Update process hangs and gives BSOD

Help for v2
#1

I installed CPF just a few days ago, it worked perfectly until 2.4 appeared.
The installation/download procedure kept stopping at 2, 6, 8, 10, you name it %, but the main problem was when it finally finished downloading.
The procedure prompted me about the network disconnection, I didn’t click on it right away and somehow all the controls on the prompt window became disabled.
I thought the procedure hung and I promptly killed its process…only to get a nice blue screen.
The screen reported: IRQL_NOT_LESS_OR_EQUAL 0x0000000a (0x00000166, 0x00000002, 0x00000000, 0x80823726)
In addition, the event log reported (20 or so minutes earlier):

The description for Event ID ( 54 ) in Source ( CmdMon ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\ComodoTcpFilter.

The next thing reported there was the dump data, plus the system restart events.

The dump info from WinDbg 6.6 (The dump itself is over 200M):

MODULE_NAME: cmdmon

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 451a13e2

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeInsertQueueApc+22
80823726 389e66010000 cmp [esi+0x166],bl

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80823726 to 80868853

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b9c8dc58 80823726 badb0d00 b9c8dcd8 88850570 nt!Kei386EoiHelper+0x27db
b9c8dce4 b7176595 88005820 87a4d560 00000000 nt!KeInsertQueueApc+0x22
b9c8dd14 80819362 8885fe40 874a5720 877a73c8 afd!AfdRestartConnect+0x172
b9c8dd44 b7729991 88f1487c b772889a 88f1487c nt!IoCancelIrp+0x12a
b9c8ddac 808eda06 00000000 00000000 00000000 cmdmon+0x6991
b9c8dddc 80869fa2 b77284ac 00000000 00000000 nt!PsRemoveCreateThreadNotifyRoutine+0x21e
00000000 00000000 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x5a2

STACK_COMMAND: kb

FOLLOWUP_IP:
cmdmon+6991
b7729991 8b4624 mov eax,[esi+0x24]

FAULTING_SOURCE_CODE:

SYMBOL_STACK_INDEX: 4

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: cmdmon+6991

IMAGE_NAME: cmdmon.sys

By the way, the update procedure should be updated (lol).
I think it is a good idea to check if all or some of the files were already downloaded instead of ignoring them and redownloading the whole thing.
Might help to reduce the server stress and the update time.

Cheers

#2

Hi, jmm,

As cmdmon.sys is the Comodo Application Engine driver you should raise a ticket with Comodo support. From what i can tell from your dump the problem is an IRQL problem due to the fact the ntoskernel unwind stack is unavailable, but my skills with dump files are far from expert. So onto the real experts ;D: Comodo Support. It may also be helpful, where possible, to provide several mini dump files so a pattern can be established (if there is one), but i’m sure the support team will tell you what they need to resolve the issue :wink: