Windows 10: Apps crashing and returning Child process [14004 - xTendSoftAP.exe ] finished with 0 in the...

I always have discord and Spotify open; while Spotify has never really crashed consistently, discord has crashed almost every hour while playing games. The games vary from rocket league to Apex to Yakuza, all on steam, with overwatch and etterna/osu also being used while discord crashes. Sometimes its just chrome open and discord decides to crash. In the events view the only info I have on why this keeps happening is this: - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="xTendSoftAPService" /> <EventID Qualifiers

:)

 

Windows Rundll32 (child process of DllHost) is crashing. How can I even identify it?

Windows 10 Home / "x64-based PC" / Dell XPS 13 9360

In Reliability Monitor, I have many "app failures" every day. They go back all the way to 2017-12-04 without variation (the details below are identical), when I believe this machine was first used. The problem is marked as having been reported (apart from problem instances in the past few minutes).

@magicandre1981 also suggested I open a public problem in the Windows app Feedback Hub for some reason.

My question is: How can I identify this? What causes the crashes? Can they be resolved somehow?

Problem details

• Faulting Application Path: C:\Windows\System32\rundll32.exe
  
• Problem Event Name: APPCRASH
  
• Fault Module Name: Windows.UI.Immersive.dll
  
• Fault Module Version: 10.0.16299.125
  
• Exception offset: 00000000000ac885
  
• Exception code: c0000005
  
• OS Version: 10.0.16299.2.0.0.768.101
  
• Bucket ID: ab5106f0b0020ee0d7e0c2d4f71642fb (1720589277589816059)
  

"Anti-virus" is installed (McAfee VirusSafe) and running with no alerts, no quarantined items, no significant logs that I can find. sfc /scannow gives the system a clean bill of health.

Triggering the problem manually

It seems possible to trigger the crash by logging in. This isn't what has been causing it in the past, because the machine doesn't usually have a user logging in and out (or even turning the machine on and off).

Process Monitor allows to trace process creation and exit. Running it as a second user, I am able to see the crashing process:

• Command line: "C:\WINDOWS\system32\rundll32.exe" -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617.
  

It's not really clear what this UUID is. The -localserver option does not appear to be documented. Google finds a question, the only answer claims it is "Process Profiling Performance Analysis Program (Windows Performance Counter Program)". Admittedly I can see that profapi.dll and powrprof.dll are loaded in this process.

• Parent process: DllHost.exe ("COM Surrogate").
  

Described as "I don't feel good about this code, so I'm going to ask COM to host it in another process. That way, if it crashes, it's the COM Surrogate sacrificial process that crashes instead of me".

• Command line: C:\WINDOWS\system32\DllHost.exe /Processid:{133EAC4F-5891-4D04-BADA-D84870380A80}
  

This UUID in the parent's command line can be found in the registry. It is associated with the name "Shell Create Object Task Server". Using the registry tracking in Process Monitor, I see DllHost loads shell32.dll, located via HKCR\CLSID\{133eac...}\InProcServer32).

=> I think we can identify this parent process, as shell32.dll / "Shell Create Object Task Server", and that it is part of the OS.

Both processes run as the user NT AUTHORITY\SYSTEM. This seems a possible venue of investigation. What is the privileged part of the GUI software doing, that needs to be run in a separate process?

Crash backtrace

After running procdump -ma -i C:\dumps, I am able to capture crash dumps. (procdump -u to stop capturing). The analyzer from DebugDiag is able to open them and run the CrashHangAnalysis:

PID 1160 is an svchost.exe instance for "RPC" and "RPC Endpoint Mapper", according to Process Explorer.

 

Child Account Get Greyed Out

Thanks for the suggestion, but I did the following instead.

I have another laptop, 2 weeks old, with Windows 10 Home on it.

On that one, I tried the same steps with the child account, and got the exact same results.

 

Boot Process

Hi,

Please suggest me a link that can explain the boot process step by step of ...

• Windows 7,
• Windows 8.1,
• Windows 10,
• Windows Server 2008 R2 and
• Windows Server 2012 R2

With Regards

InTech