marko

a2service.exe application error

Recommended Posts

11 hours ago, marko said:

ProcDump tries to create one but it just seems to not finish - it does create a new dump file but it is 0 bytes each time.  This morning I noticed in the Command Prompt window that it said 'Unhandled C000041D Dump 1 initiated C:\ProcDump\ a2service.exe_180604_102447.dmp'.

Does ProcDump have permission to write to C:\ProcDump? If you run it with administrator rights, then in theory it should have permission to write to that folder (Windows doesn't restrict writing to folders in the root of C: for administrators by default). It's just standard procedure to check permissions when a file doesn't appear to be written as expected.

Let's try adding exclusions (scanning and monitoring) to EAM for ProcDump, just in case the File Guard is causing ProcDump to freeze while saving the dump. It's easiest to just add the entire ProcDump folder to the exclusions, so here are instructions on excluding a folder from scanning and monitoring:

  1. Open Emsisoft Anti-Malware.
  2. Click on Settings in the menu at the top.
  3. Click on Exclusions in the menu at the top.
  4. To the right of the list to Exclude from scanning, click on the Add folder button.
  5. Navigate to the folder you would like to exclude, click on it once to select it, and then click OK.
  6. To the right of the list to Exclude from monitoring, click on the Add folder button.
  7. Navigate to the folder you would like to exclude, click on it once to select it, and then click OK.
  8. Close Emsisoft Anti-Malware.

 

9 hours ago, JeremyNicoll said:

I realise this is not a useful post... but the trigger is not meant to manually initiate a crash dump.   It is meant to trigger a BSOD.   The expected/normal treatment of any BSOD, by the OS, is to take the configured type of dump.    The problem you have isn't the trigger, but the dump mechanism, presumably because of that  volmgr  thing.  I don't know what that is (can't see your attached files), but does googling that produce any useful suggestions?

I would believe that the keyboard shortcut to trigger a BSoD always triggers the same error, and thus should always produce a memory dump. I've never seen it fail like this, so my only guess would be some sort of I/O issue is causing it to fail to write to the pagefile.

 

9 hours ago, marko said:

The plot thickens - I just tried to generate a dump file via the keyboard as a test (again), and this time the BSDO appeared showing 0% then the pc rebooted and no dump file was created (just as it does when I do it after an a2service crash) and I had the same volmgr error in event viewer, so it seems to be completely random - sometimes it will create a dump file and sometimes not, regardless of whether the system has hung or not.

Do you have the latest drivers installed for your computer (or your motherboard, if it's a custom built computer)? I recommend getting them either from the manufacturer, or from the company that made the chipset.

Share this post


Link to post
Share on other sites
17 minutes ago, GT500 said:

Does ProcDump have permission to write to C:\ProcDump? If you run it with administrator rights, then in theory it should have permission to write to that folder (Windows doesn't restrict writing to folders in the root of C: for administrators by default). It's just standard procedure to check permissions when a file doesn't appear to be written as expected.

The Admin group seems to have Full Control set in the security permissions for this folder, and I always run it as an admin.  I'll add the folder to the EAM exclusions and see if that helps.

20 minutes ago, GT500 said:

Do you have the latest drivers installed for your computer (or your motherboard, if it's a custom built computer)? I recommend getting them either from the manufacturer, or from the company that made the chipset.

I've checked that today as it happens (it's a Lenovo Ideapad laptop) and as far as I can tell I have the latest drivers installed.  I have noticed that there's a BIOS update available but I've been a bit reluctant to install it as BIOS updates are always a bit scary.

I also had the same problem on my desktop pc as mentioned in my original post.  I haven't had the problem on this machine since the original post but then I haven't used it very much since then and testing has been confined to my laptop.  I might try and replicate the problem on the desktop pc in the next few days to see if I can get a dump file from ProcDump.

Share this post


Link to post
Share on other sites
8 minutes ago, marko said:

I also had the same problem on my desktop pc as mentioned in my original post.  I haven't had the problem on this machine since the original post but then I haven't used it very much since then and testing has been confined to my laptop.  I might try and replicate the problem on the desktop pc in the next few days to see if I can get a dump file from ProcDump.

OK. Hopefully if the laptop is a no-go, then the desktop will provide us with the dump to understand what's going on.

