"DHCP Client" service crash

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

This is happening randomly on an XP-Embedded system. On startup sometimes the
svchost.exe crashes, and from Dr.Watson debug logs it appears that DHCP
client service is that one that crashes. It takes down other network services
also that are running under the same svchost.exe. What could be causing this
crash..?

---- part of Dr.Watson Log ----

*----> State Dump for Thread Id 0x754 <----*

eax=000ae000 ebx=00000000 ecx=000a0000 edx=00000000 esi=00000001 edi=000ae000
eip=77c47fd4 esp=0072fa54 ebp=0072fa54 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\msvcrt.dll -
function: msvcrt!wcslen
77c47fc7 cc int 3
77c47fc8 cc int 3
77c47fc9 cc int 3
77c47fca cc int 3
77c47fcb cc int 3
msvcrt!wcslen:
77c47fcc 8bff mov edi,edi
77c47fce 55 push ebp
77c47fcf 8bec mov ebp,esp
77c47fd1 8b4508 mov eax,[ebp+0x8]
FAULT ->77c47fd4 668b08 mov cx,[eax]
ds:0023:000ae000=????
77c47fd7 40 inc eax
77c47fd8 40 inc eax
77c47fd9 6685c9 test cx,cx
77c47fdc 75f6 jnz msvcrt!wcslen+0x8 (77c47fd4)
77c47fde 2b4508 sub eax,[ebp+0x8]
77c47fe1 d1f8 sar eax,1
77c47fe3 48 dec eax
77c47fe4 5d pop ebp
77c47fe5 c3 ret
77c47fe6 cc int 3

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
ChildEBP RetAddr Args to Child
0072fa54 76d8dc62 000ae000 000adfe0 00000000 msvcrt!wcslen+0x8
0072fe70 76d96f40 000adfe0 00000000 0072fea4
dhcpcsvc!DhcpOpenGlobalEvent+0x30e7
0072fe90 76d8df4c 000001c0 000a52b8 00000000 dhcpcsvc+0x16f40
0072fec4 76d87119 00000000 00000000 0072ff54
dhcpcsvc!DhcpOpenGlobalEvent+0x33d1
0072fee4 76d979d1 00000057 0072ff00 00000000
dhcpcsvc!DhcpRequestOptions+0x2fa1
0072ff54 76d97a56 000a50a8 00000000 0072ff80 dhcpcsvc+0x179d1
0072ff64 76d8c3b0 000a50a8 00000103 000a4e88 dhcpcsvc+0x17a56
0072ff80 76d8af18 000a4e9c 00000002 00002b12
dhcpcsvc!DhcpOpenGlobalEvent+0x1835
0072ffb4 7c80b50b 00000000 00000018 0000001c
dhcpcsvc!DhcpOpenGlobalEvent+0x39d
0072ffec 00000000 76d8ae19 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4
 
I would check any virus or spyware first.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


PP said:
This is happening randomly on an XP-Embedded system. On startup sometimes
the
svchost.exe crashes, and from Dr.Watson debug logs it appears that DHCP
client service is that one that crashes. It takes down other network
services
also that are running under the same svchost.exe. What could be causing
this
crash..?

---- part of Dr.Watson Log ----

*----> State Dump for Thread Id 0x754 <----*

eax=000ae000 ebx=00000000 ecx=000a0000 edx=00000000 esi=00000001
edi=000ae000
eip=77c47fd4 esp=0072fa54 ebp=0072fa54 iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
C:\WINDOWS\system32\msvcrt.dll -
function: msvcrt!wcslen
77c47fc7 cc int 3
77c47fc8 cc int 3
77c47fc9 cc int 3
77c47fca cc int 3
77c47fcb cc int 3
msvcrt!wcslen:
77c47fcc 8bff mov edi,edi
77c47fce 55 push ebp
77c47fcf 8bec mov ebp,esp
77c47fd1 8b4508 mov eax,[ebp+0x8]
FAULT ->77c47fd4 668b08 mov cx,[eax]
ds:0023:000ae000=????
77c47fd7 40 inc eax
77c47fd8 40 inc eax
77c47fd9 6685c9 test cx,cx
77c47fdc 75f6 jnz msvcrt!wcslen+0x8 (77c47fd4)
77c47fde 2b4508 sub eax,[ebp+0x8]
77c47fe1 d1f8 sar eax,1
77c47fe3 48 dec eax
77c47fe4 5d pop ebp
77c47fe5 c3 ret
77c47fe6 cc int 3

