D
dbell
Flightless Bird
OS: XP Pro, Ver 2002, SP 2
PC: HP dx5150 SFF
CPU: AMD Athlon 64 X2 Dual Core 4400+
1 GB RAM, 135 GB HDD
Running out of HDD space, and discovered >70 GB(!!) of User Dump files.
After clearing out, defragging, and page and registry defrag, I am still getting multiple dumps in bursts every couple hours. I grabbed copies of several dump log events, in hopes someone can help me figure out what's happening and how to fix it!
Thanks, Dave
In Event Logs, System, I get groups of the the following three logs:
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 3/14/2010
Time: 2:16:55 PM
User: NT AUTHORITY\SYSTEM
Computer: DAVE64
Description:
The Windows Image Acquisition (WIA) service was successfully sent a start control.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 3/14/2010
Time: 2:17:15 PM
User: N/A
Computer: DAVE64
Description:
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 22 time(s).
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 3/14/2010
Time: 2:17:25 PM
User: DAVE64\Dave
Computer: DAVE64
Description:
The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with DCOM within the required timeout.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
... and repeat, several times over 10-20 minutes.
Apparently culmionates in a svhost.exe User Dump, according to the time in the logs.
This puts an Event in the Application log tree:
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/14/2010
Time: 2:17:14 PM
User: N/A
Computer: DAVE64
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module unknown, version 0.0.0.0, fault address 0x00cf06d1.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 63 66 set 00cf
0050: 30 36 64 31 06d1
Also, an occasional System Information Event:
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 3/14/2010
Time: 5:21:26 PM
User: N/A
Computer: DAVE64
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
PC: HP dx5150 SFF
CPU: AMD Athlon 64 X2 Dual Core 4400+
1 GB RAM, 135 GB HDD
Running out of HDD space, and discovered >70 GB(!!) of User Dump files.
After clearing out, defragging, and page and registry defrag, I am still getting multiple dumps in bursts every couple hours. I grabbed copies of several dump log events, in hopes someone can help me figure out what's happening and how to fix it!
Thanks, Dave
In Event Logs, System, I get groups of the the following three logs:
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 3/14/2010
Time: 2:16:55 PM
User: NT AUTHORITY\SYSTEM
Computer: DAVE64
Description:
The Windows Image Acquisition (WIA) service was successfully sent a start control.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 3/14/2010
Time: 2:17:15 PM
User: N/A
Computer: DAVE64
Description:
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 22 time(s).
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 3/14/2010
Time: 2:17:25 PM
User: DAVE64\Dave
Computer: DAVE64
Description:
The server {A1F4E726-8CF1-11D1-BF92-0060081ED811} did not register with DCOM within the required timeout.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
... and repeat, several times over 10-20 minutes.
Apparently culmionates in a svhost.exe User Dump, according to the time in the logs.
This puts an Event in the Application log tree:
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/14/2010
Time: 2:17:14 PM
User: N/A
Computer: DAVE64
Description:
Faulting application svchost.exe, version 5.1.2600.2180, faulting module unknown, version 0.0.0.0, fault address 0x00cf06d1.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 63 66 set 00cf
0050: 30 36 64 31 06d1
Also, an occasional System Information Event:
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 3/14/2010
Time: 5:21:26 PM
User: N/A
Computer: DAVE64
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........