CIS and BSOD at boot only

Comodo Internet Security - CIS Install / Setup / Configuration Help - CIS
1

Hi,

could you please verify if the bsod today was caused by comodo 10.2.0.6526 (the latest build available here) ? because just after the automatic reboot (after the bsod with automatic data collection) I saw on desktop the “comodo warning window” with “comodo has crashed, do you want to send a report. yes” (the minidump has been sent).
I add the usually requested infos here (event dumps too):
https://www108.zippyshare.com/v/RYQH29CQ/file.html

thanks a lot, Best regards

2

Hi Anuswara,

Can you please try the latest CIS 6728 and provide the feedback.

Thanks in advance.

Kind Regards,
PremJK

3

Why autoupdate tells me that 6526 is the latest build?
what driver is reported as problematic in my dump? thanks.

4

11.0.0.6728 now.

1)After boot: do not check for AV defs update: all is ok.
2)After boot : do check for AV defs update: BSOD.
3) If after 2) all is ok, then the whole day is ok (with other manual updates search).

Thanks for analyzing the complete “full memory dump” (rar compressed) collected at the OS auto-reboot, after the BSOD that happens during the task “manual check for AV updates” (i.e. “NOT check for cis updates = no BSOD”).
https://www9.zippyshare.com/v/G1hmnDCz/file.html
(“one month” link)

Best,

5

Hi Anuswara,

Thanks for reporting.

Please check your Inbox for private message and provide us the requested dump.

Thanks in advance.

Kind Regards,
PremJK

6

Hi, thanks for your reply and for analysis.

The dump of 5.12.2018 (2.99GB) was generated with following settings (more complete than that it seems not possible here):

Addendum:
a “workaround” (working since 6.12.2018) to the BSOD during the first CIS update of the day:
after boot the small icons start to appear in systray, ok, you have now to wait 8-10 minutes before searching for CIS updates. The less minutes you wait, the bigger the possibility of BSOD (or OS total hang, without dump).

7

Hi Anuswara,

Can you please share that dump in any online storage like mega.nz or dropbox and share us the download link.

Will forward those dumps to developers for investigation.

Thanks in advance.

Kind Regards,
PremJK

8

Hi friend,

here is it:
https://drive.google.com/open?id=1K16v0cn1XO7E4rmUeKBM4yzEQ6KLMbxc

or direct
https://drive.google.com/uc?id=1K16v0cn1XO7E4rmUeKBM4yzEQ6KLMbxc&export=download

thanks a lot.

9

Hi Anuswara,

Thank you so much for taking time in providing the requested dump. Forwarded the dump to our developer for investigation. We will get back to you.

Kind Regards,
PremJK

10

Hi PremJK,

here another, up to date, full BSOD dump (RAR compressed); I guess the same (still unknown) problem:
https://drive.google.com/open?id=1htDig80888use2nMltIgnFh2thiZGUox
https://drive.google.com/open?id=1506smykX5vF5cBfPcfPTHyhUq1e86YAI

thanks.
Best,

11

ohhhhhhhhhhhhhh :frowning:

Surely CIS is involved, see here the clear message:

CIS preduced exactly this log:
https://www22.zippyshare.com/v/1HEk9mpF/file.html
(I hope that CIS dump may be very helpful)

and needed to re-download 400MB defs!

I add other files (cmdinstall, eventviewer so you can see what happened, memory dump: for “full” memory dump please see the previous message with link to google drive, thanks):
https://www82.zippyshare.com/v/iUVWkCum/file.html
https://www105.zippyshare.com/v/26SdQ4an/file.html

I warmly hope that this very big problem (the FIRST “search for defs updates” after the boot) can be understood by engineers.
Thanks.
Links to zippyshare active for one month (!)

PS: running CMD as admin:
sfc /scannow
CBS.txt
ZERO ERRORS, nothing that need to be repaired on this system!

Happy new year! (with less BSOD and CIS crashes at boot?).

12

Do you have Intel Matrix Storage Manager installed? Also can you run fltmc from an elevated command prompt and list the output of that command?

13

Hi, your purpose sounds very interesting.
Yes, you are right, I see this Matrix untitled3 — Postimages
always ignored by me.

