Edventures in Normalcy

Okay, ran into this issue and had errors in numerous places, errors consisted of 2 Information items in the event viewer:
Faulting application name: cygrunsrv.exe, version: 0.0.0.0, time stamp: 0x40826252
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec49b8f
Exception code: 0xc0000005
Fault offset: 0x00033de8
Faulting process id: 0x1864
Faulting application start time: 0x01ce3154ee337ce8
Faulting application path: C:\Program Files (x86)\OpenSSH\bin\cygrunsrv.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 2be26929-9d48-11e2-a7c5-d4ae52c404bf

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: cygrunsrv.exe
P2: 0.0.0.0
P3: 40826252
P4: ntdll.dll
P5: 6.1.7601.17725
P6: 4ec49b8f
P7: c0000005
P8: 00033de8
P9:
P10:

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cygrunsrv.exe_4970cdd197632cbc7d2bc9ea611f2a78a24963_0ae8a1c9

Analysis symbol:
Rechecking for solution: 0
Report Id: 2be26929-9d48-11e2-a7c5-d4ae52c404bf
Report Status: 4

And an actual error in the event viewer:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: cygrunsrv.exe
P2: 0.0.0.0
P3: 40826252
P4: ntdll.dll
P5: 6.1.7601.17725
P6: 4ec49b8f
P7: c0000005
P8: 00033de8
P9:
P10:

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cygrunsrv.exe_4970cdd197632cbc7d2bc9ea611f2a78a24963_0ae8a1c9

Analysis symbol:
Rechecking for solution: 0
Report Id: 2be26929-9d48-11e2-a7c5-d4ae52c404bf
Report Status: 0

Then in C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cygrunsrv.exe_4970cdd197632cbc7d2bc9ea611f2a78a24963_0ae8a1c9
I find a Report.wer file, once opened I can see this:

Version=1
EventType=APPCRASH
EventTime=130095680084486700
ReportType=2
Consent=1
ReportIdentifier=2be2692a-9d48-11e2-a7c5-d4ae52c404bf
IntegratorReportIdentifier=2be26929-9d48-11e2-a7c5-d4ae52c404bf
WOW64=1
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=cygrunsrv.exe
Sig[1].Name=Application Version
Sig[1].Value=0.0.0.0
Sig[2].Name=Application Timestamp
Sig[2].Value=40826252
Sig[3].Name=Fault Module Name
Sig[3].Value=ntdll.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.1.7601.17725
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4ec49b8f
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=00033de8
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.272.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=b2c5
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=b2c5b5c5ee4f3dfe48897bfbd1f9aa32
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=916c
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=916cf0f8a1374ec2302febca9ee94acf
UI[2]=C:\Program Files (x86)\OpenSSH\bin\cygrunsrv.exe
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=cygrunsrv.exe stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\Program Files (x86)\OpenSSH\bin\cygrunsrv.exe
LoadedModule[1]=C:\Windows\SysWOW64\ntdll.dll
LoadedModule[2]=C:\Windows\syswow64\kernel32.dll
LoadedModule[3]=C:\Windows\syswow64\KERNELBASE.dll
LoadedModule[4]=C:\Program Files (x86)\OpenSSH\bin\cygwin1.dll
LoadedModule[5]=C:\Windows\syswow64\ADVAPI32.DLL
LoadedModule[6]=C:\Windows\syswow64\msvcrt.dll
LoadedModule[7]=C:\Windows\SysWOW64\sechost.dll
LoadedModule[8]=C:\Windows\syswow64\RPCRT4.dll
LoadedModule[9]=C:\Windows\syswow64\SspiCli.dll
LoadedModule[10]=C:\Windows\syswow64\CRYPTBASE.dll
LoadedModule[11]=C:\Windows\syswow64\USER32.dll
LoadedModule[12]=C:\Windows\syswow64\GDI32.dll
LoadedModule[13]=C:\Windows\syswow64\LPK.dll
LoadedModule[14]=C:\Windows\syswow64\USP10.dll
LoadedModule[15]=C:\Windows\system32\IMM32.DLL
LoadedModule[16]=C:\Windows\syswow64\MSCTF.dll
LoadedModule[17]=C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL
LoadedModule[18]=C:\Windows\syswow64\PSAPI.DLL
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=cygrunsrv.exe
AppPath=C:\Program Files (x86)\OpenSSH\bin\cygrunsrv.exe

The fix was to update the settings of the cygrunsrv.exe file:

Go to the C:\Program Files (x86)\OpenSSH\bin\ path and right click cygrunsrv.exe.

Go to Properties

Go to Compatibility

Click ‘Change settings for all users’

Check the box for ‘Run this program in compatibility mode for:’

Set the dropdown to ‘Windows Server 2003 (Service Pack 1)’.

Save your changes and you should now be able to start the service.

cygrunsrv_Compatibility_settings

2 Responses to “Faulting application name: cygrunsrv.exe, version: 0.0.0.0, time stamp: 0x40826252 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec49b8f”

  1. AnitallicA

    Awesome! Very helpful, I’ve been searching for almost an hour.. thanks!

  2. Nelson Silva

    Yep, that did the trick. Thank you.

Leave a Reply

 

Copyright © Edventures in Normalcy. All rights reserved.