My biggest problem is that the error message is so uninformative that I don’t even know which instance of svchost (PID would make it easier) has crashed.

Q1: Is there a way to determine which services did the crashed instance host?
Q2: Does Windows randomly group services to run using several svchost instances or is it defined somewhere (in registry or whatever)?

BTW I get the message absolutely randomly, 0.1 - 3 hours from startup. But only since 1 or 2 weeks ago. In the past 4 weeks I did not install anything, even windows updates were cancelled. Now both Windows and SAV9 is up-to-date, no suspicious files were reported. Please give me a hint!

@ Veronique: Thanks for your advice too. But I prefer my windows to be always a little bit open for fresh air. :p

The short answer is: no, you’re not in any trouble and you didn’t do anything wrong. Although it’s rather confusing, Windows was actually taking preventative steps that are designed to help make your computer more secure.

First, a little background. The “Generic Host Process for Win32 Services” is a component of Windows that will appear as “svchost.exe” in the Task Manager. There are many specialized programs, called “services” which run in Windows all the time. These services take care of things like helping to manage your network connection, to downloading Windows Update patches, to keeping your computer’s clock set properly. (You can see a list of all the services that are running on your computer by right-clicking on “My Computer”, selecting “Manage”, opening the “Services and Applications” entry, and selecting “Services”.) The “svchost.exe” application manages several of these services at the same time, and it’s not unusual to have more than one copy of “svchost.exe” running at any given time, each of them managing a different set of services.

The first error message you saw, the “Data Execution Prevention” (or “DEP”) message, appeared because one of the services that “svchost.exe” crashed in a particular manner. In general, the memory that computer programs use can be one of two types: executable memory, which stores the actual computer instructions that make up the program, and data memory, which stores the information that the program is using. The kind of information stored in data memory is in a different format than executable memory, and the two types of memory don’t mix. Usually this isn’t a problem, but if a program has a bug in it, or if a malicious attacker is trying to break into a system, sometimes a program will try to interpret data memory as exeuctable memory. When this happens, Windows will cause the program to crash. This sounds severe, but making the program crash is actually better than letting it continue to run — since it’s trying to execute data memory, something has gone seriously awry, and allowing the program to keep running can result in data corruption or other such problems. Better to stop the program and crash it before it can do any more damage.

So, the first error message, the DEP message, was simply Windows telling you that the svchost.exe program became confused, and was trying to interpret data memory as executable memory, and so it was terminated by crashing the program.

The second error message, the “Please tell Microsoft about this problem” message, is the same kind of error message you’ll get when any Windows application crashes for any reason. You just happened to get two messages about the same program because of the particular way in which svchost.exe crashed, a DEP crash, triggers an additional message before the standard “hey this program has crashed” message.

There are lots of reasons programs crash, and most of them are simply because all programs have bugs in them. It’s a little more confusing in this case because the program that crashed (svchost.exe) is part of Windows and made my Microsoft, and Windows reported the DEP error, and it also reported the crash report, and everything is made by Microsoft so why are you getting all these messages? The answer is simply that just because Microsoft made it and it’s part of Windows doesn’t mean it doesn’t crash. :) I’m not trying to be cute, of course. Whether a program that crashes is made by Microsoft or not, Windows treats all crashes equally. This is actually a good thing — it means that (as long as you send the crash reports), Microsoft learns which of its programs crash, too. It would be much worse if Windows only reported on non-Microsoft programs that crashed!

And in my opinion, it’s always a good idea to submit the crash reports to Microsoft. Every report they get helps them figure out which parts of Windows (or Office, or whatever) have bugs in them, and hopefully those bugs will eventually get fixed.

Think of what foreign software you were installing, which websites did you browse other than usual, and try to correlate to think whether you might have got the virus or not… suddenly trying to execute the data is not fantastic.

I will not run second life on my macs, because I can’t control the level of antialiaing on the card itself (thanks to no third party drivers). Running it is one thing, running it well is quite another.

“In a world without walls and fences, who needs windows and gates?”

(Something i’m sure you didn’t know of: Second Life takes 3 times the amount of processing power “World of Warcraft” uses. That’s due to prims, since each is a tiny 3D mesh, the graphics card is bombarded with about 5,000+ meshes to render. Plus your avie is a very complex one. So if it can run Second Life, it can run The Sims 2 ;-). )