appcrash since last program update: stopservice.exe

I don’t know if this is a bug, but at least it is an issue:

Since a couple of days, during booting Windows 7 an appcrash occurs:

Booting takes a couple of minutes extra until the pop up occurs. It is in Dutch but most may have seen this in English before:

(stopservice) has stopped working
=>check online for a solution and close the program
=>close the program

After chosing either of the options Windows completes the boot-up.

stopservice is located in:

Checking the certificate it shows it is from Comodo Security Solutions.

The exe is present since october 4. I think there was a Comodo program update right that day. Nothing to be found on the web about it.

The questions that rise:
What is this exe for?
How can I solve this?
I my machine completely protected until it is solved?

It is Windows 7 Ultimate x64 .

I cannot find it on my Win 7 SP1 x64 Ultimate. Could you upload the executable to VirusTotal and post the url of the report here? There are multiple mentions of programs using a process called StopService.exe.

What publisher do you see when looking at the Name of the signer in the Digital Signatures tab of the Properties op stopservice.exe? Do you see Comodo there? Can you post a screenshot? Do you have Comodo Internet Security Essentials installed? I don’t have it installed.

The virustotal crowd says it is clean:

Certificate of stopservice.exe, sorry low res:

In C:\Windows\SysWOW64 there are also present:
Both also created october 4, the day I think there was a (small) Comodo update. The update did not require a reboot I remember.
No other programs were installed or updated that day

As far as I know, Comodo Internet Security Essentials is not available as an installer, only zipped, so runs portable and would not leave any traces after running. (Correct me if I’m wrong). However, Comodo Internet Security Essentials is not present on this machine, and has never been run on it.

The machine is allways run with care. I mean, has not been online without firewall, alle browsers are run within a sandbox (sandboxie) etc. etc. I make an image after installing and unpack it every 6 months or so, which in fact is a fresh install. . It hasn’t been running a lot since the last time. After booting up the first thing I do is download my updates if there are any. It’s been 15 years since I had mallware on my pcs’s.

You say you do not have stopservice on your machine. I also have a stopservicelauncher.exe in C:\Program Files\COMODO\COMODO Internet Security. Could you check if you have that? If you do have it, it could be you are not using a function of CIS that initiates the stopservice.exe in C:\Windows\SysWOW64?

Also stopservicelauncher.exe is clean according to virustotal.

It belongs to CIS. I did a clean install of CIS and got an update in which the files got added. That mystery is now solved.

Could you post the crash dump? It may be found in C:\ProgramData\Comodo\CisDumps.

C:\ProgramData\Comodo\CisDumps is empty on this PC. No crash dump there.
(I checked on another machine Running CIS in my household and that one is empty also).

There are warnings in the stopservice.log file though: “Warning: GetModuleFileName(…) returned : 35”
Whatever that may mean.
These warnings dwell between a lot of lines like thes few:
Info: using Win_x64 path for version
Info: version is :58 under V58
Info: using Win_x64 path for path
Info[openRegKey]: success opening registry key
Info: Success writing key for script restart if needed.
Info[openRegKey]: Success closing key.
Info: initializing script at: 01:39:36.151

Then there is: stopservicelauncher.log
It only containes 2 lines:
“Success: script was launched!
Info: exiting now”

Can’t you put up your service.exe for download on yousendit or somewhere so I can replace mine? Maybe it is just my .exe that is missing a bit or a byte.

edit: this is the SHA-256 hash of my stopservice.exe:
Could you compare with yours?

The default tool I use to check hashes does not provide SHA256 but only goes to SHA1. stopservicelauncher.exe" 9737DEAFA1F01822D1376D1C0BF4C5124721BA5C. This is the file in the CIS installation folder.

I have the stopservice files, these files seem to be introduced in an update to .6710. Apparently they seem to be something related to Comodo Dragon, try uninstalling Comodo Dragon if you have it to see if it is the culprit. I don’t have Comodo Dragon installed and I’m not experiencing crashes from any of these stopservice files.

Your stopservicelauncher.exe matches with mine.

You didn’t say you now have the stopservice.exe as well. The SHA1 hash of mine is:

Remarkable, no Comodo Dragon is running (or has been running) on this machine.

The SHA1 of stopservicelauncher.exe in the SysWOW64 folder is CF849DA399127C160A6E3DB890661FFD8BF420FB.

I have Dragon installed also on Win 7SP1 x64 Ultimate and I am not seeing crashes. It is must be somethinh specific for his system.

SpaceIndian. Can you check in the following folder if you see crash report for stopservicelauncher.exe: C:\Users%username%\AppData\Local\CrashDumps?

Hi SpaceIndian,

Sorry for the trouble caused.
Please check your Inbox and provide the requested logs for investigation.

Thanks in advance.

Kind Regards,

Hi All,

This is related to a defect detected in Comodo Dragon updater in earlier versions.


I found out Chromodo had been running on this PC. It has been removed some time ago.
There is still a Chromodo Folder in:

Would the issue be over if I were to simply remove stopservice.exe?

And if so, what about:

I checked another machine that has been running Comodo Dragon. None of the stopservice* files are present. It is completely offline for the moment and has not received the latest updates yet.

You can fix the issue with the following:

Run regedit and locate


And delete the key:


Let us know if this solved your issues.

NOTE: Please use regedit with extreme caution

There is no such key present:

Do you know what this .exe does? Wouldn’t the issue be over if I were to simply remove stopservice.exe? Then there still would be stopservicelauncher.exe in C:\Program Files\COMODO\COMODO Internet Security. Why is it there if stopservice.exe belongs to Chromodo/Dragon?

You need to expand the currentversion key and find and select the runonce subkey to remove the auto-start entry if it exists.

I missed when printscreening :slight_smile: But there is no such key:

If there is no key present, a system reboot should solve the issue.

Can you tell me if you still see a system slow start after reboot?

I put up a post here about the issue.;msg881725#msg881725


Well, the system gets shut down every day, and rebooted every next day. So today I rebooted the fifth time since stopservice.exe is present. The symptoms have not changed during and after those reboots.