Windows - Application error

Every time I boot up my Vista machine I get the error message:-

The instruction at 0x00366f9d referenced memory at 0x00000f18. The memory
could not be read.

Can you help?

"Phil Adamson" <> wrote...
> Every time I boot up my Vista machine I get the error message:-
> The instruction at 0x00366f9d referenced memory at 0x00000f18. The memory
> could not be read.
> Can you help?


Hi Phil,

This error is known as an "access violation". Nothing to do with security;
rather, some process tried to "access" (ie, read) a memory address which
didn't contain valid data. It can be caused by many different things.

You can get more information about the problem this way:

- go to Control Panel, System and Maintenance
- find Problem Reports and Solutions
- click on the View Problem History link

You should see a list of the errors, with time and date. Right-click the
most recent error and choose "Check for a solution" from the context menu.
If the problem is known to Microsoft and they have a ready solution, it will
be reported in the dialogue box. If you get the answer "No solution found",
double-click on the problem line to open up the problem details. Some fairly
inscrutable technobabble will be shown. Click on the "Copy to clipboard"
link. Then paste the problem details into a reply message to this newsgroup.

Even with the details, there's no guarantee we can suggest a fix - but we'll
have a much better chance, once we have the extra info about the problem.

Did the PC come with Vista pre-installed? Or have you installed Vista
yourself? If so, was it an upgrade from XP?

Regards,
--
Andrew McLaren
amclar (at) optusnet dot com dot au

Unfortunately this problem doesn't appear in the list but it also never
occurred at this logon.

Spooky!

I will update this space if it reoccurs.

Thanks anyway

"Andrew McLaren" wrote:

> "Phil Adamson" <> wrote...
> > Every time I boot up my Vista machine I get the error message:-
> > The instruction at 0x00366f9d referenced memory at 0x00000f18. The memory
> > could not be read.
> > Can you help?
>
>
> Hi Phil,
>
> This error is known as an "access violation". Nothing to do with security;
> rather, some process tried to "access" (ie, read) a memory address which
> didn't contain valid data. It can be caused by many different things.
>
> You can get more information about the problem this way:
>
> - go to Control Panel, System and Maintenance
> - find Problem Reports and Solutions
> - click on the View Problem History link
>
> You should see a list of the errors, with time and date. Right-click the
> most recent error and choose "Check for a solution" from the context menu.
> If the problem is known to Microsoft and they have a ready solution, it will
> be reported in the dialogue box. If you get the answer "No solution found",
> double-click on the problem line to open up the problem details. Some fairly
> inscrutable technobabble will be shown. Click on the "Copy to clipboard"
> link. Then paste the problem details into a reply message to this newsgroup.
>
> Even with the details, there's no guarantee we can suggest a fix - but we'll
> have a much better chance, once we have the extra info about the problem.
>
> Did the PC come with Vista pre-installed? Or have you installed Vista
> yourself? If so, was it an upgrade from XP?
>
> Regards,
> --
> Andrew McLaren
> amclar (at) optusnet dot com dot au
>
>

"Phil Adamson" <> wrote ...
> Unfortunately this problem doesn't appear in the list but it also never
> occurred at this logon.

Hi Phil,

Hmm, that's interesting in itself - suggests to me the error is appearing
before you log in. Therefore the error record it not attached to a "current
user" and doesn't appear in Control Panel.

In this case, there may be a problem record in the Event Log. This Event Log
is actually the older and more fundamental error tracking mechanism in NT -
the Control Panel "Problems nd Solutions" is just a bit of eay-to-use
flummery they put on top, as a convenience for end users.

Go to Control Panel, Classic View, Administrative Tools, Event Viewer. The
Event Viewer MMC snapin should appear.

Expand "Windows Logs" in te left-hand pane.

Right-click the "System Log" and choose "Filter Current log" from the
context menu.

Under Log Level, check Critical, Error, and Warning. Then hit okay.

You're now lookingat a record of all the problems and warning generated by
Windows. There may be hundreds, even on a "healthy" machine! You're looking
for one with a Source of "Application Error" or "Application popup".
Double-click the log entry to see the details.

If you don't find anything in System Log, try looking in the Application log
as well - use the same procedure to filter the log entries.

Let us know if you find anything.

(if you *don't* find anything, it's not necessarily theend of the line. But
it will make it much harder to diagnose the problem remotely, via a
newsgroup)

Cheers,
--
Andrew McLaren
amclar (at) optusnet dot com dot au

First one I came to is:-

Faulting application DrvInst.exe, version 6.0.6000.16386, time stamp
0x4549ad51, faulting module ntdll.dll, version 6.0.6000.16386, time stamp
0x4549bdc9, exception code 0xc0000374, fault offset 0x000af1c9, process id
0x158c, application start time 0x01c7cc85828a1e8a.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-07-22T17:27:33.000Z" />
<EventRecordID>15354</EventRecordID>
<Channel>Application</Channel>
<Computer>FamilyComp</Computer>
<Security />
</System>
- <EventData>
<Data>DrvInst.exe</Data>
<Data>6.0.6000.16386</Data>
<Data>4549ad51</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6000.16386</Data>
<Data>4549bdc9</Data>
<Data>c0000374</Data>
<Data>000af1c9</Data>
<Data>158c</Data>
<Data>01c7cc85828a1e8a</Data>
</EventData>
</Event>

"Andrew McLaren" wrote:

