I posted a comment about this a couple of weeks ago and now I am on 108.0.1 on Win 10 Pro/32 and it is still happening.
I now run task manager all the time and as soon as Firefox stops responding, but before it has crashed I see that a process called "service Host: Local System (Network restricted) (10)" is hammering disk usage to 100%. Even when there is hardly any total disk activity, task manager is also showing 100%, so this might be a red herring.
I have used the Microsoft tools to check if the disk is healthy and it indicates a healthy disk. What next ?.
I am going to try and disable the anti virus program at some point to see if that is the real culprit.
Paul posted a long reply last time referring to various aspects of Windows that might indicate the problem but I just use it as a black box, delving into the intervals is above my skill levels where windows in concerned.
Something else I have noticed is that there are several Microsoft Edge processes running even when I am not even using Edge ??. I keep it on the bar at the bottom of the screen and just click on it to power it up as as when necessary.
service host is a generic container for what nowadays consists of about a zillion windows services, you need to see what actual service is running inside which service host (several can share a process)
The SysInternals ProcExp can help you see what is what, better than task manager does, download the 32 or 64 bit version as appropriate, still takes some digging though ...
formatting link
(it's safe they're the good-guys section of microsoft)
Ok, got that. Lots of pretty colours and many svchost.exe processes running none of which I understand.
Firefox seems to use a lot more memory than Edge and something called endpointprotection.exe uses as much as Firefox but the description is blank.
CTRL-I offers some tabs, one of which is memory where a green box headed System shows 4.3 GB and below it is a Salmon pink box headed Physical memory but that only show 2.1 GB. I thought I had 4 GB ??? or is this the physical memory being used ?
while I was faffing about Firefox 109.0 crashed.
The MEM tab from above shows -
Physical Memory (K) Total 2,881,076 Available 603,476 << after FF crashed became 1,449,226 cached ws 22,624 Kernal WS 0 Driver WS 4,300
If I fire up Edge then 'Available' only drops to about
990,000 bytes. Maybe it is time to stop using Firefox.
I have 2x2 GB DDR3 slots occupied and two free at the moment.
I am reluctant to add more memory because it is my intention to switch to an Apple mac mini at some point.
Yes, the greeninh graph normally shows you're using more virtual memory you actually have, since some is backed by files (either awap files or the .exe/.dll files that stuff is loaded from) mine is showing nearly
18GB but I only have 16GB
Yes, the pinkish graph ought to show less than you have, that's how much is physically in use, mine shows 10G out of my 16GB is used.
If you click File/ShowDetails for all processes, you can get a handles tab at the bottom, that includes all files opened per process
also useful is to View/Select columns and add the I/O bytes read and writted, then sort by these columns, which will show the "greediest" disk using processes ... is one of those your service host? right click and properties will tell you which service(s) ar in that service process host.
firefox and thunderbird can be quite greedy on memory, I'd say it's got better in the last few months with background tabs not retaining as much memory as they used to.
Might be worth posting this to the bug tracker at the web site, since if nothing else is crashing, it might just be some weird interaction between some otherwise benign software. Brian
Is this a 32 installation of windows or a 64 bit? I would, if possible tell anyone who can to run 64 bit Windows, as I had no end of problems like this before I did. Obviously depends on the hardware of course.
I am wondering if all the latest versions of Firefox are putting a strain on a Win10 machine with 4GB of main memory (and being 32 bit only ?3 are used).
A Software Development Kit or SDK, means a third party (another AV company) may purchase the materials and use them in a product. While the most likely explanation is that a copy of Avira is on the computer, a less likely explanation is that another company is using that SDK. AV signature engines can also be purchased, such as F-Secure using a BitDefender signature engine.
*******
I think I recommended checking the Health Report, because it would have a crash summary prepared from the .dmp . This may save some faffing about.
perfmon.exe /rel
In this picture, I demonstrate analysis of a crash, using my very own crashing program "crashzero.exe". I think what I try to do, is dereference location zero in the address space, which likely does not belong to my program. I have been a bad monkey. I use this program, while "tuning" Windows releases and verifying they've stopped sending Dr.Watson to Microsoft and instead are leaving a .dmp for me.
formatting link
control panels : security and maintenance : View Reliability History : Click entries near bottom...
The C0000005 error, can be decoded with a program like this from Microsoft. Presumably this program, eats all the header files that define error numbers, so we will have a reference to those errors. In the sample output, the error number may appear in multiple headers, and you make your best guess as to which is closest. Since I do not own location zero in the memory, ACCESS_VIOLATION makes sense to me.
formatting link
Err_6.4.5.exe c0000005
# for hex 0xc0000005 / decimal -1073741819 ISCSI_ERR_SETUP_NETWORK_NODE iscsilog.h # Failed to setup initiator portal. Error status is given in # the dump data.
STATUS_ACCESS_VIOLATION ntstatus.h <====== Bad monkey, bad.
The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
USBD_STATUS_DEV_NOT_RESPONDING usb.h # as an HRESULT: Severity: FAILURE (1), FACILITY_NONE (0x0), Code 0x5 # for hex 0x5 / decimal 5 WINBIO_FP_TOO_FAST winbio_err.h # Move your finger more slowly on the fingerprint reader. # as an HRESULT: Severity: FAILURE (1), FACILITY_NULL (0x0), Code 0x5 ERROR_ACCESS_DENIED winerror.h # Access is denied. # 5 matches found for "c0000005"
At this point though, we have no idea what happened, and the very first thing is to prove there is a red entry on the Reliability report for the crashed Firefox.
*******
Firefox consists of multiple processes. I've pared this list down to what I suspect are the components. One of those containers would handle a Youtube movie while you viewed it. If the Youtube movie crashed, the rest of the Firefox processes continue. If the parent Firefox crashes, the others might go away (eventually). They have some communications scheme between them, which on Windows, won't work the best (in the past, Firefox was slow to close). The usage of containers, is to make the browser less exploitable. In addition to containers, Firefox now contains a stack analyzer, which is a kind of AV subroutine in the sense that it checks for a particular kind of attack.
PID TTY TIME CMD
71 pts/0 00:00:24 firefox 226 pts/0 00:00:01 Privileged Cont ainer 282 pts/0 00:00:00 WebExtensions 373 pts/0 00:00:02 Isolated Web Co ntainer 429 pts/0 00:00:00 Web Content <=== open enough tabs, another 462 pts/0 00:00:00 Web Content <=== one of these will sprout 492 pts/0 00:00:00 Web Content
MSEdge also uses multiple processes. As does Chrome or Chromium.
There are two versions of MSEdge. One version is a web browser. The second version is a "web engine" for things like help dialogs. If the EU said that Microsoft had to remove their browser, they would remove the MSEdge browser, but they would leave the "web engine" since it is not customer facing. The "web engine" is for usage of the software.
Both of those could be running, on their own. Sometimes Microsoft "warms up MSEdge.exe on the runway" for takeoff. But more normally, just the web engine is sitting there, waiting for work to be handed to it.
HomeOwnersHub website is not affiliated with any of the manufacturers or service providers discussed here.
All logos and trade names are the property of their respective owners.