Share this post


Link to post
Share on other sites

I had another lock up this morning on my laptop - ProcDump created a dump file but didn't finish again so it's 0 bytes in size.  I generated a blue screen from the keyboard but it didn't create a dump file again - I had the same volmgr error in Event Viewer.

I've just changed the pagefile settings to system managed, rebooted, then set the pagefile size back to 8500 min and 12500 max and rebooted again, then tested a blue screen from the keyboard and it succesfully created a dump file so maybe it wasn't remembering the setting - who knows ?

Anyway, I've just reset the page file again as above in the hope that I can generate a dump file next time the system hangs - time will tell.....

Share this post


Link to post
Share on other sites

OK. If you still can't get a memory dump, then I'll see if our developers have any ideas about what else we could try.

Share this post


Link to post
Share on other sites
19 hours ago, GT500 said:

OK. If you still can't get a memory dump, then I'll see if our developers have any ideas about what else we could try.

Well, I had another lock up earlier and I've finally managed to generate a dump file via the keyboard.

There's nothing in the Windows event viewer to say that a2service faulted, but ProcDump tried to create a dump file again so this suggests that a2service did cause the problem.

Please let me know whether you still want the dump file, and if so, where to send it.

It's 2.31GB when zipped as a zipx file, or 2.87GB as a standard zip file - the next challenge will be sending it to you as I only have an upload speed of 0.5 MB/s !

Share this post


Link to post
Share on other sites

Can you use 7-Zip to compress it using LZMA2 to get the file size under 2GB? Here's a screenshot of the settings to use (you only need to change the Archive format, Compression level, and Compression method to match the screenshot):

image.png
Download Image

Share this post


Link to post
Share on other sites

If you can get the file size below 2GB then WeTransfer will allow you to send files up to 2GB for free. You may have to enter an e-mail address when uploading the file, so enter [email protected] and be sure to leave a link to this topic in your message.

Share this post


Link to post
Share on other sites
50 minutes ago, GT500 said:

Can you use 7-Zip to compress it using LZMA2 to get the file size under 2GB? Here's a screenshot of the settings to use (you only need to change the Archive format, Compression level, and Compression method to match the screenshot):


Download Image

Have just done that and the 7z file is 2.24GB

51 minutes ago, GT500 said:

If you can get the file size below 2GB then WeTransfer will allow you to send files up to 2GB for free. You may have to enter an e-mail address when uploading the file, so enter [email protected] and be sure to leave a link to this topic in your message.

So, I can't use WeTransfer as the file is too big.

I have plenty of space on Google Drive so I could put it there and send a download link if that''s any good ?

Share this post


Link to post
Share on other sites

> I have plenty of space on Google Drive so I could put it there and send a download link if that''s any good ?

I expect that will work - I use Dropbox in a similar way for sending dumps etc to Emsisoft.  Just make sure you don't post the URL in this forum where anyone can see it.  Send a PM (personal message) to GT500 - to do that hover over his avatar and then click 'message'.

Share this post


Link to post
Share on other sites
1 minute ago, JeremyNicoll said:

> I have plenty of space on Google Drive so I could put it there and send a download link if that''s any good ?

I expect that will work - I use Dropbox in a similar way for sending dumps etc to Emsisoft.  Just make sure you don't post the URL in this forum where anyone can see it.  Send a PM (personal message) to GT500 - to do that hover over his avatar and then click 'message'.

Thanks Jeremy - I just wasn't sure if they had some sort of preferred method of obtaining the files so seeing as you use Dropbox then I can't see there'll be a problem using Google Drive.

I wasn't going to post the URL - GT500 said to send an email with a download link to the support email address, so I'll do that rather than pm him.

Share this post


Link to post
Share on other sites
13 hours ago, GT500 said:

If you can get the file size below 2GB then WeTransfer will allow you to send files up to 2GB for free. You may have to enter an e-mail address when uploading the file, so enter [email protected] and be sure to leave a link to this topic in your message.

To confirm, I have just uploaded the dump file (zipped as 7z) to my personal Google Drive space, and have emailed a download link to the support email address quoted above.

Share this post


Link to post
Share on other sites
12 hours ago, marko said:

To confirm, I have just uploaded the dump file (zipped as 7z) to my personal Google Drive space, and have emailed a download link to the support email address quoted above.

Received. ;)

I'll make sure it gets forwarded to our QA team, and see if some of our developers can take a look at it.

