KB934238 - svchost throws a strop and takes it's ball home

My WinXp Pro machine prompted me to install the KB934238 update that
was shipped yesterday. The usual warnings and caveats were glanced at
(you cannot remove this later, it fixes something you probably never
use).

I performed the update, but not immediately. I let it do one of those
"next time you shut down I'm going to run during the shutdown screen"
things.

It got to the page post-update that says "Please don't turn off or
power down your computer" (or something to that effect), and then a
warning dialog appeared saying that the Generic Host Process
svchost.exe has encountered an error and been stopped.

I clicked OK and waited. 2 hours passed whilst I watched a film,
occasionally checking the PC. Still it was on the "Do not shut down"
screen. 2 hours! I figured that the crashed process must be the one
that was supposed to reboot, so I power down and head off to bed.

This morning, the computer boots and I am immediately confronted with
a svchost.exe error, and this time I click the "More info" link on the
debug window that has popped up. The DLL it appears to have crashed on
is msi.dll. So I search the system, see it is a system file that
hasn't changed in ages, and look at Process Explorer instead to try
and see what MSI file the process has a hook to.

It seems that the MSI was in the C:\WINDOWS\Installer directory and
was for Visio 2003. It also hadn't changed in ages.

Now this isn't the problem, that's just all that I figured out from
quick looks. The problem is that the svchost.exe that crashes takes
down a considerable chunk of Windows.

I have lost the ability to click the start bar, to launch programs, to
connect to the internet. If I do these things before the crash then
it's fine, but post crash and I am locked out of my machine. Even
Process Explorer becomes useless, I don't have the ability to start
new processes as the File Open dialog is unavailable and Process
Explorer hangs when I access it.

That's the problem.

Short of formatting the drive and re-installing Windows XP how do I
get my machine back to a usable state?

"DavidK" <> wrote in message
news: oups.com...
> My WinXp Pro machine prompted me to install the KB934238 update that
> was shipped yesterday. The usual warnings and caveats were glanced at
> (you cannot remove this later, it fixes something you probably never
> use).
>
> I performed the update, but not immediately. I let it do one of those
> "next time you shut down I'm going to run during the shutdown screen"
> things.
>
> It got to the page post-update that says "Please don't turn off or
> power down your computer" (or something to that effect), and then a
> warning dialog appeared saying that the Generic Host Process
> svchost.exe has encountered an error and been stopped.
>
> I clicked OK and waited. 2 hours passed whilst I watched a film,
> occasionally checking the PC. Still it was on the "Do not shut down"
> screen. 2 hours! I figured that the crashed process must be the one
> that was supposed to reboot, so I power down and head off to bed.
>
> This morning, the computer boots and I am immediately confronted with
> a svchost.exe error, and this time I click the "More info" link on the
> debug window that has popped up. The DLL it appears to have crashed on
> is msi.dll. So I search the system, see it is a system file that
> hasn't changed in ages, and look at Process Explorer instead to try
> and see what MSI file the process has a hook to.
>
> It seems that the MSI was in the C:\WINDOWS\Installer directory and
> was for Visio 2003. It also hadn't changed in ages.
>
> Now this isn't the problem, that's just all that I figured out from
> quick looks.

> The problem is that the svchost.exe that crashes takes down
> a considerable chunk of Windows.
>
> I have lost the ability to click the start bar, to launch programs, to
> connect to the internet. If I do these things before the crash then
> it's fine, but post crash and I am locked out of my machine. Even
> Process Explorer becomes useless, I don't have the ability to start
> new processes as the File Open dialog is unavailable and Process
> Explorer hangs when I access it.


Sounds like explorer.exe has died?
Instead of trying to use Process Explorer to start new tasks
try using Task Manager. E.g. press Ctrl-Alt-Delete


>
> That's the problem.
>
> Short of formatting the drive and re-installing Windows XP how do I
> get my machine back to a usable state?


Is Process Explorer running when the crash occurs?
You would be able to get more clues from it what had happened.
Even better would be ProcMon. Use Alt-Tab to switch between
tasks or use Task Manager when you don't have Windows Explorer
running.

In either case it might be a good idea to make sure that those tools
have high dispatching priority before the crash, e.g. in order to break through
a run-away task having otherwise equal priority. I.e., beside not having
an explorer.exe task running it sounds as if you have some other task(s) in a loop.

Tip: if you do have a loop you have to be very deliberate, sparing and patient
about any actions you take to try to break out of it. E.g. use specific keystrokes
and *wait* for their responses. Using the mouse or trying to "force" some
action by repetition is more likely to make things worse.


HTH

Robert Aldwinckle
---

I'd open a free Support Incident on this one, David.

Customers in the U.S. and Canada can receive technical support from
Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for
support calls that are associated with security updates.

International customers can receive support from their local Microsoft
subsidiaries. There is no charge for support that is associated with
security updates. For more information about how to contact Microsoft for
support issues, visit the International Support Web site:
https://support.microsoft.com/common/international.aspx
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

DavidK wrote:
> My WinXp Pro machine prompted me to install the KB934238 update that
> was shipped yesterday. The usual warnings and caveats were glanced at
> (you cannot remove this later, it fixes something you probably never
> use).
>
> I performed the update, but not immediately. I let it do one of those
> "next time you shut down I'm going to run during the shutdown screen"
> things.
>
> It got to the page post-update that says "Please don't turn off or
> power down your computer" (or something to that effect), and then a
> warning dialog appeared saying that the Generic Host Process
> svchost.exe has encountered an error and been stopped.
>
> I clicked OK and waited. 2 hours passed whilst I watched a film,
> occasionally checking the PC. Still it was on the "Do not shut down"
> screen. 2 hours! I figured that the crashed process must be the one
> that was supposed to reboot, so I power down and head off to bed.
>
> This morning, the computer boots and I am immediately confronted with
> a svchost.exe error, and this time I click the "More info" link on the
> debug window that has popped up. The DLL it appears to have crashed on
> is msi.dll. So I search the system, see it is a system file that
> hasn't changed in ages, and look at Process Explorer instead to try
> and see what MSI file the process has a hook to.
>
> It seems that the MSI was in the C:\WINDOWS\Installer directory and
> was for Visio 2003. It also hadn't changed in ages.
>
> Now this isn't the problem, that's just all that I figured out from
> quick looks. The problem is that the svchost.exe that crashes takes
> down a considerable chunk of Windows.
>
> I have lost the ability to click the start bar, to launch programs, to
> connect to the internet. If I do these things before the crash then
> it's fine, but post crash and I am locked out of my machine. Even
> Process Explorer becomes useless, I don't have the ability to start
> new processes as the File Open dialog is unavailable and Process
> Explorer hangs when I access it.
>
> That's the problem.
>
> Short of formatting the drive and re-installing Windows XP how do I
> get my machine back to a usable state?

Google Groups is being slow on updating it's cache, but I can see via
the MS site that there has been replies.

This is the detail of the error:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 25/04/2007
Time: 19:17:54
User: N/A
Computer: ODIN
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module msi.dll, version 3.1.4000.2435, fault address 0x00012780.


The solution I've found is this:
1) Turn off automatic upates and reboot before the crash can occur (in
otherwords, as soon as possible when the computer is up).
2) Use Microsoft Update within MSIE to update anything that needs
updating.
3) Turn on automatic updates and reboot.
4) Disco.

It seems that the original crash meant that the update was never
finished cleanly. I'm not sure why running the update in the browser
works and letting it run in the background doesn't. This solution did
work though.

Thanks to those who had suggestions.