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
ChildEBP RetAddr Args to Child
0072fa54 76d8dc62 000ae000 000adfe0 00000000 msvcrt!wcslen+0x8
0072fe70 76d96f40 000adfe0 00000000 0072fea4
dhcpcsvc!DhcpOpenGlobalEvent+0x30e7
0072fe90 76d8df4c 000001c0 000a52b8 00000000 dhcpcsvc+0x16f40
0072fec4 76d87119 00000000 00000000 0072ff54
dhcpcsvc!DhcpOpenGlobalEvent+0x33d1
0072fee4 76d979d1 00000057 0072ff00 00000000
dhcpcsvc!DhcpRequestOptions+0x2fa1
0072ff54 76d97a56 000a50a8 00000000 0072ff80 dhcpcsvc+0x179d1
0072ff64 76d8c3b0 000a50a8 00000103 000a4e88 dhcpcsvc+0x17a56
0072ff80 76d8af18 000a4e9c 00000002 00002b12
dhcpcsvc!DhcpOpenGlobalEvent+0x1835
0072ffb4 7c80b50b 00000000 00000018 0000001c
dhcpcsvc!DhcpOpenGlobalEvent+0x39d
0072ffec 00000000 76d8ae19 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
Click to expand...
 
The system is clean - no virus / spyware.

To add on - the system is not connected to the internet, and no external
programs are allowed to run on it.

Robert L. (MS-MVP) said:
I would check any virus or spyware first.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


PP said:
This is happening randomly on an XP-Embedded system. On startup sometimes
the
svchost.exe crashes, and from Dr.Watson debug logs it appears that DHCP
client service is that one that crashes. It takes down other network
services
also that are running under the same svchost.exe. What could be causing
this
crash..?

---- part of Dr.Watson Log ----

*----> State Dump for Thread Id 0x754 <----*

eax=000ae000 ebx=00000000 ecx=000a0000 edx=00000000 esi=00000001
edi=000ae000
eip=77c47fd4 esp=0072fa54 ebp=0072fa54 iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
C:\WINDOWS\system32\msvcrt.dll -
function: msvcrt!wcslen
77c47fc7 cc int 3
77c47fc8 cc int 3
77c47fc9 cc int 3
77c47fca cc int 3
77c47fcb cc int 3
msvcrt!wcslen:
77c47fcc 8bff mov edi,edi
77c47fce 55 push ebp
77c47fcf 8bec mov ebp,esp
77c47fd1 8b4508 mov eax,[ebp+0x8]
FAULT ->77c47fd4 668b08 mov cx,[eax]
ds:0023:000ae000=????
77c47fd7 40 inc eax
77c47fd8 40 inc eax
77c47fd9 6685c9 test cx,cx
77c47fdc 75f6 jnz msvcrt!wcslen+0x8 (77c47fd4)
77c47fde 2b4508 sub eax,[ebp+0x8]
77c47fe1 d1f8 sar eax,1
77c47fe3 48 dec eax
77c47fe4 5d pop ebp
77c47fe5 c3 ret
77c47fe6 cc int 3

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
ChildEBP RetAddr Args to Child
0072fa54 76d8dc62 000ae000 000adfe0 00000000 msvcrt!wcslen+0x8
0072fe70 76d96f40 000adfe0 00000000 0072fea4
dhcpcsvc!DhcpOpenGlobalEvent+0x30e7
0072fe90 76d8df4c 000001c0 000a52b8 00000000 dhcpcsvc+0x16f40
0072fec4 76d87119 00000000 00000000 0072ff54
dhcpcsvc!DhcpOpenGlobalEvent+0x33d1
0072fee4 76d979d1 00000057 0072ff00 00000000
dhcpcsvc!DhcpRequestOptions+0x2fa1
0072ff54 76d97a56 000a50a8 00000000 0072ff80 dhcpcsvc+0x179d1
0072ff64 76d8c3b0 000a50a8 00000103 000a4e88 dhcpcsvc+0x17a56
0072ff80 76d8af18 000a4e9c 00000002 00002b12
dhcpcsvc!DhcpOpenGlobalEvent+0x1835
0072ffb4 7c80b50b 00000000 00000018 0000001c
dhcpcsvc!DhcpOpenGlobalEvent+0x39d
0072ffec 00000000 76d8ae19 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
Click to expand...
Click to expand...
 
