Svchost got attacked ?

Hi,

Can someone check their Windows 10 Home Creators Update Event Viewer ? I have an application error Event ID 1000 in the Application Log. The faulting application name is svchost_AppReadiness. and the faulting module is ntdll.dl

It might have occurred during a Windows Update but the log entry was on Aug 3, 2017 a few weeks ago so I can't remember what I was doing then.

I was doing Windows Update on another Win10 Home machine yesterday, and the same error occured.

If I can get a member to verify for me that this error also occured on their machine, then I need not worry. Simply create a filter for Event ID 1000 and Application log.

 

Event 1000 = crash
AppReadiness
https://answers.microsoft.com/en-us...n/52d5f0a9-c0e8-4c65-82cb-7184bc1e3034?auth=1

its just an app which crashed, whyever.

 

I have seen it too after installing a windows update some time ago, the service of AppReadiness has crashed.
There is nothing to worry about

Code:

analysis of the dmp-file in the CrashDumps-directory (svchost.exe.[xxx].dmp)

FAULTING_SERVICE_NAME:  AppReadiness
FAILURE_PROBLEM_CLASS:  SVCHOSTGROUP_AppReadiness_HEAP_CORRUPTION

 

Hi mood,

Yours is different from mine. My Event ID 1000 was for svchost_AppReadiness. Maybe they are the same, as yours probably happened when it was a different Windows version & build. Was yours a Event ID 1000 too ?

Hi Brummelchen,

In my experience, applications rarely crash. It could be a buffer overflow. And svchost is network reachable, which makes more of a danger signal. And AppReadiness runs under the System account.

 

Yes, it was. In the Event-log i can see:

Code:

Event-ID 1000
faulting application: svchost.exe_AppReadiness, Version: 10.0.15063.0
faulting module: ntdll.dll, Verson: 10.0.15063.447
... application: C:\Windows\System32\svchost.exe
... module: C:\Windows\SYSTEM32\ntdll.dll

 

Hi mood,

Can you do a Windows update now and see if my error occurs? I re-imaged the HD and just did a Windows Update, and the error is re-occurring. But it could just mean that the attackers attacked again, rather than it being an safe-to-ignore event.

 

Thanks stapp.

What you linked to is the same error as mine. Good to know that it is normal and not an attack. Thanks everyone for their help.