0

Everyday, my Reliability Monitor on Windows 7 x64 reports at least one SearchIndexer.exe crash. Here is the log.

Description
    Faulting Application Path:  C:\Windows\System32\SearchIndexer.exe

Problem signature
    Problem Event Name: APPCRASH
    Application Name:   SearchIndexer.exe
    Application Version:    7.0.7601.17610
    Application Timestamp:  4dc0d019
    Fault Module Name:  msvcrt.dll
    Fault Module Version:   7.0.7601.17744
    Fault Module Timestamp: 4eeb033f
    Exception Code: c0000005
    Exception Offset:   00000000000011fd
    OS Version: 6.1.7601.2.1.0.256.48
    Locale ID:  1033
    Additional Information 1:   8e9c
    Additional Information 2:   8e9cc075dc50f01b9cac7ccc1eadbd5c
    Additional Information 3:   7fa4
    Additional Information 4:   7fa418f09a0afea8e8da8b9cc9b6d244

What can I do to stop it?

Improve this question
2
  • generate a crash dump and share it: pastebin.com/gYV6vWHJ Maybe I can see what is wrong
    – magicandre1981
    Jul 23, 2016 at 18:06
  • @magicandre1981 I got a crash dump. It was very big so, I compressed it with 7-Zip because I felt Zip compression wasn't small enough. Hope that's okay with you.
    – user477799
    Jul 23, 2016 at 19:38

1 Answer 1

Reset to default
0

In the dump, I can see this call tquery!CSdidLookupTable::LookupSDIDOrAdd+0x152, so there is an issue looking for permissions.

00 ntdll!NtWaitForMultipleObjects
01 KERNELBASE!WaitForMultipleObjectsEx
02 kernel32!WaitForMultipleObjectsExImplementation
03 kernel32!WerpReportFaultInternal
04 kernel32!WerpReportFault
05 kernel32!BasepReportFault
06 kernel32!UnhandledExceptionFilter
07 ntdll! ?? ::FNODOBFM::`string'
08 ntdll!_C_specific_handler
09 ntdll!RtlpExecuteHandlerForException
0a ntdll!RtlDispatchException
0b ntdll!KiUserExceptionDispatch
0c msvcrt!memcpy
0d tquery!CRcovStrmTrans::Read
0e tquery!CRcovStrmIter::GetRec
0f tquery!CSdidLookupTable::LookupSDIDOrAdd
10 tquery!CSecurityStoreWrapper::LookupSDID
11 mssrch!CPluginCollectionSink::PushProperties
12 mssrch!CRobotThread::Thread
13 kernel32!BaseThreadInitThunk
14 ntdll!RtlUserThreadStart

I can see this string floating around C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.001. So make sure that SYSTEM has access to it.

I can also see that a 3rd party dll called guard64.dll is involved. 

0x00000000051180f8 : 0x000007fefe0511fd : msvcrt!memcpy+0x250
0x0000000005118300 : 0x007600650044005c :  !du "\Device\"
0x0000000005118348 : 0x0000000076c91a0a : kernel32!HeapFree+0xa
0x0000000005118360 : 0x007600650044005c :  !du "\Device\Hard"
0x0000000005118368 : 0x005c006500630069 :  !du "ice\Hard"
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for guard64.dll - 
0x0000000005118380 : 0x0075006c006f0056 :  !du "Volume?\*"
0x0000000005118388 : 0x005c003f0065006d :  !du "me?\*"
0x0000000005118408 : 0x000007fefccc0480 : KERNELBASE!g_SbTableEntry_CreateFileDowngradeSwitch_Scenario
0x0000000005118458 : 0x000007fefcc6725e : KERNELBASE!CreateFileW+0x4aa
0x0000000005118500 : 0x000007fefe0511fd : msvcrt!memcpy+0x250
0x0000000005118588 : 0x00000000017a5680 :  !du "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\S..."

and this belongs to COMODO:

Image path: C:\Windows\System32\guard64.dll
Image name: guard64.dll
Browse all global symbols  functions  data
Timestamp:        Tue Jun 14 23:11:46 2016 (57607312)
CheckSum:         000D15C2
ImageSize:        000C6000
File version:     8.4.0.5068
Product version:  8.4.0.5068
File flags:       0 (Mask 3F)
File OS:          4 Unknown Win32
File type:        1.0 App
File date:        00000000.00000000
Translations:     0409.04e4
CompanyName:      COMODO
ProductName:      COMODO Internet Security
ProductVersion:   8, 4, 0, 5068
FileVersion:      8, 4, 0, 5068
FileDescription:  COMODO Internet Security
LegalCopyright:   2005-2016 COMODO. All rights reserved.

remove it and look if this fixes the crashes.

Improve this answer
6
  • Thanks for your help. Tried the permission thing. Comodo Internet Security is my antivirus and firewall but I try it next. It may take a couple of days before I can be sure the problem is solved.
    – user477799
    Jul 24, 2016 at 8:36
  • Sorry to be bothering you again but none of what I did seems to have had any effects. I hate troubling you too much but I've also been having this problem for two days short of seven month now. Would you mind having another crack at the latest crash log?
    – user477799
    Jul 27, 2016 at 12:49
  • I still see the path in the dump. Try to rebuild the search index
    – magicandre1981
    Jul 27, 2016 at 15:26
  • Didn't help. I had the third crash in one day.
    – user477799
    Jul 28, 2016 at 5:09
  • hm, install the convenience roll-up and look if it fixes the issue. this rollup include tons of hotfixes/updates and my include a fix for your issue: catalog.update.microsoft.com/v7/site/Search.aspx?q=3125574 , support.microsoft.com/en-gb/kb/3125574
    – magicandre1981
    Jul 28, 2016 at 15:40

You must log in to answer this question.