Any errors in the event viewer?

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


PP said:
The system is clean - no virus / spyware.

To add on - the system is not connected to the internet, and no external
programs are allowed to run on it.

Robert L. (MS-MVP) said:
I would check any virus or spyware first.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


PP said:
This is happening randomly on an XP-Embedded system. On startup
sometimes
the
svchost.exe crashes, and from Dr.Watson debug logs it appears that DHCP
client service is that one that crashes. It takes down other network
services
also that are running under the same svchost.exe. What could be causing
this
crash..?

---- part of Dr.Watson Log ----

*----> State Dump for Thread Id 0x754 <----*

eax=000ae000 ebx=00000000 ecx=000a0000 edx=00000000 esi=00000001
edi=000ae000
eip=77c47fd4 esp=0072fa54 ebp=0072fa54 iopl=0 nv up ei pl nz na
pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
C:\WINDOWS\system32\msvcrt.dll -
function: msvcrt!wcslen
77c47fc7 cc int 3
77c47fc8 cc int 3
77c47fc9 cc int 3
77c47fca cc int 3
77c47fcb cc int 3
msvcrt!wcslen:
77c47fcc 8bff mov edi,edi
77c47fce 55 push ebp
77c47fcf 8bec mov ebp,esp
77c47fd1 8b4508 mov eax,[ebp+0x8]
FAULT ->77c47fd4 668b08 mov cx,[eax]
ds:0023:000ae000=????
77c47fd7 40 inc eax
77c47fd8 40 inc eax
77c47fd9 6685c9 test cx,cx
77c47fdc 75f6 jnz msvcrt!wcslen+0x8 (77c47fd4)
77c47fde 2b4508 sub eax,[ebp+0x8]
77c47fe1 d1f8 sar eax,1
77c47fe3 48 dec eax
77c47fe4 5d pop ebp
77c47fe5 c3 ret
77c47fe6 cc int 3

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may
be
wrong.
ChildEBP RetAddr Args to Child
0072fa54 76d8dc62 000ae000 000adfe0 00000000 msvcrt!wcslen+0x8
0072fe70 76d96f40 000adfe0 00000000 0072fea4
dhcpcsvc!DhcpOpenGlobalEvent+0x30e7
0072fe90 76d8df4c 000001c0 000a52b8 00000000 dhcpcsvc+0x16f40
0072fec4 76d87119 00000000 00000000 0072ff54
dhcpcsvc!DhcpOpenGlobalEvent+0x33d1
0072fee4 76d979d1 00000057 0072ff00 00000000
dhcpcsvc!DhcpRequestOptions+0x2fa1
0072ff54 76d97a56 000a50a8 00000000 0072ff80 dhcpcsvc+0x179d1
0072ff64 76d8c3b0 000a50a8 00000103 000a4e88 dhcpcsvc+0x17a56
0072ff80 76d8af18 000a4e9c 00000002 00002b12
dhcpcsvc!DhcpOpenGlobalEvent+0x1835
0072ffb4 7c80b50b 00000000 00000018 0000001c
dhcpcsvc!DhcpOpenGlobalEvent+0x39d
0072ffec 00000000 76d8ae19 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
Click to expand...
Click to expand...
Click to expand...
 
There are errors reported from the 'Win32Time' service about un-reachable
time-server.

<<application-log>>

information 26 10/13/2007 12:01:47 AM Application Popup svchost.exe
- Application Error The instruction at "0x77c47fd4" referenced memory at
"0x0014c000". The memory could not be "read".

