Author Topic: Firewall causes AeLookupSvc crash (exception 0xc0000008 in ntdll.dll Windows 8)  (Read 4245 times)

Offline marfalk

  • Newbie
  • *
  • Posts: 2
Hi all,
I apologize for the long post, but I hope that by giving more details I'll help to understand the issue and eventually solve it.

I've been using CIS Firewall on Windows 7 (32 bit) for almost 4 years and never had a issue. A few months ago I bought myself a new notebook with Windows 8 (64 bit) preinstalled. Since day one I installed CIS 5.12.

Ever since AeLookupSvc (Application Experience Lookup Service version 6.2.9200.16420) started crashing at least once a day. Event ID 1000 is reported in windows event viewer, exception code is 0xc0000008 in ntdll.dll and offset is 0x0000000000004c39, the application is svchost.exe_AeLookupSvc.

What I've been able to determine so far is the following:
- I've been using my system for over a week WITHOUT CIS installed and never got the AeLookupSvc issue.
- When AeLookupSvc is in the stopped state (not running) the issue never occurs.
- AeLookupSvc is automatically started and stopped by windows whenever needed (e.g. clicking on a "startup.exe"); tipically after AeLookupSvc is started, it runs for 10 minutes then it is stopped; that's the moment the issue might occur, those times it does, it is always during the running --> stopped transition.
- A few days ago I upgraded to CIS Firewall to 6.3.297838.2953 version, but the issue still occurs.

Whenever AeLookupSvc crashes, all the other services "owned" by the same svchost.exe instance are stopped and then restarted (as reported in windows event viewer, that is about 15 services), so that's quite annoying.

Is this a Comodo Firewall known issue? Any way to solve it?

Thank you in advance
« Last Edit: November 02, 2013, 07:16:15 AM by marfalk »

Offline SunViolet

  • Newbie
  • *
  • Posts: 1
Same problem too! Please, help! Win 8.1 x64 CIS 7.0.317799.4142

Offline Soynice

  • Newbie
  • *
  • Posts: 1
the problem too!
Win 8.1 x64
CIS 7.0.317799.4142
----------------------------------------------------------------------------------------------------------------------------------------------
Faulting application name: svchost.exe_AeLookupSvc, version: 6.3.9600.16384, time stamp: 0x5215dfe3
Faulting module name: ntdll.dll, version: 6.3.9600.17114, time stamp: 0x53649e73
Exception code: 0xc0000008
Fault offset: 0x000000000009cbea
Faulting process id: 0x214
Faulting application start time: 0x01cf85f61016e657
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: e8c9ee6f-f1ee-11e3-8276-b870f43febfd
Faulting package full name:
Faulting package-relative application ID:

---------------------------------------------------------------------------------------------------

Offline xaudiox

  • Newbie
  • *
  • Posts: 12
I am having this issue with latest Comodo firewall aslo win 8.1 x64.
Have removed comodo until this has been resolved as the AeLookupSvc crash causes multiple other errors.
All is normal with Comodo removed.


Offline EricJH

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 24579
Try adding AeLookupSvc to the exclusions of Detect shellcode injections (i.e. Buffer overflow protection) and see if that makes a difference.

Offline xaudiox

  • Newbie
  • *
  • Posts: 12
AeLookupSvc path to exe is : C:\Windows\system32\svchost.exe -k netsvcs
there are multiple svchost.exe in the list, also hips was already off.

I have added the dll file (aelupsvc.dll) to the exclusions, will test.

UPDATE, still the same, i have now unticked "detect shellcode injections" cannot see it making any difference because HIPS is off.
UPDATE AeLookupSvc still crashing.
« Last Edit: December 22, 2014, 04:31:29 AM by xaudiox »

Offline Cimba

  • Comodo Loves me
  • ****
  • Posts: 181
I noticed the same problems for a long time and now, I found this thread over Google.

Are there any new solutions about this problem?

 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek