CIS troubles with ms outlook (office 365 - 2013) [V6]

A. THE BUG/ISSUE (Varies from issue to issue)

  1. Summary - Give a clear summary in the topic subject, NOT here.
  2. Can U reproduce the problem & if so how reliably?: Turning on outlook start receiving the e-mail.
  3. If U can, exact steps to reproduce. If not, exactly what U did & what happened: A week ago, did not have any problems the computer did not come to accept mail imap in outlook.
    outlook mail settings to try again, created a new profile, but it did not work. At any moment, outlook is turned on, the process will continue wermgr.exe created.
    To stop the process to get into the service, the problem did not occur. Windows error reporting service of the process was, and I did not want to stop it.
    Because the problem is something that causes a conflict with the meaning of outlook was, we know the cause because it would be continued.
    Also, other window problem. Will were not to have been updated. After all windows, format, and is now the basic system drivers and browsers, office applications and video player and installed.
    The basic system drivers to install, the security program (nod32, cis) to install, and then installed a Windows update. Finally, testing proceeded to install Office.
    Also had the same problem in outlook. will continue to wermgr.exe were created.
    And to find out the cause, uninstall the installed programs began And found out that the reason is that cis. After uninstall cis, wermgr.exe did not even generated,
    cpu goes up to 20% of the problem was solved.
  4. If not obvious, what U expected to happen: I hope you do not crash again.
  5. If a software compatibility problem have U tried the conflict FAQ?: This is what the problem is.
  6. Any software except CIS/OS involved? If so - name, & exact version: ms outlook(office 365 home premium - 2013 version) / 15.0.4551.1011 version
  7. Any other information, eg your guess at the cause, how U tried to fix it etc: Windows service, see the Event Viewer

EventData

SearchProtocolHost.exe
7.0.7601.17610
4dc0d006
AppvIsvSubsystems64.dll_unloaded
0.0.0.0
515dec46
c0000005
000007feee7f3f08
180c
01cef8add7af25ee
C:\Windows\system32\SearchProtocolHost.exe
AppvIsvSubsystems64.dll
158912b2-64a1-11e3-9076-c860005fe5d4

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)

  1. Exact CIS version & configuration: 6.3.302093.2976
  2. Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: hips - traning mode(enhanced mode), sandbox - disabled, firewall - training mode
    (Even the high setting, the same problem occurs, because the state is deliberately lowered settings.)
  3. Have U made any other changes to the default config? (egs here.): yes
  4. Have U updated (without uninstall) from a CIS 5?: no
    if so, have U tried a a clean reinstall - if not please do?: Already did.
  5. Have U imported a config from a previous version of CIS: no
    if so, have U tried a standard config - if not please do: yes
  6. OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used: windows 7 sp1 64 bit, uac 3/4, admin, v.m - none
  7. Other security/s’box software a) currently installed b) installed since OS: a) nod 32 antivirus b) outpost

[attachment deleted by admin]

Please try reinstalling CIS by following the advice I give in this topic:

Also uninstall NOD32. After restarting, and uninstalling both, run removal tools for NOD32, CIS, and outpost. Links to the removal tools are given in that other topic.

Then, restart and install CIS fresh. Do not install any other security products or change any settings. After CIS runs the quick scan, allow it to restart the computer. Then see if the problem with outlook still happens.

Going through this will allow me to get a much better idea of what might be, and is not, causing this issue.

Thank you.

PM reminder sent.

For the time being I will move this to the Non-Format Verified board.

Topics in this board are rarely looked at by the devs, and even if they are it is unlikely the devs can fix the bugs reported.

To get your report forwarded to the devs please try reinstalling CIS using the approach I advised and see if the problems continue.

If you have any questions please do not hesitate to ask.

Thank you.

Come on guys, use proper grammar! Don’t use the letter U as a replacement to the pronoun you in an official friggin template! Tsk tsk!

A. THE BUG/ISSUE (Varies from issue to issue)

  • Summary - Give a clear summary in the topic subject, NOT here.
    I have the same issue as described in OP. I do not have anything other than (Outlook 2013 or Visual Studio 2013) and CIS running at the times of the searchprotocolhost.exe crashes. It appears to do nothing other than crash for that matter. Uninstalling CIS remedies the issue or removing Outlook 2013 from the indexer.