Share this post


Link to post
Share on other sites

I had another lock up, again this morning just after logging in to my laptop at 08:48.

ProcDump started creating a dump file at 08:53 (Unhandled C000041D Dump 1 initiated C:\ProcDump\ a2service.exe_180616_085310.dmp) but after waiting 15 minutes for it to finish, and with no obvious sign of progress or disk activity, I tried to generate a dump file via the keyboard.  

Unfortunately, it just went to the blue screen with 0% progress then restarted without creating the dump file.

After the system had rebooted, I checked the ProcDump folder and the dump file it's created is 684kb rather than 0kb this time, so ProcDump obviously tried but I suspect it didn't finish given the size of the file - should I have waited longer ?.

Another thing I noticed is that, after restarting the machine following this morning's crash, EAM debug logs have reverted to Disabled again, although I'm fairly certain it should still be Enabled for 1 day - I think it would be useful if the action of turning debug mode on or off was written to the forensic log - something to consider for future builds perhaps ?

I also noticed that there are only two debug logs for this crash (one for a2service and one for a2guard) created this morning at 08:49 (I started the machine at 08:48), but it didn't create one for a2start so I assume this means a2service crashed before a2start could load (again).  This again implies that debug logging was Enabled when the crash happened, yet it showed as Disabled after restarting following the crash.

I've attached the ProcDump dump file and the two EAM debug logs in case they are of any use.

EAM debug logs etc 16062018.zip

Share this post


Link to post
Share on other sites

Unfortunately there's nothing useful in the debug logs either. The only thing we were able to get out of the memory dump is that the hang seems to be happening when a2service.exe is suspended. It's difficult to say why a2service.exe is suspended, however it may be trying to terminate and getting "stuck" (hanging/freezing for some reason) while that is happening. Unfortunately there's nothing in the debug information that shows us why this is happening. 

With the odd volmgr errors you've been having it is possible that there's a hard drive or controller issue (or perhaps even a driver or BIOS issue) that's at the root of the problem. Updating your BIOS and drivers may help, but it's hard to say. Either way, that volmgr error may need to be resolved before we can figure out what's wrong with EAM (assuming the EAM hangs aren't simply a symptom of the volmgr issue).

Share this post


Link to post
Share on other sites

It's a shame there's nothing in the debug logs that help.

I'm not convinced it's a hard drive or controller issue - I've done a full surface scan using chkdsk and done the same with HDTune plus health and benchmark tests and everything seems fine on that front and I'm not seeing any other odd behaviour.

I've also run full diagnostic tests on all hardware and full memory tests using a diagnostic utility from the laptop manufacturer with no problems found.  And all my drivers are up to date.

Would another dump file be of any help if I can manage to create one ?

Share this post


Link to post
Share on other sites

Further to my last post, I've now resolved the volmgr errors and can consistently generate a dump file when crashing the system via the keyboard.

I'd neglected to untick the 'Automatically Restart' check box in the Startup and Recovery settings window :(

So, I'm confident that there's nothing wrong with my hardware or drivers.

I will now be able to generate a dump file with certainty next time it locks up, so please let me know if you'd like one.

Share this post


Link to post
Share on other sites

The option to restart automatically shouldn't prevent the memory dump from being saved, it just restarts the computer automatically after saving it.

You can try another memory dump if you'd like, however I suspect that the results will be the same.

Share this post


Link to post
Share on other sites
17 minutes ago, GT500 said:

The option to restart automatically shouldn't prevent the memory dump from being saved, it just restarts the computer automatically after saving it.

well, after I unchecked it I was able to generate a dump file several times in a row which was a first.  Now though, it's not creating one again and just sits at the blue screen with 0% - very odd

20 minutes ago, GT500 said:

You can try another memory dump if you'd like, however I suspect that the results will be the same.

I just thought it may be of use as you said you had trouble reading the call stacks in the previous one.

So, it looks as if we're out of options...................

Share this post


Link to post
Share on other sites
23 hours ago, marko said:

Now though, it's not creating one again and just sits at the blue screen with 0% - very odd

That makes me suspect a problem with disk access, although it could be a software issue and not a hardware issue. It's hard to say, especially if there was a problem before trying to force the memory dump.

 

23 hours ago, marko said:

I just thought it may be of use as you said you had trouble reading the call stacks in the previous one.

That's possible, however it's just as likely that a new dump would have the same issue (perhaps due to whatever is preventing ProcDump from saving a2service.exe's memory to a dump file when it terminates). It's a gamble, and it may just end up wasting more of your time. Since I've had you go through so much effort trying to debug this already, I'm hesitant to ask you to keep trying when the odds of getting useful debug information don't look good.

 

On 6/18/2018 at 10:49 PM, marko said:

So, it looks as if we're out of options...................

I'm certainly not able to think of anything else we could do to debug the issue. When memory dumps and debug logs fail, there really isn't anything left to fall back on.

Share this post


Link to post
Share on other sites
1 hour ago, GT500 said:

That makes me suspect a problem with disk access, although it could be a software issue and not a hardware issue. It's hard to say, especially if there was a problem before trying to force the memory dump.

Maybe it's not creating a dump file because of the limitations mentioned at the bottom of this page https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard

 

1 hour ago, GT500 said:

That's possible, however it's just as likely that a new dump would have the same issue (perhaps due to whatever is preventing ProcDump from saving a2service.exe's memory to a dump file when it terminates). It's a gamble, and it may just end up wasting more of your time . Since I've had you go through so much effort trying to debug this already, I'm hesitant to ask you to keep trying when the odds of getting useful debug information don't look good.

I'm happy to keep trying - maybe another dump file would show something that the first one didn't, and maybe the call stacks will be more readable - it's worth a try surely.

When I created this thread, it was because I had the lock up on my desktop pc and my laptop with 24 hours of each other - I'm still hoping that I can replicate the hang on my desktop pc but haven't neen able to so far - I'll keep trying.

Share this post


Link to post
Share on other sites
18 hours ago, marko said:

Maybe it's not creating a dump file because of the limitations mentioned at the bottom of this page https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard

That's possible, however from what the article says I expect it would only be applicable with a PS/2 keyboard. It shouldn't happen with a USB keyboard. In this case we did get a memory dump though, and you mentioned that saving the dump has been more reliable recently, so this may not be the issue.

Note that laptop keyboards are usually PS/2, so if you have a USB keyboard and want to try it with that then there's a separate set of batch files for enabling/disabling the keyboard shortcut for USB keyboards:
https://www.gt500.org/emsisoft/USB_Crash_On_Crtl_Scroll_Lock_Batch_Files.zip

 

18 hours ago, marko said:

When I created this thread, it was because I had the lock up on my desktop pc and my laptop with 24 hours of each other - I'm still hoping that I can replicate the hang on my desktop pc but haven't neen able to so far - I'll keep trying.

Considering the fact that it hasn't happened on bother computers since you first created this thread, is it possible that it was a power-related issue? Is there any difference in where the laptop and desktop have been plugged in since it happened? Does the laptop only do it when plugged in, or on battery? Have you added/changed any surge protection or battery backups to the desktop since the issue happened?

Share this post


Link to post
Share on other sites
On 6/21/2018 at 1:00 AM, GT500 said:

Considering the fact that it hasn't happened on bother computers since you first created this thread, is it possible that it was a power-related issue? Is there any difference in where the laptop and desktop have been plugged in since it happened? Does the laptop only do it when plugged in, or on battery? Have you added/changed any surge protection or battery backups to the desktop since the issue happened?

Both machines are plugged in to the same place they always have been, on separate surge protectors in different rooms.

Just to update you, I replaced the surge protector that the laptop plugs in to a week ago and I also managed to find a couple of driver updates (audio and touchpad) and since installing them I haven't had a single lock up (7 days so far).

I'm reluctant to say that the problem is now resolved as sometimes the lock ups wouldn't happen for a week or so, but it's looking good so far.

Share this post


Link to post
Share on other sites
5 hours ago, marko said:

Just to update you, I replaced the surge protector that the laptop plugs in to a week ago and I also managed to find a couple of driver updates (audio and touchpad) and since installing them I haven't had a single lock up (7 days so far).

I'm reluctant to say that the problem is now resolved as sometimes the lock ups wouldn't happen for a week or so, but it's looking good so far.

That's good news. Hopefully the issue is resolved. You'd be surprised how power issues can effect a computer, and cause strange freezes and such. I've seen systems that were unstable, but were fine when plugged into a brand new UPS (Uninterruptible Power Supply/Battery Backup). I've also seen similar issues fixed by BIOS and driver updates.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.