[Karl89]

Hello GeeksToGo!

I've recently (a week or two ago) bought a new computer which my friend built. I bought the parts separated and he built it. Here are the specs;


The operating system is Windows XP Pro x64 bit Edition


Now today (for the first time ever) as I turned on my PC and logged onto my account (Administrator), I quickly hit my Realtek HD Audio Manager to test the 3D sound of my new speakers. I'm NOT sure this Realtek 3D audio test was the cause of it, and I actually doubt it since the error only appeared a few minutes after I've been testing the audio.

I got this error message;



I selected 'Cancel' (in hopes to debug or something) and the message just disappeared.

I haven't tried restarting or anything to see if it happens again, but I'm still wondering what might have caused it? It's a brand new PC, I don't want it to already start getting trouble.

Thank you in advance,
Karl

[Advertisements]

Go to Start - Control Panel - Administrative Tools - Event Viewer

Go through the three sections, Application, System and Security and see if there are any events logged at the time you recieved the error, if there are, please post them here. If you double click the entry there is a copy button that will allow you to paste so you dont have to type it

[jaxisland]

Go to Start - Control Panel - Administrative Tools - Event Viewer

Go through the three sections, Application, System and Security and see if there are any events logged at the time you recieved the error, if there are, please post them here. If you double click the entry there is a copy button that will allow you to paste so you dont have to type it

[Karl89]

Hello, thanks for the reply.

Here's what I found:

In APPLICATIONS:
Faulting application iw3mp.exe, version 0.0.0.0, faulting module iw3mp.exe, version 0.0.0.0, fault address 0x0027782e.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



Could that be it? The time seems to match.

Edit: Actually, I don't think that's it. Because I think iw3mp.exe is Call of Duty 4 Multiplayer which crashed at about the time this error is reported, so no, that's not the one.

There's no other error reports though. D:

Edited by Karl89, 26 August 2008 - 06:31 PM.

[jaxisland]

Reboot and see if it happens again. If you can recreate the issue on every reboot there is a way we can narrow it down.

If that is the case go to Start
Run
type: msconfig
hit enter
Click the Startup tab

Everything listed there with a check mark on it, is an application or process thats starting when your PC starts. Find something that looks like the realtek stuff and uncheck one at a time. Then reboot. If it still happens, uncheck one more and reboot. Keep repeating until you know which one it is. With it being a new computer Im assuming there is only going to be a few entries. I would start with the Reltek stuff.

[Karl89]

Hello,

I tried what you said.

In the end, I unchecked them all and the error still came upon start up.

However, what I noticed is that there's an application named 'dumprep 0 -u' that has two instances of it with different locations though. One of them I manage to keep unchecked, however the second one keeps showing up checked after a restart even if I uncheck it.

This might be the core of our problem, or do you have any other suggestions?

Here are what the two 'dumprep' applications look like:

One that I manage to keep unchecked: "dumprep 0 -u", "%systemroot%\system32\dumprep 0 -u", "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

One that keeps showing up checked: "dumprep 0 -u", "%systemroot%\system32\dumprep 0 -u", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Awkwardly similar.

Either way, I'll be eagerly awaiting your response.

Thank you in advance,
Karl

Edit!

I've noticed that if I let the windows login screen without inputting my password, the error message will appear either way! Look:

Edited by Karl89, 26 August 2008 - 10:34 PM.

[jaxisland]

Please download CCleaner

Its free and a nice cleanup utility. Open CCleaner and on the left select Tools then click Startup. Find that entry in there, right click and select delete. Reboot and report results.

Thanks.

[Karl89]

Hey jaxisland,

Yesterday, as I was restarting my PC over and over again to find out the source of the problem, a new 'error' appeared. Something about "Generic Host Process for Win32 Services" or something like that. The DEP message kept looping even when I hit the "close message" button. So I googled on how to fix that, and figured out how to turn off DEP. I turned it off, restarted, turned it back on, and the DEP message stopped coming, but the other error (where you hit the "Don't Send" button, for error reports) started appearing on startup. Also, my initial svchost error is gone now and I don't see these files mentioned earlier neither in CCleaner nor in my Startup on msconfig.. so now my new problem is this Windows Generic Host error message.. I tried installing a fix, but the installer wouldn't work on my Windows XP 64 bit, not sure why..

Thank you again.
Karl

[jaxisland]

Is this the KB Article you looked at?

Also did you check the Event Viewer to see if this error is being logged.

[Karl89]

This is indeed the article I looked at.

Also, here's a paste of my Event Viewer, hopefully you can make out something out of it that I didn't notice.

Thank you in advance!
Karl.

[jaxisland]

Can you double click the entries that have red X's in the Application and System log. Please use the copy button on the window that comes up and paste them in a post. They defintiely look related to the issue.

[Karl89]

Faulting application svchost.exe, version 5.2.3790.3959, faulting module unknown, version 0.0.0.0, fault address 0x00516cce.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



The FCI service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



Faulting application svchost.exe, version 5.2.3790.3959, faulting module unknown, version 0.0.0.0, fault address 0x00516cce.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



Timeout (30000 milliseconds) waiting for the FCI service to connect.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



\??\C:\WINDOWS\SysWow64\drivers\glaide32.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



Also, I'm not sure what I just did to trigger it, but the svchost error appeared again and right after it the Generic Host Process for Win32 Services. :/

Also! I've noticed by scrolling lower that Symantec Antivirus seems to have lots of errors:

[jaxisland]

Im not trained here for Malware but both FCI service and glaide.sys are linked to malware infections. At this point I would point you to read This First.

If it turns out that its not malware, save this link and I will stay subscribed to help you further if I can, but Im just starting to think we may want to get the system checked first.

[Karl89]

Alright, thanks a lot! I'll try the link you gave me.

I'll keep you informed. I also suspect it to be malware, despite me having Symantec installed.

Edit: I'm sorry, I really don't want to sound rude, but what exactly from the thread you linked me would you like me to do?

Edited by Karl89, 27 August 2008 - 06:25 PM.

[jaxisland]

The link is a quick read of what happens in Geeks to Go Malware forum. They ask that you read that post, try some of the applications and scans first and if you still have problems to post a HijackThis log and start a thread in the Malware section. Basically its just a Read This First before posting a Hijack log. After you read it and you start a thread in the malware section they will walk you through it. I cannot help you in that section because replying to a poster is restricted to Geeks to Go trained malware personnel.

[Karl89]

Alright!

A big thanks to you jaxisland!