Comodo Firewall causing BSOD

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
1

I am on Win XP SP3. Since I installed the latest Comodo Firewall version 3.5.54375.427, I have had 2 BSOD crashes. When I used WinDbg to analyze the minidump, it names the likely culprit as cmdguard.sys. Is this a known issue?

Here’s a snippet of the details reported by WinDbg

STACK_TEXT:
aee35b30 eda820c7 00000000 ae0ef9ce aee35c6c nt!CcPinFileData+0x1a2
WARNING: Stack unwind information not available. Following frames may be wrong.
aee35b68 eda745e0 aee35c14 aee35b9c aee35cb8 cmdguard+0xe0c7
aee35b78 f71d8b27 aee35c14 aee35b9c 00000000 cmdguard+0x5e0
aee35cb8 f71d8c33 86a7a250 86c2ae6c aee35cd8 fltmgr!DrainCompletionNode+0xfd
aee35cf0 f71e1fef 86a7a250 86a7a250 aee35d30 fltmgr!FltpDrainActiveCompletions+0xe1
aee35d00 f71e7a24 86a7a250 80535780 870e6c18 fltmgr!FltpDrainPendingCallbacksForInstance+0xf
aee35d30 f71ef09f 870e6c18 00000008 89c61c70 fltmgr!FltpFreeInstance+0x74
aee35d50 f71e18f7 86a7a25c 00000008 89c61c70 fltmgr!FltpFreeVolume+0x89
aee35d68 f71e564e 89decee8 00000008 8056485c fltmgr!FltpCleanupDeviceObject+0x61
aee35d7c 8053877d 89c61c70 00000000 870f7020 fltmgr!FltpFastIoDetachDeviceWorker+0x14
aee35dac 805cff70 89c61c70 00000000 00000000 nt!MiTrimPte+0x1fe
aee35ddc 805460ee 8053868e 80000001 00000000 nt!IopQueryReconfiguration+0x23
aee35df8 00000000 00000000 00000000 00001f80 nt!ExpRemovePoolTracker+0x7b

FOLLOWUP_IP:
cmdguard+e0c7
eda820c7 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: cmdguard+e0c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: cmdguard

IMAGE_NAME: cmdguard.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48ff8e14

STACK_COMMAND: .cxr 0xffffffffaee35764 ; kb

FAILURE_BUCKET_ID: 0x7E_cmdguard+e0c7

BUCKET_ID: 0x7E_cmdguard+e0c7

Followup: MachineOwner

2

I have had two bsod today after installing ver 3.5 both when coming out of sleep mode.

vista ultimate, on a dell insiron 6000 desktop, fresh instal after having version 3 installed. Minidump s cmdagent,exe and commodo bug report trys to send crash.dmp.

Have it working fine on my laptop with vista home??

removed and will wait for the next beta??

3

Now that you mentioned it, the last time it went BSOD on me, it came out of standby, seems like a pattern to me. Incidentally, does anyone know of a way to roll back to the previous release? May be the best option till this bug is fixed.

4

ARGH, besides the BSOD, I have had 4 unexplained mysterious freeze today causing me to have to cold boot. I have now uninstalled version 3.5.54375.427 and reinstalled version 3.0.25.378.

5

Still experiencing a freeze with version 3.0.25.378, Comodo Firewall is off my system completely now, I am using McAfee Firewall. Maybe when there is a more stable 3.5 release, I will give it a try again.

6

I, too, am experiencing about one BSOD a day on WinXP SP3 after updating to V3.5… and cmdguard.sys is the faulting module, 0x07e stop code, same as posted earlier in thread. This machine never enters sleep mode…

7

I was not aware there was a new Comodo product until I clicked check for updates, then started having problems afterward. Having caught up a bit on the forums, now I don’t know if this is to be expected or not. After the updating, a reboot is requested. After that reboot, I see a BSoD without fail 10-15 minutes after login. No login, no BSoD. Also other apps fail or exhibit strange behavior: eg process explorer is not able to display process list in tree form anymore and RadioShark fails to start, taking an exception. I’ve tried taking screenshots and noting down messages but once radioshark fails there is not enough time before the BSoD follows, which is only up for 2 seconds or so. I thought it was SpywareDoctor causing problems because this was the only app exhibiting any error messages before this and I’d tried to update it recently. I could not boot to a stable run state anymore until I did a restore in safe mode. Then I also remembered that one of the last things I did was try to update CFP3.

