What you did: Start Microsoft Word Starter or Microsoft Excel Starter.
What actually happened or you actually saw: After a few seconds a splwow64.exe application error is displayed: “The application was unable to start correctly (0xc0000005).” Both applications are then unable to print.
What you expected to happen or see: I expect these applications to start normally and to be able to print.
How you tried to fix it & what happened:
I have found that using the “Deactivate the Defence+ permanently” option removes the problem.
I have found that all other attempts to configure Defence+ to avoide the problem do not help.
In particular, I have found that setting the Defense+ securuty level to disabled will still give the problem but using the “Deactivate the Defence+ permanently” option removes the problem. As I understand it their should be no difference in behaviour between these two options if Defense+ is behaving correctly.
I have found that there are no entries in the event log to help with the problem.
If its an application compatibility problem have you tried the application fixes here?: I believe I have tried all appropriate configuration options to remove the problem.
Details & exact version of any application (execpt CIS) involved with download link: Windows 7 Home Premium 64-bit SP1; Microsoft Office Starter 2010.
Whether you can make the problem happen again, and if so exact steps to make it happen:
A. Start Microsoft Word Starter.
B. After a few seconds a splwow64.exe application error is displayed several times: “The application was unable to start correctly (0xc0000005).”
C. Go the “backstage” printer section.
D. An splwow64.exe application error is displayed twice: “The application was unable to start correctly (0xc0000005).”
E. You will have problems printing.
-or-
A. Start Microsft Excel.
B. Go to the “backstage” printer section.
C. An splwow64.exe application error is displayed twice: “The application was unable to start correctly (0xc0000005).”
D. Excel says that “Excel could not connect to the selected printer”.
Any other information (eg your guess regarding the cause, with reasons):
I have determined that Word and Excel are starting splwow64.exe, which is a Windows system application that allows 32-bit processes to perform printing functionality. 0xc0000005 is the error code for access violation on startup - ie splwow64.exe is crashing.
I suspect the issue is realated to the somewhat exotic way in which Microsoft Office Starter is installed. The Windows Start Button entries actually launch a “Virtualization Handler”. The actual Word and Excel executable appear to be located in a Q “drive”. This is not actually a drive but a virtual file system described by Microsoft here: Click-to-Run for Office 2010 - Office | Microsoft Learn . Because of this Defence+ can not access the files in the path of the Word and Excel processes. I suspect that Defence+ is not able to handle this and so is crashing the splwow64.exe process.
Files appended. (Please zip unless screenshots).
Screenshots illustrating the bug: I will supply a screenshot of the problem itself.
Screenshots of related CIS event logs and the Defense+ Active Processes List: I will supply a screenshot of the key parts of the active process list when the problem happens.
A CIS config report or file. I am happy to supply this if required.
Crash or freeze dump file: I am happy to supply this if it is possible.
Your set-up
CIS version, AV database version & configuration used: COMODO 5.3.181415.1237. Firewall and Defence+ only; AV option not installed.
a) Have you updated (without uninstall) from CIS 3 or 4: This is a new PC with a fresh installation of COMODO.
b) if so, have you tried a clean reinstall (without losing settings - if not please do)?: N/A
a) Have you imported a config from a previous version of CIS: N/A
b) if so, have U tried a standard config (without losing settings - if not please do)?: N/A
Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.): no.
Defense+, Sandbox, Firewall & AV security levels: D+= Safe, Sandbox= Disabled, Firewall = Safe, AV = not installed.
OS version, service pack, number of bits, UAC setting, & account type: Windows 7 Home Premium 64-bit SP1; can be reproduced in both admin and standard accounts with UAC set to both to default and never notify.
Other security and utility software installed: AVG Free.
Virtual machine used (Please do NOT use Virtual box): N/A
We would very much appreciate it if you would edit your first post to create an issue report in line with the bug forum guidelines and format here. You can copy and paste the format from this topic.
To understand the reasons why we ask you to follow these guidelines please see below.
WHY WE ASK YOU TO FOLLOW THESE GUIDELINES
Bugs/issues can be impossible or very time consuming to fix if developers don’t have enough information to reproduce them. Since CIS is free, development time is limited. So if you want your issue fixed, please use the format below to describe it.
To avoid clutter, issues not described in the format below your post will not be moved to the ‘moderator verified’ issues topic. This means that the developers may not look at it.
