services.exe crash in Windows 7

[techno_race]

I was just typing when the following message appeared out of nowhere:

You are about to be logged off
Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now.
[ Close ]

After rebooting, the Event Log shows these events around that time:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Application Error" /> 
  <EventID Qualifiers="0">1000</EventID> 
  <Level>2</Level> 
  <Task>100</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2010-06-16T21:43:56.000000000Z" /> 
  <EventRecordID>293</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>Clam</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>services.exe</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bbf1b</Data> 
  <Data>UBPM.dll</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bdb1c</Data> 
  <Data>c0000005</Data> 
  <Data>0000143d</Data> 
  <Data>198</Data> 
  <Data>01cb0c19878a7750</Data> 
  <Data>C:\Windows\system32\services.exe</Data> 
  <Data>C:\Windows\system32\UBPM.dll</Data> 
  <Data>4381d1a0-7990-11df-b5f0-00065b36f4ed</Data> 
  </EventData>
  </Event>

and

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Windows Error Reporting" /> 
  <EventID Qualifiers="0">1001</EventID> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2010-06-16T21:43:59.000000000Z" /> 
  <EventRecordID>294</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>Clam</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data /> 
  <Data>0</Data> 
  <Data>APPCRASH</Data> 
  <Data>Not available</Data> 
  <Data>0</Data> 
  <Data>services.exe</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bbf1b</Data> 
  <Data>UBPM.dll</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bdb1c</Data> 
  <Data>c0000005</Data> 
  <Data>0000143d</Data> 
  <Data /> 
  <Data /> 
  <Data>C:\Windows\Temp\WERD3A2.tmp.appcompat.txt C:\Windows\Temp\WERD502.tmp.WERInternalMetadata.xml C:\Windows\Temp\WERD50D.tmp.hdmp C:\Windows\Temp\WERDAB0.tmp.mdmp</Data> 
  <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_services.exe_1511f2d94f0ba99e533872c9a343a7e32f39e3_cab_0797dbb1</Data> 
  <Data /> 
  <Data>0</Data> 
  <Data>4381d1a0-7990-11df-b5f0-00065b36f4ed</Data> 
  <Data>4</Data> 
  </EventData>
  </Event>

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Windows Error Reporting" /> 
  <EventID Qualifiers="0">1001</EventID> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2010-06-16T21:44:00.000000000Z" /> 
  <EventRecordID>295</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>Clam</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data /> 
  <Data>0</Data> 
  <Data>APPCRASH</Data> 
  <Data>Not available</Data> 
  <Data>0</Data> 
  <Data>services.exe</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bbf1b</Data> 
  <Data>UBPM.dll</Data> 
  <Data>6.1.7600.16385</Data> 
  <Data>4a5bdb1c</Data> 
  <Data>c0000005</Data> 
  <Data>0000143d</Data> 
  <Data /> 
  <Data /> 
  <Data>C:\Windows\Temp\WERD3A2.tmp.appcompat.txt C:\Windows\Temp\WERD502.tmp.WERInternalMetadata.xml C:\Windows\Temp\WERD50D.tmp.hdmp C:\Windows\Temp\WERDAB0.tmp.mdmp</Data> 
  <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_services.exe_1511f2d94f0ba99e533872c9a343a7e32f39e3_cab_0797dbb1</Data> 
  <Data /> 
  <Data>0</Data> 
  <Data>4381d1a0-7990-11df-b5f0-00065b36f4ed</Data> 
  <Data>0</Data> 
  </EventData>
  </Event>

The computer is a Dell Latitude C610 notebook with 1GB of RAM, a 1GHz Pentium III processor, and Windows 7 Ultimate.

What does it mean??? It doesn't seem to have happened again yet, but it was just random enough as to warrant a mention.

[djr33]

I have no idea about the details, but my guess is that something is misconfigured or you have a virus. You could use the "repair"/"restore" function of the windows disc (whatever it's called), but since that rarely accomplishes something (unless you're really lucky), it's probably a good time to reformat: why not, anyway? Every 3-6 months is about normal for a PC (unless you're excessively careful about viruses, etc.).

[techno_race]

Uh... I just installed Windows 3 days ago.

I suspect that my hard drive is corrupted, as I had an insane amount of problems with it while installing. Possibly related, I just bluescreened. I didn't catch the details, but I got these reports:

Problem signature:
  Problem Event Name:	BlueScreen
  OS Version:	6.1.7600.2.0.0.256.1
  Locale ID:	1033

Additional information about the problem:
  BCCode:	1000008e
  BCP1:	C0000005
  BCP2:	8D4EDC8B
  BCP3:	80F0AA08
  BCP4:	00000000
  OS Version:	6_1_7600
  Service Pack:	0_0
  Product:	256_1

Files that help describe the problem:
  C:\Windows\Minidump\061610-35651-01.dmp
  C:\Users\Tortoise\AppData\Local\Temp\WER-62239-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

C:\Users\Tortoise\AppData\Local\Temp\WER-62239-0.sysdata.xml:

  <?xml version="1.0" encoding="Unicode" ?> 
- <SYSTEMINFO>
- <SYSTEM>
  <OSNAME>Windows 7 Ultimate Professional</OSNAME> 
  <OSVER>6.1.7600 0.0</OSVER> 
  <OSLANGUAGE>1033</OSLANGUAGE> 
  <ARCHITECTURE>0</ARCHITECTURE> 
  <PRODUCTTYPE>1</PRODUCTTYPE> 
  </SYSTEM>
  TOO LONG, SEE AT: thetortoise.tk/bug.txt

I clicked the "check for solution" button at the next boot. I also checked the logs, which reported that all of my paused services suddenly started, and that the system bluescreened 7 seconds later:
"The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x8d4edc8b, 0x80f0aa08, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 061610-35651-01."

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" /> 
  <EventID Qualifiers="16384">1001</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2010-06-16T23:27:54.000000000Z" /> 
  <EventRecordID>1211</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>System</Channel> 
  <Computer>Clam</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="param1">0x0000008e (0xc0000005, 0x8d4edc8b, 0x80f0aa08, 0x00000000)</Data> 
  <Data Name="param2">C:\Windows\MEMORY.DMP</Data> 
  <Data Name="param3">061610-35651-01</Data> 
  </EventData>
  </Event>

After boot, all my services started, and:
"The dump file at location: C:\Windows\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space."

[djr33]

Then maybe something went wrong with the install. All the more reason then to reformat again.

If your hard drive is the problem, it's surprising it works at all, unless there is some software issue (driver??), but that's also rare.


Again, maybe someone else will understand the logs and have better advice, but if after 3 days of use your computer is doing this, why wouldn't you reinstall?

[techno_race]

Well, it's probably a hardware problem, because my older Windows XP installation (and attempted Ubuntu installation) behaved similarly. I've already replaced the AC adapter, CD drive, battery, hard drive, RAM, and epoxied the USB port into place. Grr. (The laptop is mostly just an experiment - I found it sitting dead in a pile, and have been restoring it.)