In short, no update, no problem. Update=BSoD city. Wondering if I’ll have similar problems uninstalling CFP3 and installing CIS3.5 (I assume that is what this update is BTW). I guess I can’t complain since I am not supposed to be running other firewalls besides this one (per a post I read on this forum), but this has worked out great for me for about the past 6 months, only now exhibiting problems:

CFP3
AVG8
AdAware2008
Panda IS2008
(Googlepack:)
NSS (not resident; used to clean up but just now only notifies of threats)
SpywareDoctor (installed but not resident; only recently more stable)

I have come to really appreciate CFP3, with the visibility and customizability it allows, so I want to keep using it even if I have to live without any updates. I just tried to attach the last mini-dump and got an error page saying I can’t attach anything unless it has one of a certain set of extensions–extension *.dmp was not one of them–so I cheated and appended a .jpg extension.

-regards.

[attachment deleted by admin]

8

Add me to the list of BSOD after installing V3.5. Same numbers (0X0000007E) etc. as the others. It happens intermittantly for no apparent reason. I uninstall V3.5 and go back to V3.0 and the problem disappears. Like others, I’ll just wait for an update.

9

I’m getting the same 0x7E BSOD. I traced it to cmdguard.sys also. And now that I think about it, CF did just do an update. The blue screens happened only when I was doing something in iTunes, but that could just be a coincidence considering I listen to music a lot. I guess I’ll be going back to v3.0…

10

I am on Win XP SP2 and get the same kind of problem since upgrade to v3.5 about one week ago; since then I had 12 minidump. Your posts helped me to detect the likely culprit, cmdguard.sys, mentioned first in the dump analysis. My system crashes look to happen every time I start winamp after coming back from hibernation. I also will try going back to v3.0.
Another detail, I don’t know has to do with this problem: when an external usb hd was connected before the crash, my system refused to reboot. I had first to disconnect the usb cable.

update (november 11)
I confirm, going back to v3.0 solves my dump problem !

11

Has there been any resolution to the BSOD problem associated with cmdguard.sys?

Has it been acknowledged as an issue by comodo?

Is there an ETA for a resolution?

thanks for any info.

jrn

12

Hi Guys.

I moved this thread here. And it will be looked at, Please attach the BSODS here in zip folder. This will let the developers download it, and if reproducible, it will be fixed.

Josh

13

I’m also running Windows XP SP3 32-bit and COMODO Internet Security version 3.5.55810.432.

After installing and running ImgBurn version 2.4.2.0, my computer completely crashed with a BSOD; so I ran WinDbg once my PC finished booting up, and WinDbg also revealed cmdguard.sys as the culprit in nearly every single minidump files produced by Windows except for one. Here is the bugcheck analysis from my PC:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx” referenced memory at “0x%08lx”. The memory could not be “%s”.

FAULTING_IP:
nt!CcPinFileData+1a2
804f04fe 8b8020020000 mov eax,dword ptr [eax+220h]

EXCEPTION_RECORD: f7aa7a68 – (.exr 0xfffffffff7aa7a68)
ExceptionAddress: 804f04fe (nt!CcPinFileData+0x000001a2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000220
Attempt to read from address 00000220

CONTEXT: f7aa7764 – (.cxr 0xfffffffff7aa7764)
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=f7aa7c14 edi=f7aa7c6c
eip=804f04fe esp=f7aa7b30 ebp=f7aa7b30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CcPinFileData+0x1a2:
804f04fe 8b8020020000 mov eax,dword ptr [eax+220h] ds:0023:00000220=???

