Alan_S

Computer freezes at startup – faulting application a2service.exe

Recommended Posts

Two more lock ups within 5 minutes. I have to uninstall EAM to use my PC now... 😢

Will follow this topic to see when I can install (beta of) EAM again.

Share this post


Link to post
Share on other sites
1 hour ago, XIII said:

Two more lock ups within 5 minutes. I have to uninstall EAM to use my PC now... 😢

Will follow this topic to see when I can install (beta of) EAM again.

It sounds like this has been happening for you much more often than for Alan_S. Have you been able to get a memory dump or debug logs for us so that we can make sure it's the same issue?

Share this post


Link to post
Share on other sites

Since you told Alan you did not need a second one I never tried that…

I'll put it on my todo list. Anything in particular I should (not) do?

Share this post


Link to post
Share on other sites

I've been away for a week. Sunday before last, 2018-08-05, I got a freeze. But this time it didn't occur at start-up but during normal running. I was removing redundant data from the C-partition in preparation for taking an image copy when suddenly it happened.  Unfortunately, I'd already disabled EAM diagnostic logging and removed the logs.  I'm a bit uncertain, but  believe it happened on launching XYplorer (a replacement for Windows Explorer). 

I've saved the memory dump so if the developers have any use for it in this case,  i.e. not occurring at start-up but out of the blue,  just let me know and I'll send it.

Oh yes, the version:  The production version as of 2018-08-05  16:19 CET   I believe that would be 2018.7.0.8824.

Share this post


Link to post
Share on other sites

One of the things XYplorer probably does is set up its own set of 'context menu' handlers (ie the things that determine what menu options are shown to you when you right-click a file in 'Windows Explorer' or whatever else ('File Explorer'?) it's called in more recent versions of Windows, and then actually implement the choices they offer.    Akthough I'm sure that there's a standard approach to coding one of these handlers for use with Windows itself, maybe XYplorer is making some incorrect assumption, or maybe there's something in EAM's handler that XPplorer doesn't like.  

There's an option in EAM's Settings -> Advanced, named "Windows Explorer Integration"; it would be interesting to know whether your problems continue if you turn that off.  Indeed it would be interesting to know whether XPplorer normally offers the EAM context menu option, and whether turning the setting off in EAM makes it invisible to XYplorer.

Also... does XIII also use an explorer-replacement?

Share this post


Link to post
Share on other sites

I think I might have just complicated things Jeremy!   As I said, I believe it occurred on launching XYplorer but I'm not 100% sure. I can't recall a freeze happening during normal operations and it took me by surprise. I've had XYplorer since February 2012. The first occurrence of the freeze was 2018-03-30. Over 6 years later. Furthermore, XYplorer isn't activated at start-up. The program launches on clicking the desktop shortcut and terminates on closing, so if it is involved here we are surely talking about two different cases..

However, thank you for the tip. Windows Explorer integration was on and XYplorer does offer the context view option (indeed I've used it many, many times). On unticking Windows Explorer integration, the context view option is no longer offered.

My feeling is that there is no connection, but I'll leave off anyway and let's see what happens. I still keep getting back to the big question: What changed around March 30th? Whatever it was, it affected both my machines.

 

Share this post


Link to post
Share on other sites
7 hours ago, Alan_S said:

I've saved the memory dump so if the developers have any use for it in this case,  i.e. not occurring at start-up but out of the blue,  just let me know and I'll send it.

Let's wait on more debug info until we have a fix for you to test.

 

7 hours ago, Alan_S said:

I'm a bit uncertain, but  believe it happened on launching XYplorer (a replacement for Windows Explorer).

Do you know what version of XYplorer you have installed?

 

On 8/10/2018 at 4:52 PM, XIII said:

Since you told Alan you did not need a second one I never tried that…

I'll put it on my todo list. Anything in particular I should (not) do?

That's understandable, however I in this case I just want to be certain that you really do have the same issue he does.

As for things to do/not to do the two most important are:

  1. Make sure to save anything you're working on before using the keyboard shortcut to force a BSoD/memory dump.
  2. Don't turn off your computer until Windows says it is 100% done saving the memory dump.

Share this post


Link to post
Share on other sites

Ouch: after installing EAM and entering my license code EAM started updating; at 1% it locked up!

Unfortunately 1Password was running unlocked, so I cannot share a dump of this state.

Going to try again with no App open...

Share this post


Link to post
Share on other sites

Reproduced immediately. Waited for Windows to report 100%, after which it rebooted itself. No DMP created.

Worse: EAM is installed, but there's no uninstall option.  And the link to emsiclean.exe on the website is broken...

I'm stuck!

Share this post


Link to post
Share on other sites

My XYplorer is version 15.90 Pro.      But as I said, although I'm pretty sure it was what I launched, I can't say for 100% 
Yes, it's ancient but is just what I need and the licence doesn't allow upgrades.

Edited by Alan_S

Share this post


Link to post
Share on other sites
8 hours ago, XIII said:

Reproduced immediately. Waited for Windows to report 100%, after which it rebooted itself. No DMP created.

Worse: EAM is installed, but there's no uninstall option.  And the link to emsiclean.exe on the website is broken...

I'm stuck!

Link works (for me) on website.

Can you boot into safe mode and uninstall?

Share this post


Link to post
Share on other sites
10 hours ago, XIII said:

Reproduced immediately. Waited for Windows to report 100%, after which it rebooted itself. No DMP created.

Worse: EAM is installed, but there's no uninstall option.  And the link to emsiclean.exe on the website is broken...

I'm stuck!

Link works for me - but like Stapp I'm in the UK so maybe (depending on where you are) we get it from a different server.

Share this post


Link to post
Share on other sites

For a dump actually to be taken, Windows needs to be suitably configured at Control Panel - System - Advanced - Startup & Recovery - System failure   and you also need your page file to be big enough (because the dump gets placed in the  page file at BSoD time, then on your next reboot it is moved to a normal file).   You might want to read through https://support.emsisoft.com/topic/29533-a2serviceexe-application-error/ where some of the issues with such dumps are aired.

Share this post


Link to post
Share on other sites
20 hours ago, XIII said:

Worse: EAM is installed, but there's no uninstall option.  And the link to emsiclean.exe on the website is broken...

Emsiclean is in the Emsisoft Anti-Malware folder:

image.png
Download Image

 

20 hours ago, XIII said:

Reproduced immediately. Waited for Windows to report 100%, after which it rebooted itself. No DMP created.

C:\Windows\MEMORY.DMP didn't exist? Have you turned off your pagefile?

Share this post


Link to post
Share on other sites

The pagefile is currently managed by Windows itself which allocated only 512 MB, but I can temporarily set it to 10 GB manually.

I also noticed that "Write debugging information" was set to "Small memory dump (256 KB)"...

Which option should I choose instead?

  • Kernel memory dump
  • Complete memory dump
  • Automatic memory dump
  • Active memory dump

 

Share this post


Link to post
Share on other sites

Full/Complete memory dump is usually best for debugging, although Windows 10 is supposed to be set to "Automatic memory dump" by default. Note that it will need to be highly compressed in order to reduce the size. I recommend using 7-Zip with LZMA2 compression. Here's a screenshot of the settings (only "Archive format", "Compression level", and "Compression method" are really important):

image.png
Download Image

Share this post


Link to post
Share on other sites

Even after selecting "Complete memory dump" (to %SystemRoot%\MEMORY.DMP) and setting the page file to 10 GB (and rebooting) the dump file is not created.

Instead a 512 KB minidump is written to C:\Windows\Minidump.

I did wait several minutes when the counter reached 100% on the manually initiated BSOD (which already took several minutes) before rebooting.

I'm afraid I have to give up for now...

Share this post


Link to post
Share on other sites

Every time I've triggered the manual BSOD to get a complete system dump, I've had a Minidump file created as well (though that's on W8.1).

Is your pagefile on the same disk as Windows?  For this dumping process, it needs to be (or if you have several pagefiles on various disks, it's the one on your Windows disk that has to be large enough for the dump). 

Does the event log show any errors in the dumping process, or anything at all happening around the same time as (a) the dump is taken, or (b) at reboot, when the dump is moved from the pagefile to the .DMP file?  (Someone else who had problems getting dumps had a disk volume error.)

Do you have systems dumps set to overwrite previous ones?  If not, is there by any chance a very small (or even empty)  C:\Windows\MEMORY.DMP file already in existence?

 

 

Share this post


Link to post
Share on other sites
3 hours ago, XIII said:

Even after selecting "Complete memory dump" (to %SystemRoot%\MEMORY.DMP) and setting the page file to 10 GB (and rebooting) the dump file is not created.

How much RAM do you have? Normally the pagefile needs to be 1.5 times the amount of RAM at the bare minimum to give enough room for a complete memory dump. Keep in mind that with a complete memory dump Windows is writing a file that will be the same size as the maximum amount of data that your RAM can hold, and there's no compression used to make it smaller. If you have 16 GB of RAM, then the memory dump will be 16 GB.

Share this post


Link to post
Share on other sites

I've not seen a 1.5x factor before either, but instead the suggestion that the pagefile needs to be no smaller than ram size, plus 257 MB.   That's explained in: https://support.microsoft.com/en-gb/kb/2860880  in the section entitled "System crash dumps".  However the bit at the top listing all the versions of Windows that the advice is for doesn't mention Win 10 (even though some parts of the page do in fact mention W10) so it's hard to tell if that advice is true for Win 10 or not.

Share this post


Link to post
Share on other sites

Thank you for that link. That would mean the 10 GB should have been enough...

Would there be additional requirements? For example the size of the Windows partition? 

(I use a small SSD, but it does have more than 10 GB free space available)

Share this post


Link to post
Share on other sites

Setting the pagefile to 1.5 times the amount of available RAM is a old recommendation (from the days when computers had less than 1 GB of RAM). I can't quite remember if it was ever an official recommendation from Microsoft, however many techs back then recommended it.

 

2 hours ago, XIII said:

Would there be additional requirements? For example the size of the Windows partition?

Having enough free space is certainly important as well. Do you have a secondary hard drive to move the pagefile to? It doesn't need to be on your C:\ drive if you have another hard drive with more free space. Note that when the memory dump is copied from the pagefile, it will always be saved to the same drive that Windows is in (since it is saved in the Windows folder), however you can change the path that it saves the memory dump in to whatever you want in case you need it on another hard drive as well.

Share this post


Link to post
Share on other sites

One of the things that is frustrating with MS's KB articles is that they often contradict each other, and/or don't get updated properly.  So for example in the summary info at the start of https://support.microsoft.com/en-gb/help/969028/how-to-generate-a-kernel-or-a-complete-memory-dump-file-in-windows-ser  it clearly states that "When you initiate the dump file creation procedure, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed."

That doesn't prevent you from having other paging files on other partitions/disks, but they won't (according to that statement) be used for placing a dump.   But somewhat further into that same page there's a section that says "In Windows Vista and Windows Server 2008, to get a Memory Dump, the paging file does not have to be on the same partition as the partition on which the operating system is installed as was the requirements of previous versions.".   Presumably that applies to more recent versions of Windows too.  But it's followed by instructions on how to create the "DedicatedDumpFile and DumpFileSize" registry entries you need to create to allow this actually to happen.  I've no idea if that got simplified in later versions of Windows.

And, of you continue to read through successive sections of that KB article, things get more and more complicated - eg a pagefile you think is big enough etc might still not get used.  The number of fixes they document suggest (to me) that their code's not robust enough.

Anyway, when @GT500 says (of the pagefile that will be used to hold the dump) "It doesn't need to be on your C:\ drive if you have another hard drive with more free space." ... can I ask what the KB reference for that is?  (Most of the KB articles I've found don't include Win10 in their list of applicable OSes (at the top of the page), though some do have phrases later on like "and later versions".

 

Addressing the question that @XIIIasked about partition size, clearly at the very least you need the MEMORY.DMP file that will be created after you reboot after a BSOD to be able to be big enough to take the data copied out of the pagefile, so (in your case) there's going to have to be at least 10 GB of spare space in that partition.  I'd expect that if insufficient space existed at that point you'd get an Event Log record indicating a problem.

Share this post


Link to post
Share on other sites
23 hours ago, JeremyNicoll said:

Anyway, when @GT500 says (of the pagefile that will be used to hold the dump) "It doesn't need to be on your C:\ drive if you have another hard drive with more free space." ... can I ask what the KB reference for that is?  (Most of the KB articles I've found don't include Win10 in their list of applicable OSes (at the top of the page), though some do have phrases later on like "and later versions".