> "Phil Adamson" <> wrote ...
> > Unfortunately this problem doesn't appear in the list but it also never
> > occurred at this logon.
>
> Hi Phil,
>
> Hmm, that's interesting in itself - suggests to me the error is appearing
> before you log in. Therefore the error record it not attached to a "current
> user" and doesn't appear in Control Panel.
>
> In this case, there may be a problem record in the Event Log. This Event Log
> is actually the older and more fundamental error tracking mechanism in NT -
> the Control Panel "Problems nd Solutions" is just a bit of eay-to-use
> flummery they put on top, as a convenience for end users.
>
> Go to Control Panel, Classic View, Administrative Tools, Event Viewer. The
> Event Viewer MMC snapin should appear.
>
> Expand "Windows Logs" in te left-hand pane.
>
> Right-click the "System Log" and choose "Filter Current log" from the
> context menu.
>
> Under Log Level, check Critical, Error, and Warning. Then hit okay.
>
> You're now lookingat a record of all the problems and warning generated by
> Windows. There may be hundreds, even on a "healthy" machine! You're looking
> for one with a Source of "Application Error" or "Application popup".
> Double-click the log entry to see the details.
>
> If you don't find anything in System Log, try looking in the Application log
> as well - use the same procedure to filter the log entries.
>
> Let us know if you find anything.
>
> (if you *don't* find anything, it's not necessarily theend of the line. But
> it will make it much harder to diagnose the problem remotely, via a
> newsgroup)
>
> Cheers,
> --
> Andrew McLaren
> amclar (at) optusnet dot com dot au
>
>

"Phil Adamson" <> wrote ...
> First one I came to is:-
>
> Faulting application DrvInst.exe, version 6.0.6000.16386, time stamp
> 0x4549ad51, faulting module ntdll.dll, version 6.0.6000.16386, time stamp
> 0x4549bdc9, exception code 0xc0000374, fault offset 0x000af1c9, process id
> 0x158c, application start time 0x01c7cc85828a1e8a.

That's a plausible candidate. A "0xC0000374" exception means
STATUS_HEAP_CORRUPTION. A "heap" is a structure which exists temporarily in
memory while a program runs. Every program has one or more heaps. If a heap
gets damaged while the program is running, the program will often crash.
Heap corruption can be caused either by an internal programming error, or by
some external factor like bad data which is input to the program.

DrvInst.exe is a Microsoft-supplied component of Windows; as the name
suggests, it installs device drivers. Likewise, ntdll.dll is part of the
very heart of Windows, which provied an access point for processes out there
in user-space (like DrvInst) to communicate with the Windows kernel. These
are both extremely heavily exercised bits of code; if there was a
programming error which could cause heap corruption, we should be seeing
hundreds, thousands or millions of reports of it every day. But so far,
0xC0000374 in DrvInst seems to be pretty rare (although not unique). So
axiomatically, it's being caused by some faulty data somehwere - maybe a bad
driver *.INF file or the like.

I guess teh main question is: does this event No. 15354 occur every time you
boot the machine? Or was it a once-off event? If it was a one-off, we ca
probably ignore it. If it happens every time you boot, it's probably related
to the error message you see - the "The instruction at 0x00366f9d referenced
memory at 0x00000f18. The memory could not be read."

O'course going to the next step, and identifying the data data which is
upsetting DrvInst could be tricky ... but, we'll cross that when we come to
it.
--
Andrew McLaren
amclar (at) optusnet dot com dot au

In answer to an earlier question, I upgraded to Vista from XP Home.

"Andrew McLaren" wrote:

> "Phil Adamson" <> wrote ...
> > First one I came to is:-
> >
> > Faulting application DrvInst.exe, version 6.0.6000.16386, time stamp
> > 0x4549ad51, faulting module ntdll.dll, version 6.0.6000.16386, time stamp
> > 0x4549bdc9, exception code 0xc0000374, fault offset 0x000af1c9, process id
> > 0x158c, application start time 0x01c7cc85828a1e8a.
>
> That's a plausible candidate. A "0xC0000374" exception means
> STATUS_HEAP_CORRUPTION. A "heap" is a structure which exists temporarily in
> memory while a program runs. Every program has one or more heaps. If a heap
> gets damaged while the program is running, the program will often crash.
> Heap corruption can be caused either by an internal programming error, or by
> some external factor like bad data which is input to the program.
>
> DrvInst.exe is a Microsoft-supplied component of Windows; as the name
> suggests, it installs device drivers. Likewise, ntdll.dll is part of the
> very heart of Windows, which provied an access point for processes out there
> in user-space (like DrvInst) to communicate with the Windows kernel. These
> are both extremely heavily exercised bits of code; if there was a
> programming error which could cause heap corruption, we should be seeing
> hundreds, thousands or millions of reports of it every day. But so far,
> 0xC0000374 in DrvInst seems to be pretty rare (although not unique). So
> axiomatically, it's being caused by some faulty data somehwere - maybe a bad
> driver *.INF file or the like.
>
> I guess teh main question is: does this event No. 15354 occur every time you
> boot the machine? Or was it a once-off event? If it was a one-off, we ca
> probably ignore it. If it happens every time you boot, it's probably related
> to the error message you see - the "The instruction at 0x00366f9d referenced
> memory at 0x00000f18. The memory could not be read."
>
> O'course going to the next step, and identifying the data data which is
> upsetting DrvInst could be tricky ... but, we'll cross that when we come to
> it.
> --
> Andrew McLaren
> amclar (at) optusnet dot com dot au
>
>
>