Jump to content
exile360

COM Surrogate has stopped working [trying to view image in MS Picture Viewer; gdiplus.dll indicated]

Recommended Posts

Greetings,

I was hoping to get assistance with this issue. Here are the contents of a typical problem report when this occurs:

Problem signature:

Problem Event Name: APPCRASH

Application Name: DllHost.exe

Application Version: 6.1.7600.16385

Application Timestamp: 4a5bca54

Fault Module Name: gdiplus.dll

Fault Module Version: 6.1.7601.19054

Fault Module Timestamp: 56390374

Exception Code: c0000005

Exception Offset: 00000000000591f3

OS Version: 6.1.7601.2.1.0.256.1

Locale ID: 1033

Additional Information 1: bdb8

Additional Information 2: bdb86a6ed6f48f6bb3505b92a6e26720

Additional Information 3: 3c9f

Additional Information 4: 3c9f16c920b681ed2a3c8faefdb231ea

For the past few days or so I've been receiving this error quite frequently (though not always) when attempting to view images in MS Picture Viewer (double-clicking on an image file). The error typically pops up 2 or 3 times, then I can attempt to open the image again and it typically succeeds.

I'm running Windows 7 x64 SP1, fully patched.

As far as I've been able to determine so far this error is caused by an access violation in memory, possibly related to DEP. While I could probably exclude DLLHost.exe from DEP to eliminate the errors, I'd rather not take any such action which might compromise the security of my system. I also did a filesystem search for gdiplus.dll and discovered that I have recent copies under various locations in WinSXS which are dated 11/13 which I believe is the date that all of this started. This tells me that a Windows Update was likely the culprit however I cannot find any updates that were installed on that day save this one which, while it may be related, is probably best left installed:

Security Update for Windows 7 for x64-based Systems (KB3097877)

I might try uninstalling/reinstalling it to see if that resolves it, but before I do I'd like to get input from one of the more seasoned experts around here as to whether that is/might actually be the cause or not.

dllhost.rar

Share this post


Link to post
Share on other sites

The Exception Code: c0000005 is an Access Denied violation.

From my webpage here - http://www.carrona.org/ntstatus.html

// MessageId: STATUS_ACCESS_VIOLATION
//
// MessageText:
//
// The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
//
#define STATUS_ACCESS_VIOLATION ((NTSTATUS)0xC0000005L) // winnt

It implies nothing else, so assuming DEP may be dangerous.

In most cases, when I see it, it's due to a corruption (but I mostly see it when 3rd party software is involved)

And, in most cases, an uninstall/reinstall will clear the corruption and fix it.

 

Have you tried reregistering gdiplus.dll?
Here's an article about reregistering dll's: http://stackoverflow.com/questions/4897685/how-do-i-register-a-dll-file-on-windows-7-64-bit

Also, as this involves Windows files, I'd also try sfc.exe /scannow from an elevated (Run as administrator) Command Prompt\

 

Finally, it's possible that this is a "glitch" and Windows may end up replacing it with an updated version (if their error reporting and correcting processes deem it to be an issue).

I mention this because you have isolated this to a date when the problems started happening.

It's still possible that this is related to 3rd party software - but we'll need a lot more reports to confirm that (and, FYI, I'm not real comfortable working in the user space - I'm a kernel space kind of guy).

 

Let's try looking at these reports:

1)  Please provide this information (even though you may not be reporting BSOD's) so we can provide a complete analysis (from the Pinned Topic at the top of the forum):  https://forums.malwarebytes.org/index.php?/topic/170037-blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

2)  Please do the following:
- open Event Viewer (run eventvwr.msc from the "Run" dialog)
- expand the Custom Views category (left click on the > next to the words "Custom Views")
- right click on Administrative Events
- select "Save all Events in Custom View as..."
- save the file as Admin.evtx
- zip up the file (right click on it, select "Send to", select "Compressed (zipped) folder")
- upload it with your next post (if it's too big, then upload it to a free file-hosting service and post a link here).

Lastly, search the system for files that end in .dmp and .?dmp

I'm looking for those to try and find any crash dumps from the application that crashed - to see if the dumps contain any additional information.

Share this post


Link to post
Share on other sites

I tried registering gdiplus.dll shortly after posting this topic, however I received an error message that it was 'registered successfully but the entry-point DLLRegisterServer was not found. Make sure that gdiplus.dll is a valid DLL or OCX file and try again.' I tried it once more just now and received the same error.

I do believe I figured out the cause and hopefully have now resolved it, though only time will tell. I use a custom theme of my own creation which includes a modified copy of imageres.dll (to replace the default folder icons). I noticed that shortly after having modified/replaced that file, the issue started. I just realized that while I did correctly modify/replace the copy of imageres.dll located in System32, I forgot to do the same for the x86 copy located in SysWOW64. I've now done so and I'm going to reboot and test it out to see how it goes. Hopefully the error will not occur again.

Share this post


Link to post
Share on other sites

Well, that didn't work unfortunately. I hate to say it but it's possible that I've corrupted something irreparably in all of these system modifications to the theme that I've made or perhaps one of the third party tools I'm using (like WindowFX) is causing it. I'll continue tweaking things to see if I can work it out and if all else fails I'll revert back to the original stable system files and start modding my theme again, one component at a time until I find the culprit then I'll either skip making that change this time around or make sure that when I do make it, I do so in such a way that it avoids this corruption.

Of course it could be a simple matter of having pushed my GPU too far since all I have currently is an onboard/integrated Intel GPU so maybe it has trouble keeping up with all of the graphical elements it's being called on to render.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.