I don't have a specific KB article, and it's also possible that I was mistaken about that. I'll try to remember to test it and see if it works when I have time.

Share this post


Link to post
Share on other sites

We fixed issues related to a2service.exe crashing in 2018.9.2. Did that have any effect on this issue?

Share this post


Link to post
Share on other sites

I haven't been running EAM (and visiting this forum) because of this issue for quite a while (couldn't work on my PC with EAM installed).

I'll put it on my to-do list to check this week.

Share this post


Link to post
Share on other sites

OK. If you do try it again, then note that we do have a new beta (2018.10) available as well, although the changes are mostly minor and more than likely will not effect stability.

Share this post


Link to post
Share on other sites

Can't even finish install. Completely locks up my PC again. Uninstall is not working either. EmsiClean to the rescue...

Event ID is 1000, application is a2service.exe, and module is KERNELBASE.DLL (10.0.1.17763.1).

Share this post


Link to post
Share on other sites

Did you use the version of Emsiclean that is in the Emsisoft Anti-Malware folder, or did you download a copy of it?

Share this post


Link to post
Share on other sites

In a few of days I was hoping to announce the good news that version 2018.9.2.8988 was looking very promising as I'd had no freezes since 2018-10-06 (version 2018.9.1.8968). Sadly, I got one today on my HP EliteBook 8440p. Powered on, logged on and then nothing but a desktop with no shortcut icons and a taskbar with nothing but the start-button. Whenever the mouse pointer was over the taskbar, it became an hourglass. Unfortunately I've no debug material to offer: the USB keyboard wasn't plugged in so no dump and debug logging wasn't turned on (well, at least it shows how confident I was!)

So this just has to be a heads-up that the problem is still with us (well with me, at least).

If / when it occurs again shoud I send a dump etc. or is what you have on older versions enough?

Share this post


Link to post
Share on other sites
1 hour ago, Alan_S said:

If / when it occurs again shoud I send a dump etc. or is what you have on older versions enough?

I haven't been asked for more debug info, so I think it would be best to wait and see if our developers end up needing anything else first.

Share this post


Link to post
Share on other sites

This problem still occurs in version 2018.10.1.9026. Occurs at about 3-week intervals. In fact it occurred on start-up yesterday morning: after logon but before I had done anything at all. So it's nothing to do with launching any particular program.  It's extremely irritating and a great time waster.  Generally seems to occur when I'm in a hurry.

If the developers are interested, I have a dump, diagnostic logs and an EmsisoftDiagLog.txt.

One thing I have done today is a clean re-installation of EAM. I doubt it will help (it shouldn't) but it's worth a try.

 

Share this post


Link to post
Share on other sites
1 hour ago, Alan_S said:

One thing I have done today is a clean re-installation of EAM. I doubt it will help (it shouldn't) but it's worth a try.

When you uninstalled, did you use Emsiclean afterwards? If so, did you use a copy of the one from the Emsisoft Anti-Malware folder, or one you downloaded?

Share this post


Link to post
Share on other sites

Yes I did, following the instructions in https://helpdesk.emsisoft.com/en-us/article/150-how-do-i-completely-uninstall-an-emsisoft-product Thus after the uninstall I downloaded emsiclean.zip from the link provided there (actually, there was no choice since uninstall had removed it) Unpacked it and ran EmsiClean32.exe.  It reported that uninstall had left C:\Program Files\Emsisoft Anti-Malware (with some content) but, as recommended, closed the program without letting it do anything. I then renamed the directory to C:\Program Files\Emsisoft Anti-Malware_Old rather than deleting directly. I ran regedit to see if anything was left. There were some 'Emsisoft items' but none that I felt had any bearing on the running of the program as such, so left them.

Then, I downloaded EAM, installed it and entered my licence key.

Before starting this exercise, I documented the settings and then exported them. My plan was/is to not import them but start from scratch. Of course, that means that EAM now needs interaction and an import would make life a lot easier. In the context of what I'm trying to achieve (a fresh installation in the hope of getting rid of the problem) could an import potentially mess up the good work?