I have updated my opening entry as requested. I am now supplying three screenshots:
Problem.png: a screenshot of the error message in Word when the problem happens.
ProcessList.png: a screenshot of the Defence+ process list when the problem happens.
ProcessExplorerProcessList.png: a Process Explorer process list screenshot when the problems happens. This shows the processes image paths, which allows you to see which ones come from the Q “drive”, which I think is significant.
I have win 7 64 bit with office starter functioning smoothly along side Defense+ without any problems. This despite that I have blocked the advertisement using defense+! So, it could be something else. Can you open
and verify rules related to office starter applications like winwordc
and try using predefined policy ‘trusted application’ and see this solves the problem.
or else delete all rules (if any) created under defense+ rules for office starter applications and re-run
The most probable reason could be, at the first run of ms office, defense+ gives some 4-5 alerts and you may have blocked any one of them, which could be crucial for functioning of the application.
Office starter actually opens 2-3 dlls for advertisements, compatibility to earlier ms word documents etc. and blocking any of them may result in such behaviour. Please retry removing the already created rules. I haven’t created any rule for ‘partition - Q’ and still office starter functions normally without defense+ doing anything.
As it functions properly in my machine, I can confirm that it is not a compatibility problem but some wrong blocking done within defense+. I remember once I inadvertently blocked an alert when defense+ showed an alert when opening a ms office 2003 document, using compatibility mode in word 2010, due to which I got error report. (However, I haven’t used a printer with office starter and cannot confirm whether it has any such angle to it).
Just to be sure I have now been systematically through all rules associated with these applications and removed. I have then run the applications, made sure they are set to trusted and allowed all other actions. I’ve also added their file paths to the trusted file lists. This has not made any difference to the problem.
I have realised there are two things that I should have been clearer on in my opening entry:
The problem happens even when Defense+ securuty level is set to disabled. I believe that all policies should be ignored and all actions allowed in this state. The problem does not happen if I used the “Deactivate the Defence+ permanently” option. As I understand it their should be no difference in behaviour between these two options if Defense+ is behaving correctly. So I maintain that this is not a configuration issue.
There is actually a difference in the problem between Word and Excel. With Word the error message is disaplyed regularly. With Excel the error message is only disaplayed if you attempt to print. Both applications behave fine appart from this. If you have tried printing then maybe you are just not seeing the problem for that reason.
I will update my opening entry to record these two additional points.
Are you all running the Microsoft Office Client Virtualization Handler?
It certainly would explain the Q drive (virtual disks, what else?). CIS might consider this Q drive a removable device and not trust it (or anything on it). That alone might cause some problems.
Yes, as stated in my opening entry. Microsoft Office Starter Edition is only available in this form. I understand from the Microsoft web-site that it is optionally available in this form for other editions. As also stated in my opening entry, I think the issue is most likely caused by the executables apparently being located on a file path that Comodo does not have any access to.
I have the same problem exactly as described by BenB.
Problem first turned up on a new HP Pavilion mini-laptop with a protected Q: drive and MicroSoft Word & Excel Starter; same exception generated by splwow64.exe.
I have this problem after I have installed service pack 1 for windows 7.
I am not sure the service pack would have any problems with the windows starter and defense +.
It keeps on showing splwow64.exe application error after opening office words starter.
Also: am wondering if this is a Windows problem? Maybe the Windows firewall has some special permission in relation to Q: drive not allowed to a 3rd party firewall?
I just tried this again. The issue appears to be resolved as I can no longer reproduce it. I am now using COMODO 5.5.195786.1383 and Office Starter 2010 Service Pack 1.
Same issue here. It’s very frustrating that files in Q: can be added to Trusted Files only to disappear once I close the dialog. Setting Defense+ Security Level to disabled was the first fix that worked for me, and I’ve also found that setting Sandbox Security Level to disabled fixes it as well (even with Defense+ still in Safe Mode). Not sure if changing either setting is having the same effect in terms of system security…
I am having the same issues. For me the only option is to turn off Defense+. However, Microsoft has issued an update for Office 2010:
[i]Update type: Important
Update for Microsoft Office 2010 (KB2515417)
Microsoft has released an update for Microsoft Office 2010. This update provides the latest fixes to the Microsoft Office 2010 Click-2-Run deployment mechanism. Additionally, this update allows anti-virus and anti-malware scan of virtualized Microsoft Office 2010.