Click on OK to terminate the program

<<system-log>>

error 17 10/13/2007 12:01:50 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)
error 29 10/13/2007 12:01:49 AM W32Time The time
provider NtpClient is configured to acquire time from one or more time
sources, however none of the sources are currently accessible. No attempt to
contact a source will be made for 15 minutes. NtpClient has no source of
accurate time.
error 17 10/13/2007 12:01:49 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)
error 29 10/13/2007 12:01:48 AM W32Time The time
provider NtpClient is configured to acquire time from one or more time
sources, however none of the sources are currently accessible. No attempt to
contact a source will be made for 15 minutes. NtpClient has no source of
accurate time.
error 17 10/13/2007 12:01:48 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)
error 29 10/13/2007 12:01:47 AM W32Time The time
provider NtpClient is configured to acquire time from one or more time
sources, however none of the sources are currently accessible. No attempt to
contact a source will be made for 15 minutes. NtpClient has no source of
accurate time.
error 17 10/13/2007 12:01:47 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)
error 29 10/13/2007 12:01:46 AM W32Time The time
provider NtpClient is configured to acquire time from one or more time
sources, however none of the sources are currently accessible. No attempt to
contact a source will be made for 14 minutes. NtpClient has no source of
accurate time.
error 17 10/13/2007 12:01:46 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)
error 29 10/13/2007 12:01:45 AM W32Time The time
provider NtpClient is configured to acquire time from one or more time
sources, however none of the sources are currently accessible. No attempt to
contact a source will be made for 15 minutes. NtpClient has no source of
accurate time.
error 17 10/13/2007 12:01:45 AM W32Time Time
Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an
unreachable host. (0x80072751)


Robert L. (MS-MVP) said:
Any errors in the event viewer?

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


PP said:
The system is clean - no virus / spyware.

To add on - the system is not connected to the internet, and no external
programs are allowed to run on it.

Robert L. (MS-MVP) said:
I would check any virus or spyware first.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


This is happening randomly on an XP-Embedded system. On startup
sometimes
the
svchost.exe crashes, and from Dr.Watson debug logs it appears that DHCP
client service is that one that crashes. It takes down other network
services
also that are running under the same svchost.exe. What could be causing
this
crash..?

---- part of Dr.Watson Log ----

*----> State Dump for Thread Id 0x754 <----*

eax=000ae000 ebx=00000000 ecx=000a0000 edx=00000000 esi=00000001
edi=000ae000
eip=77c47fd4 esp=0072fa54 ebp=0072fa54 iopl=0 nv up ei pl nz na
pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
C:\WINDOWS\system32\msvcrt.dll -
function: msvcrt!wcslen
77c47fc7 cc int 3
77c47fc8 cc int 3
77c47fc9 cc int 3
77c47fca cc int 3
77c47fcb cc int 3
msvcrt!wcslen:
77c47fcc 8bff mov edi,edi
77c47fce 55 push ebp
77c47fcf 8bec mov ebp,esp
77c47fd1 8b4508 mov eax,[ebp+0x8]
FAULT ->77c47fd4 668b08 mov cx,[eax]
ds:0023:000ae000=????
77c47fd7 40 inc eax
77c47fd8 40 inc eax
77c47fd9 6685c9 test cx,cx
77c47fdc 75f6 jnz msvcrt!wcslen+0x8 (77c47fd4)
77c47fde 2b4508 sub eax,[ebp+0x8]
77c47fe1 d1f8 sar eax,1
77c47fe3 48 dec eax
77c47fe4 5d pop ebp
77c47fe5 c3 ret
77c47fe6 cc int 3

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may
be
wrong.
ChildEBP RetAddr Args to Child
0072fa54 76d8dc62 000ae000 000adfe0 00000000 msvcrt!wcslen+0x8
0072fe70 76d96f40 000adfe0 00000000 0072fea4
dhcpcsvc!DhcpOpenGlobalEvent+0x30e7
0072fe90 76d8df4c 000001c0 000a52b8 00000000 dhcpcsvc+0x16f40
0072fec4 76d87119 00000000 00000000 0072ff54
dhcpcsvc!DhcpOpenGlobalEvent+0x33d1
0072fee4 76d979d1 00000057 0072ff00 00000000
dhcpcsvc!DhcpRequestOptions+0x2fa1
0072ff54 76d97a56 000a50a8 00000000 0072ff80 dhcpcsvc+0x179d1
0072ff64 76d8c3b0 000a50a8 00000103 000a4e88 dhcpcsvc+0x17a56
0072ff80 76d8af18 000a4e9c 00000002 00002b12
dhcpcsvc!DhcpOpenGlobalEvent+0x1835
0072ffb4 7c80b50b 00000000 00000018 0000001c
dhcpcsvc!DhcpOpenGlobalEvent+0x39d
0072ffec 00000000 76d8ae19 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4
Click to expand...
Click to expand...
Click to expand...
 
Back
Top