I also took an image copy of the system so if I've done anything wrong above (e.g. using a downloaded EmsiClean32.exe) I can re-do it all.

The above took place on my Dell stationary computer. Today, at 13:20 CET I started up my HP EliteBook which hadn't been used for about a week. No prizes for guessing what happened...  After a forced restart and doing what I wanted, I turned it off and then at 15:58 fired it up again. Noted that EAM started updating, the shield in the notification area being light green and pulsating, which suddenly stopped...
Two incidents in a couple of hours!

This (it occurring on both machines and several times within a very short time) has happened before. However far out it sounds, could there be some connection with the time?

Finally, since you didn't ask for the material I have, I assume the developers don't need it.  Right?

Share this post


Link to post
Share on other sites
52 minutes ago, Alan_S said:

Finally, since you didn't ask for the material I have, I assume the developers don't need it.  Right?

They haven't asked for anything more in the way of debug information, and if they need more info then they generally ask for it, so I think it's safe to say that you're correct and that they have what they need for now.

 

54 minutes ago, Alan_S said:

I ran regedit to see if anything was left. There were some 'Emsisoft items' but none that I felt had any bearing on the running of the program as such, so left them.

It's best to search for "epp" as well, just to be on the safe side. Several of our drivers have names that start with "epp" (short for "Emsisoft Protection Platform").

 

56 minutes ago, Alan_S said:

The above took place on my Dell stationary computer. Today, at 13:20 CET I started up my HP EliteBook which hadn't been used for about a week. No prizes for guessing what happened...  After a forced restart and doing what I wanted, I turned it off and then at 15:58 fired it up again. Noted that EAM started updating, the shield in the notification area being light green and pulsating, which suddenly stopped...
Two incidents in a couple of hours!

This (it occurring on both machines and several times within a very short time) has happened before. However far out it sounds, could there be some connection with the time?

Is it possible that this always happens when updates are being installed?

Share this post


Link to post
Share on other sites

According to my notes, the last diagnostic material I sent was at the end of July. Speaking as an old programmer, I'm surprised that the developers are satisfied to be working (if they still are) with material from a version that is so old. But if it's OK with them then that's fine. My only interest is that the problem gets identified -- and I don't care whether it's EAM's “fault” or mine -- and zapped.

Yes, there are some paths to epp-modules in the registry, but that would be natural since EAM has been re-installed after the uninstall. But I thought it was things like that that emsiclean was supposed to find. I can do a new uninstall exercise and check - if that would help.

As for the problem always occurring on update, no - it updates every two hours and almost always at start-up. However, I suppose there could well be a timing issue where an update starts at a sensitive time (not just at start-up either). That would explain a lot. Diagnostic logs covering today's two incidents on the HP EliteBook are available as they are for yesterday's incident on the Dell. They might shed some light.

 

Share this post


Link to post
Share on other sites

A problem concerning the 2 incidents on the EliteBook 2018-11-22. Next day, it was running but I had left it, to do some work on the Dell. Suddenly a BSOD on the EliteBook! Out of the blue. Hadn't touched it for some time. So, the dump file of 2018-11-22 got overwritten. I had already turned off debug logging and automatic updates, so at least updating can surely be exonerated?

I think this is an interesting case - happening spontaneously.

Then the Dell. I still have the material I mentioned last Wednesday: Dump, debug logs and EmsisoftDiagLog.txt

I've sent both these and a PM.

 

 

Share this post


Link to post
Share on other sites
2 hours ago, Alan_S said:

I had already turned off debug logging and automatic updates, so at least updating can surely be exonerated?

That's more than likely the case. Hopefully the memory dumps will shed some light on what's happening.

Share this post


Link to post
Share on other sites

@Alan_S I've been told that the issue you reported has been fixed, and that the fix should be available in an upcoming beta for you to test.

Note that the first 2018.11 beta release does not contain this fix. It will be in a subsequent beta release which should be available soon.

Share this post


Link to post
Share on other sites

Very, very good news!  I'll keep an eye on the beta releases.

Just one question:  I assume I get the beta release by changing "Update feed" in the settings to "Beta" and then the Update will fix it,  Right?  But when the beta version is released as "Stable", how do I get back to that state?  Simply set "Update feed" as stable or should I un-install the beta first?

Santa Claus has come early...

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.