Win 8 hang during CIS AV scan (purple screen) MEMORY LEAK? [M284]

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.during CIS scans the computer suddenly shows only the background color and a mouse pointer, it has to be powershut down by pressing the power switch for 5 seconds, as nothing else works anymore

  • Can U reproduce the problem & if so how reliably?:no, it happens sometimes, always during CIS scans after starting the win 8 OS and when i am afk
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:i started the computer, updated the data base and started a full scan. then i left the computer. upon returning i saw my backgroundcolour an a mouse pointer, alt+ctrl+del, alt+f4, shutting down by shortly pressing the power button, none of them worked anymore. the computer had to be shut down by pressing the button for 5 sec.
  • If not obvious, what U expected to happen:
  • If a software compatibility problem have U tried the conflict FAQ?:i thought maybe it’s a screensaver or auto display off issue, i disabled both but still it happened
  • Any software except CIS/OS involved? If so - name, & exact version:win 8
  • Any other information, eg your guess at the cause, how U tried to fix it etc: see https://forums.comodo.com/antivirus-help-cis/purple-screen-of-horror-t92109.0.html
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration:6.0.264710.2708 database 15449 config: COMODO internet security,

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:CIS
  • Have U made any other changes to the default config? (egs here.):no
  • Have U updated (without uninstall) from a CIS 5?:no
    [li]if so, have U tried a a clean reinstall - if not please do?:yes
    [/li]- Have U imported a config from a previous version of CIS:no
    [li]if so, have U tried a standard config - if not please do:yes, the standard “full scan” configuration, but it occured also in costomized scan profiles
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:windows 8 64 bit UAC enabled, user account
  • Other security/s’box software a) currently installed b) installed since OS: a=none b=test version of McAfee, removed with McAfee removal tool prior to Comodo installation
    [/ol]

diagnostics file attached

[attachment deleted by admin]

Can you also please open KillSwitch while the scan is running and choose the option to “Save Current View”. You can then put this in a zip file and attach it to your first post. Also, please attach a screenshot of the relevant AV scan logs, for the time between when the scan started and when it gave the purple screen to your first post.

In addition, once you find when the scan started, and when it gave the purple screen, please post a screenshot of your Firewall and Defense+ logs for the same time frame. There might be some hint as to what is going on if all of that information is provided.

Thank you.

hi,
sorry i don’t have killswitch and i don’t want to install it.
the logs from antivirus events, firewall and defence+ are all empty

KillSwitch can be opened by going to the Advanced Tasks section and clicking on “Watch Activity”. This will open KillSwitch.

By default it only shows events for the current day. To see more right-click on the blank window and select “Current Week”, “Current Month”, or “Entire Period”.

Also, EricJH provided some very good advice here. It would be very helpful if you could find out which file, or at least which folder, is being scanned when the problem occurs. If possible could you please do this and see if it always happens when scanning the same file. The idea is that if you can locate the actual file which causes this, or at least the folder, the developers can very likely fix the issue. If you cannot it may become difficult for them to narrow it down.

That said, at least attaching what I asked for previously would be very helpful.

Thank you.

all the log files are epmty for the entire period except defence +.
there can be found for this week only the file for updating the bios which i did some days ago.
when attempting to open killswitch it prompts me to install it which i dont want :-\

I apologize, I also meant to ask you to check the tasks logs and select the ones that correspond to the AV scan. From what you said, unless updating the bios corresponded with the problem you are seeing, there is no need to attach any other logs.

Please do install it. This is a program which will not run unless you open it. Thus, installing it does not eat up any system resources. However, it is very helpful for the devs to figure out the bug you are running into.

Also, did you yet make any progress figuring out which file causes the issue. I’ve thought more about it and I believe that, especially since there is nothing in the logs, this is really the best way to go. Please let me know if it’s possible for you to narrow this down so you can let the devs know which file causes the problem. If you can do that I’m almost certain they can fix the problem.

Thanks.

updating the BIOS has nothing to do with it, as the problem was before the update too. i still dont understand which logs you want me to attach. in the logs the crashed scans are listed, but no additional info (see screenshot full scan today at 10:16)
i cannot narrow it down as the problem occurs not always. i am quite sure it has nothing to do with a specific file, as it occurs not always. never it happened when i am using the computer during the scan. i dont want to test everyday for many hours, sorry.
still i dont want to install killswitch, as in the license agreeement something is said about payable service. i dont understand that agreement and i dont install killswitch.

[attachment deleted by admin]

just now a customized scan crashed while i was in firefox, suddenly it didnt respond anymore. i could close the firefox window and noted the file which was scanned when the scan crashed as i could see the scan window. a sceenshot and a shut down was not possible anymore. i am tired of killing my system everyday so many times :frowning:
i will try to scan that file an write here if i know more 88)

Thank you. At least finding out if scanning the same file triggers this is very helpful.

Also, those are the logs I was looking for. Thank you for attaching them.

However, I’m afraid that the KillSwitch Process dump may be very important for the bug report. It shows all processes which are running during the scan, which may have something to do with the problem you are seeing. I promise you that KillSwitch is not a paid service. In fact, it has always been free and has no paid counterpart. There is nothing nefarious about KillSwitch.

Please install it and do a process dump while the scan is running. Also, KillSwitch is a portable application. Thus, I believe that to remove it all you need to do is delete the KillSwitch application from the Comodo folder, which is located in Program Files.

Thank you.

ok, i installed killswitch. but what exactly does it do? what file you need? how do i obtain it? shall i first start the scan and then killswitch? when i “save current view” it will show the status before the crash. after the crash i cannot “save current view”… ???
i tried to scan that file which showed in the scan window when it crashed yesterday. nothing happened.
same with the file i noted today after the crash…

ok… 88)
i started the computer and did start a “full scan”
then i opened killswitch and “save current view” (killswitch.zip file)
as i was in the forum when the crash happened the purple screen was not there, but everything was frozen; i could go to killswitch which was also opened but didnt respond, but “save current view” still worked. (killswitch2.zip)
i noted the file which was in the scan window (it was not the same as yesterday)
i pressed the power button for 5 secs 88)
i restarted the computer and did another “save current view” (killswitch3.zip)

the next full scan was running when i was afk an brought the purple screen as usual :frowning:

i will attach those 3 files here and to my first post

i am sick and tired of it and might soon install another antivirus :-\

[attachment deleted by admin]

I’m very sorry you have had so much trouble. Thank you for attaching the KillSwitch process dumps. That should be very helpful to the devs. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed. I will now move this to Format verified Issue Reports - CIS.

Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Also, I would advise that until this bug is fixed you do not run any full scans. If you believe this is necessary on your computer you may instead wish to downgrade to V5. Older versions of CIS can be downloaded from sites such as FileHorse.

Thank you.

ok thank you
i want to add the two paths of the files that were scanned when it crashed (at least the were shown in the CIS scan window when it freezes)

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089

C:\Windows.old\Windows\System32\fr-FR\wshtcpip.dll.mui

;D

Thanks for the additional information. Could you try scanning the files you think involved using a right click scan.

Unfortunately the file in the window may not be the file that causes the problem as the display is retrospectively updated.

There is a way of finding out if you have not yet found the file.

yes, i already scanned those files without result, the scan was made without problems.

i don’t understand this, and i think it’s not only one file causing the issue

OK, this is how you do it:
https://forums.comodo.com/bug-reports-cis/resources-for-bug-reporters-t26980.0.html;msg655013#msg655013

Then you can exclude any file you discover from the scan.

Then repeat the process. If there are two or more it will happen again

And so on.

If you keep getting new ones when carrying out this process then it’s likely it’s not scanned file specific.

(Feedback on instructions appreciated - I will update if anything unclear)

Best wishes

Mouse

thank you, mouse1 :slight_smile:
your help is appreciated, its only that i have other troubles in my life right now :frowning: and the comodo issue is not on top of my to do list. i think your instructions are clear, but sorry i am not in the mood for trying this. thanks for your comprehension :embarassed:

That’s no problem at all. Very best of luck with your troubles.

Best wishes

Mike

it happened yesterday with a cusomized scan, again when i was afk. it looks like the computer still is running, at least some functions, but the userinterface not (for example the adjustment of screen brightness with fn+f5 and f6). just that purple screen can be seen and a mouse pointer (which can be moved) and because one cannot shut it down normally i have to force it by pressing the button 5 secs.

Thanks. Can you get the task manager up when it happens? (By Cntrl Alt Del)