The way in which I installed followed this guide Comodo Forum

Here is a post I made a couple hours ago before I looked at my event logs. https://forums.comodo.com/antivirus-help-cis/busy-icon-every-couple-seconds-outlook-2013-t100347.0.html

  • Can you reproduce the problem & if so how reliably?:
    Yes I can, very much so.
  • If you can, exact steps to reproduce. If not, exactly what you did & what happened:
    a: Reboot
    b: Log in
    c: Open particular application (Outlook 2013 is definite, I haven’t verified for sure that VS2013 does so as well but does appear to, I also believe that other 2013 Microsoft applications will also do the same)
    what happened: SearchIndexer.exe launches sub processes in particular SearchProtocolHost.exe. Child process terminates, then is re-executed, and continues to repeat that process. What happens in the Windows Event Logs is as follows

Faulting application name: SearchProtocolHost.exe, version: 7.0.7601.17610, time stamp: 0x4dc0d006
Faulting module name: AppvIsvSubsystems64.dll_unloaded, version: 0.0.0.0, time stamp: 0x515dec46
Exception code: 0xc0000005
Fault offset: 0x000007feedb33f08
Faulting process id: 0x2ae0
Faulting application start time: 0x01cefbbc1377e750
Faulting application path: C:\Windows\system32\SearchProtocolHost.exe
Faulting module path: AppvIsvSubsystems64.dll
Report Id: 51424379-67af-11e3-aa20-902b6bfee3b3

This is all quite apparent at the user level as a cursor busy icon appears every other second.

  • If not obvious, what you expected to happen:
    I expected nothing to happen
  • If a software compatibility problem have you tried the conflict FAQ?:
    I have not been able to find it, because all the instances of it being asked show up in search results before the actual FAQ.
  • Any software except CIS/OS involved? If so - name, & exact version:
    Yea lots, too much for me to bother listing it all; especially given that those applications don’t have an issue and aren’t running. As for the services that came with them, there might be a few running but again the issue arises with particular applications actually running.
  • Any other information, eg your guess at the cause, how you tried to fix it etc:
    1.) I’ve tried to fix it using a google search on SearchProtocolHost.exe AppvIsvSubsystems64.dll_unloaded it suggested including the microsoft office 15 directories to my environment variable PATH; I rebooted immediately after my alteration of PATH.
    2.) I also removed Outlook 2013 from my indexer in control panel.
    – Neither thing resolved the issue at the time.
    A) When I put my computer into standby mode and resumed this morning however the issue was resolved. I just rebooted and the issue is still resolved, so these steps fix the issue.

B) I would prefer to have the root cause remedied however, as in whatever part of CIS is causing this issue has a fix applied to it. This is because I prefer to have my inbox indexed so that I can search for old mail easier.

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)

  • Exact CIS version & configuration:
    6.3.302093.2976

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
    It happens with these modules disabled oddly enough. Doesn’t happen if uninstalled however.

  • Have you made any other changes to the default config? (egs here.):#
    Negatory

  • Have you updated (without uninstall) from a CIS 5?:
    No, freshly downloaded 2 days ago. Clean install.
    [list type=lower-alpha][li]if so, have you tried a a clean reinstall - if not please do?:
    [/li]- Have you imported a config from a previous version of CIS:
    No I have not, I am using fresh install configs
    [li]if so, have you tried a standard config - if not please do:
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
    Windows 7 Professional x64
    UAC Disabled
    Administrator
    Not running in a virtual machine
    Lenovo X230 Tablet

  • Other security/s’box software a) currently installed b) installed since OS c) what is it d) is it enabled:
    a=Yes b=Yes
    c= Windows Defender
    d= No, it is disabled

[/list]

C. ATTACH REQUIRED FILES

  • Always attach - Diagnostics file[nobbc], Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)
  • After you have attached the required files to your post please delete this section (section c) from your report.

Thank you. I will move this post back to the main bug reporting section of the forum for processing. Please edit your post so that it is in the format provided here:
https://forums.comodo.com/bug-reports-cis/new-format-draft-do-not-use-yet-being-updated-t90436.0.html;msg651613#msg651613
Just copy and paste the code. Then put your responses after each colon.

Let me know if you have any questions.

Thanks.

Thank you for editing your post. I have a few questions, and some more information is required.

Are you seeing any files being sandboxed? Are there any files listed in your Unrecognized Files List?

Also, please attach the diagnostics report, and the KillSwitch Process List. Please record the running processes while Outlook is displaying the behavior you are experiencing. Attach both of these to your above post.

Let me know if you have any questions.

Thank you.

I apologize, but I’ve been able to resolve the issue while having Outlook indexed. I just wanted to, at least, get the information out there; I don’t have the time to help track down all the information that would be necessary to fixing it. I realize that the issue will probably be put on a back-burner in the guest house’s garage (ie. won’t get fixed) However perhaps somebody will keep their eye out on the development team, or perhaps somebody new will yet again step in to provide the missing info.

Could you please provide some steps for how you were able to fix it? This will be very helpful for others in the same situation.

For greater visibility I will move this to the HELP section of the forum, so that others will be more likely to stumble across it and be able to solve the problem.

Thank you.

Sorry to bump an old thread, but I am suffering from this issue as well, using Outlook 2013 and Comodo 7.0.313494.4115
It is a fresh install of Windows 7 x64 + Office + Comodo, but search crashes with Comodo activated.
I’ve uninstalled Comodo, rebooted the machine, and the problem went away.
I then reinstalled Comodo, set everything to Training Mode, and the problem returned again.

What I’ve noticed: due to this, the People Pane does not work in Outlook 2013 either.
So, somewhere, Comodo seems to be blocking the Search Functionality of Outlook.

Try adding the search process to the exclusion list in behavior blocker.

Tried that, but unfortunately it didn’t work.
I added SearchIndexer.exe, SearchProtocolHost.exe, SearchFilter.exe (I think) and Outlook.exe to all the exclusions possible.

Uninstalling Comodo worked and I have now Agnitum Outpost Free installed, which doesn’t have the problem, I can now actually use the People Pane.
I’m willing to try out other stuff, however.

Hi,

I also had to uninstall Comodo Firewall (7.0.317799) because of this problem.

Search indexer was crashing, and also GASMO (Google Apps Sync for Microsoft Outlook) would not start.

After Comodo was uninstalled, everything started to work correctly.

I dunno what HIPS config these systems are in.

I’m wondering if adding a HIPS rule for it manually and give it God access rights might solve the issue. At the very least, if the rule exists with resource access name permissions = ‘ask’ for everything, should at least get the ball roling, no?

I don’t know what indexer would write to, but it would seem indexer would needs access rights to all folder / files, no?

The fact that these system function w/ out CIS intimates a config issue. I’d try disabling auto-sandbox & HIPS and incrementally tighten the leash until it breaks. What’s perplexing is that there are no alerts. Nothing in the log files either WRT blocking?

I have turned HIPS off completely and it still does this.

now, this problem is still progress. This problem is only “during the receive email” occurs. After that, no matter even if you turn on the service.
The time I wrote this article, I had 2-3 times the window format, and CIS was clean installed. Option was also set by default.

Hi,

same problem here with the actual Version of Comodo Security 7.

I got an entry in the event log every second. And Outlook 2013 isn´t able to generate a Search Index, which is very bad (ever used Outlook without “search”)

From the event log (in German, sorry)
Name der fehlerhaften Anwendung: SearchProtocolHost.exe, Version: 7.0.9600.17031, Zeitstempel: 0x53087ec6
Name des fehlerhaften Moduls: AppvIsvSubsystems64.dll, Version: 5.151.36.0, Zeitstempel: 0x515dec46
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000e0a2c
ID des fehlerhaften Prozesses: 0x1848
Startzeit der fehlerhaften Anwendung: 0x01cfb5a4af8d40a1
Pfad der fehlerhaften Anwendung: C:\WINDOWS\system32\SearchProtocolHost.exe
Pfad des fehlerhaften Moduls: C:\Program Files\Microsoft Office 15\root\Office15\AppvIsvSubsystems64.dll
Berichtskennung: ed5eefe8-2197-11e4-8128-00190e01b803
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

I use

  • Hips in Safe mode
  • Auto Sandbox untrusted
  • Firewall Custom Ruleset.

SSD (C:Partition) will be on around 22% (idle) because “SearchProtocolHost.exe” and a crashfile is written (or tried to be written)
Deaktivating Hips and Firewall (via left click on the "C"comodo Icon in the right corner will not get it working.

Tried to make a “allow group” with Outlook.exe and the both files mentioned in the eventlog and put it in the exclude lists of hips and sandbox and also make them “trusted files” but even this didn´t help. Nothing logs in Comodos logfile

Some advice/hints ?

Regards
Kevin

Try adding SearchIndexer.exe ,SearchProtocolHost.exe and SearchFilterHost.exe to the behavior blocker exclusions.

Found this is help so I moved it here - maybe the same as M1112?

Please see the bug report here. Does this seem like the same issue which you are experiencing?