Here the requested output Matrix:

[[
and here, just as comparison, the same task from my Vista+CIS laptop without problems:

]]

Maybe this Matrix sw bothers CIS during the boot process?

Thanks, Best

14

If you don’t have any use for it, I would uninstall it and see if you can still cause BSOD, if no crash then keep it uninstalled if you don’t use it. If it is required try to find an updated version from either your computer manufacture website or get the latest version from Intel. Another user has it installed that also causes BSOD on boot after performing an AV update of CIS. Is your OS Vista as well?

15

Yes, Vista here.
The driver (even if I dont use Raid) cannot be unistalled, even as admin because it is a system driver “always in use”.

https://downloadcenter.intel.com/product/55005/Intel-Rapid-Storage-Technology-Intel-RST-
here I see 2007 and 2009 driver (i.e. not updated), the problem with CIS update after boot arised, I guess, 2015…it was the 8th december (2015?) update, when you introduced support for w10, according to your official changelog.
How this driver interact with CIS is a mystery, another mistery is that this driver is on laptop too, without issues.

https://downloadcenter.intel.com/it/download/12528/Driver-RAID-Intel-Matrix-Storage-per-Windows-
https://downloadcenter.intel.com/it/download/18314/RAID-Intel-Matrix-Storage-Manager-Driver-per-Scheda-Intel-per-workstation-WX58BP
the exact name of my motherboard is not listed in dxdiag.exe hmmmm, I am a bit confused what to do.

It is strange that the driver is corrupted for some time, then it is not corrupted for 3 months.

16

Try booting into safe mode and uninstall from there, I just know that it is a cause of many BSoD as other reports found through goolge search indicate.

17

Hi anuswara,

Thank you for providing us required logs and dumps, but unfortunately it seems that dumps are not fully collected, because the part of required data is absent in the dumps.

Could you please configure the system to collect Full Memory dumps during BSOD.

Here is the steps:

Note: Please make sure you have enough disk space before you proceed.

i. Run > regedit
ii. Go to : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
iii. Manually set the CrashDumpEnabled registry entry to 1
iv. Restart computer system

Then upload full memory dump to any online storage and share us the download link (after next BSOD)

18

@futuretech: not allowed, I tried in Safe Mode too.
@Metheni: as said, that is exactly what I did: regedit value to “1” , reboot, and full memory dump uploaded on google drive;
here what I posted on 25th december here: the FULL dump (2.99GB):
https://drive.google.com/file/d/1htDig80888use2nMltIgnFh2thiZGUox/view
Metheni, the “minidump” I posted on December 29, 2018, 07:26:39 AM was offered here just to indicate the dump collected and produced by “Comodo itself” during its crash :wink:

!]]
Please pay attention that always when CIS installs defs update, the regedit value changes “automatically” into 2 or zero value! Therefore, before EACH shutdown, I switch it manually (every evening: I have the regedit shortcut on my desktop!) into “1” for collecting always the required full dump, if it happens.
!]]

@all:
short summary:

  1. this BSOD arised after the CIS major upgrade from 8th December 2015.
  2. from 5th June 2018 until 28 november 2018 all was ok, every day! (a big mistery)
  3. Intel people says “we dont know well Comodo sw therefore we are unable to make ameliorements for better compatibility with Comodo”, then they offer these (OLD!) drivers Supporto per memoria e storage(Intel%C2%AE%20RST
    as you see 2007, 2009, I have 2009. They add “Intel Matrix Storage does not exist, perhaps do you mean Intel Rapid Storage Technology?” No dear Intel, I mean just what I wrote.
  4. Comodo (if I understood right) says “the CIS crash (and eventually the BSOD) its due to Intel Matrix driver only, not to Comodo sw”.

Question:
what should the patient user anuswara do now?

  1. to try installing other sw antivirus/firewall if they may result “more compatible” with Intel Matrix Storage at boot?
  2. to change OS (and therefore printer, bluray burner, scanner, router, UPS sw and therefore the whole UPS…)?

thanks.

19

Hi anuswara,

We are working to find the reason for BSOD. We’ll get back to you as earlier as possible.

Thanks,
Metheni R

20

I warmly thank you Metheni, much appreciated.
Best,