STACK_TEXT:
f7aa7b30 f1bfa11d 00000000 f75bc069 f7aa7c6c nt!CcPinFileData+0x1a2
WARNING: Stack unwind information not available. Following frames may be wrong.
f7aa7b68 f1bec5e0 f7aa7c14 f7aa7b9c f7aa7cb8 cmdguard+0xe11d
f7aa7b78 f72dab27 f7aa7c14 f7aa7b9c 00000000 cmdguard+0x5e0
f7aa7cb8 f72dac33 83e1f100 83d1745c f7aa7cd8 fltmgr!DrainCompletionNode+0xfd
f7aa7cf0 f72e3fef 83e1f100 83e1f100 f7aa7d30 fltmgr!FltpDrainActiveCompletions+0xe1
f7aa7d00 f72e9a24 83e1f100 80535780 83edbc18 fltmgr!FltpDrainPendingCallbacksForInstance+0xf
f7aa7d30 f72f109f 83edbc18 00000008 84ad3be8 fltmgr!FltpFreeInstance+0x74
f7aa7d50 f72e38f7 83e1f10c 00000008 84ad3be8 fltmgr!FltpFreeVolume+0x89
f7aa7d68 f72e764e 83ef3ee8 00000008 8056485c fltmgr!FltpCleanupDeviceObject+0x61
f7aa7d7c 8053877d 84ad3be8 00000000 84fc68b8 fltmgr!FltpFastIoDetachDeviceWorker+0x14
f7aa7dac 805cff70 84ad3be8 00000000 00000000 nt!MiTrimPte+0x1fe
f7aa7ddc 805460ee 8053868e 00000001 00000000 nt!IopQueryReconfiguration+0x23
f7aa7df8 00000000 00000000 00000000 00001f80 nt!ExpRemovePoolTracker+0x7b

FOLLOWUP_IP:
cmdguard+e11d
f1bfa11d ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: cmdguard+e11d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: cmdguard

IMAGE_NAME: cmdguard.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 491b1a43

STACK_COMMAND: .cxr 0xfffffffff7aa7764 ; kb

FAILURE_BUCKET_ID: 0x7E_cmdguard+e11d

BUCKET_ID: 0x7E_cmdguard+e11d

.cxr 0xfffffffff7aa7764
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=f7aa7c14 edi=f7aa7c6c
eip=804f04fe esp=f7aa7b30 ebp=f7aa7b30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CcPinFileData+0x1a2:
804f04fe 8b8020020000 mov eax,dword ptr [eax+220h] ds:0023:00000220=???

Is there any fix for this other than completely uninstalling COMODO Internet Security?

14

Unfortunately, Windows deleted my mini-dump before I could copy it somewhere else.

I am willing to provide as much info as necessary to help resolve the issue.

For me, reverting back to version 3.0 has fixed the BSOD issue.

For me, v3.5 BSOD’d whenever iTunes v8.x was playing or sometimes, even just starting.
For me, v3.5 BSOD’d when trying to burn a dvd using Sonic DigitalMedia Plus v7.

My wife’s computer is nearly identical to mine. It does not BSOD with iTunes 7.x and Comodo v3.5 …

hope this is of some help.

15

I’m currently using 3.5.55810.432 on one of my PCs.

I have had 2 BSOD recently. I have attached the latest minidump and debuglog from debugwiz (which says CMDGUARD.SYS is suspected to have caused the BSOD) (the first one got deleted by windows)

Which in this case is black screen of death since the monitor just turns off and the PC locks up

it doesn’t seem to be caused by anything specific, it happened randomly each time (or so it would appear)

I think there is a new version now which I am going to update to and see if this fixes it. I will post back if anything changes or if you want more information.

[attachment deleted by admin]

16

Updated to 3.5.57173.439 and still have the problem. Got a BSOD this morning but this time I actually got to see it, rather than everything going black.

Minidump attached.

[attachment deleted by admin]

17

I had the same BSOD after the Commodo update to 3.5xx performed 10/31/08. Took me a while to figure out what was going on. No particular rhyme not reason for the BSOD, happened several times daily until I removed Comodo altogether. Using Windows XP Pro SP2. I will try to attach a zip of several of the minidump files. Each refers to the cmdguard.sys file as the offender. Thank you. Loved the program prior to this.

[attachment deleted by admin]

18

Is anyone actually going to look at these dumps and attempt to figure out the problem?? Considering they’ve been downloaded 0 times…

19

(:AGY)
Unfortunately, I had no choice but completely uninstall COMODO Internet Security from my Windows XP SP3 32-bit system as it yet again caused another one of my applications (Firefox) to completely lockup; not once, but twice just this morning alone.

Although no Minidumps was generated by Windows at the point of the lockups, I however do have a crash report from version 3.5.57173.439 of COMODO Internet Security generated on 12/08/08 that I’m sending as an attachment.

Because of this, I refuse to reinstall this product until this problem is fixed in the 32-bit version of Windows XP. (:AGY)

[attachment deleted by admin]

20

I posted a dump. I’m running Vista 64 and as I’m reading this thread it seems completly related to my issues.