Access Violation in msched.exe at shutdown of Windows 7 x64

[alan1mtnview]

Hi, folks.
This has been driving me bonkers, and I've tried everything that I can think of without success, so I'm putting it to the big brains here.

Problem: If I edit ANY already-existing script I get an access violation:"instruction @...the referenced mem could not be read" when I shut down the PC. If I don't make any script changes, I don't get the error. I can run any script I try with no problem as well. If I create and save a new script, I get the error, but if I just compile an existing script, I don't. (IF I don't make any changes to the compiled settings!)

The first half of the address varies from login to login (I've seen "74A8", "74B5", "73FD" this morning), but the second half is always "51D3." I'm on MS 11.1.15. I've been on Windows 7 RTM since the day after it was released to MSDN subscribers, and until a couple weeks ago, everything's been fine.

PC: Thinkpad W500, 2.80 GHz dual-core, 4GB RAM, 512 MB ATI graphics, Windows 7 Ultimate x64 RTM fully patched. I have all the latest Lenovo drivers, and Device Manager shows no problems. AVG 9 antivirus, MalwareBytes Anti-Malware, SpywareBlaster have never reported anything. Aero glass is fully enabled (I like the pretty borders and effects. There, I said it). The sidebar is disabled from msconfig.

Major Software: Visual Studio 2008 SP1; SQL Server 2008 SP1 (None of the services here are running-I use it for report writing and SQL editing); Photoshop CS4; Office 2007 SP2. All of these were loaded before MS as part of my normal system build.

What I've tried so far: Removing/swapping/swapping ports for the flash drive I use for Readyboost (It actually works in 7!); MS uninstall, delete script and prog folders, delete all MS-referenced reg keys, then a clean re-install; moving script folder from c:\users\username\my documents\ to c:\programdata\; setting ownership and permissions as loosely as possible on script and prog dirs; Enable and Disable UAC (normally disabled); Verified all needed services are running (I typically turn off several services as part of my normal config); checked for locked files using Process Explorer; Googled all of the memory addresses referenced for something that might spark an idea; Loaded MS into XP Mode (works fine, no errors at all); System Restore'd a couple of times to different points that I know MS was fine at; Everything short of a clean re-install as this is my main (read: only) workstation with any horsepower and I can't have it down for any length of time for the next few weeks.

I know that's a lot to go through, but I wanted to cover everything I've tried and to respect Marcus' wishes from his "Crystal Ball" post.

I appreciate any advice y'all might have.

[Marcus Tettmar]

Alan,

I've been running Windows 7 ultimate x64 since RTM also and have never experienced this, and of course I'm editing Macro Scheduler scripts all the time.

I'm assuming the error is in Macro Scheduler? You say it occurs on shutdown but is it a Macro Scheduler error or outside of Macro Scheduler? What happens if you exit Macro Scheduler before attempting to shut down Windows?

Probably the best thing we can do is send you a special debug version of Macro Scheduler which will give us a stack trace. Please PM me and I'll get that set up for you.

[alan1mtnview]

Thanks, Marcus. PM on the way.

You running 7 x64 for as long as you have with no issues at all is what has me so bumfuzzled (a southern U.S. technical term). I didn't see recent posts about any access violations without a macro at least running or being edited, either.

To answer your questions:
It is in msched.exe
It's outside of MS, and it looks like everything else has been shutdown, and explorer itself is about to close when it occurs.
If I exit MS manually before shutdown, I don't get the error.
Also, I should add that I have the Security Center, Windows Firewall, and Windows Defender disabled.


I'm considering making a vhd out of my current install and running it from Virtual PC, but I don't know if it's possible to run a 64-bit OS from there.

[alan1mtnview]

With Marcus' help I was able to track down the cause of my crashes:
At shutdown, if I canceled the request to force the shutdown, I was brought back to the desktop, but several background/tray apps were no longer running. I made a script change, tried a shutdown, and no error.
After a clean boot, I made a couple more script changes, then killed my tray apps one at a time until I narrowed it down to Ultramon.exe. Then, using Process Monitor and Process Explorer from Sysinternals, I looked for what files/keys/hooks the two had in common and found an Ultramon dll for adding custom commands to a window's title right-click menu. I disabled that option for msched.exe from within Ultramon, and have had no errors since.
Macro Scheduler cleared again.