows\System32\secur32.dll
LoadedModule[29]=C:\Windows\System32\SSPICLI.DLL
LoadedModule[30]=C:\Windows\System32\credssp.dll
LoadedModule[31]=C:\Windows\system32\rdpcorekmts.dll
LoadedModule[32]=C:\Windows\system32\IPHLPAPI.DLL
LoadedModule[33]=C:\Windows\system32\WINNSI.DLL
LoadedModule[34]=C:\Windows\system32\CRYPT32.dll
LoadedModule[35]=C:\Windows\system32\MSASN1.dll
LoadedModule[36]=C:\Windows\System32\rdpwsx.DLL
LoadedModule[37]=C:\Windows\System32\tlscsp.dll
LoadedModule[38]=C:\Windows\System32\ntmarta.dll
LoadedModule[39]=C:\Windows\system32\WLDAP32.dll
LoadedModule[40]=C:\Windows\System32\dhcpcsvc6.DLL
LoadedModule[41]=C:\Windows\System32\dhcpcsvc.DLL
LoadedModule[42]=C:\Windows\system32\mswsock.dll
LoadedModule[43]=C:\Windows\System32\wshtcpip.dll
LoadedModule[44]=C:\Windows\System32\logoncli.dll
LoadedModule[45]=C:\Windows\System32\netutils.dll
LoadedModule[46]=C:\Windows\System32\SAMLIB.dll
LoadedModule[47]=C:\Windows\System32\SXS.DLL
LoadedModule[48]=C:\Windows\System32\USERENV.dll
LoadedModule[49]=C:\Windows\System32\profapi.dll
LoadedModule[50]=C:\Windows\system32\apphelp.dll
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Host Process for Windows Services
AppPath=C:\Windows\System32\svchost.exe

[Hemoco]

_JasonB_ wrote:
OK, so maybe I'm not running the newest version of the service:(...I'm actually running 4.1.0.12. Is updating the service just a matter of downloading the latest version, stopping the existing service, replacing the file, then restarting the service?

You can download the setup.exe from the download page and it will detect the upgrade.

[Hemoco]

PS: also take a look at this one:
http://support.microsoft.com/kb/982293

[Hemoco]

Can you post the exact error from the eventviewer please.
Which version of lansweeperservice.exe are you running? (4.1.0.14?)