Google Chrome, ntdll.dl, and EIS

[Matto 0]

Today after installing the latest version of EIS on my pc google chrome, and all extensions and plugins crash when I try to open it. Just to test if it was actually EIS causing the issue I uninstalled it and everything worked fine.

 

In event viewer I see these events:

 

Faulting application name: chrome.exe, version: 54.0.2840.16, time stamp: 0x57d0c53e

Faulting module name: ntdll.dll, version: 10.0.14393.103, time stamp: 0x57b7e207

Exception code: 0xc0000005

Fault offset: 0x000000000002f21b

Faulting process id: 0x23d8

Faulting application start time: 0x01d20e99e2a9ecab

Faulting application path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: 046f660d-f525-4aea-a8ce-bd337085e6c0

Faulting package full name: 

Faulting package-relative application ID: 

 

 

 

And:

 

Fault bucket , type 0

Event Name: APPCRASH

Response: Not available

Cab Id: 0

 

Problem signature:

P1: chrome.exe

P2: 54.0.2840.16

P3: 57d0c53e

P4: ntdll.dll

P5: 10.0.14393.103

P6: 57b7e207

P7: c0000005

P8: 000000000002f21b

P9: 

P10: 

 

Attached files:

 

These files may be available here:

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_8755fc181917483bd3e894d29fed119e7c7355_5e766df6_0dde9dfa

 

Analysis symbol: 

Rechecking for solution: 0

Report Id: 046f660d-f525-4aea-a8ce-bd337085e6c0

Report Status: 4

Hashed bucket: 

 

 

I've played around with various settings in the program but I haven't nailed down which one is causing the crash, even "Disable All Components" doesn't do anything. But, as I said, uninstalling EIS allows Chrome to start up as it normally should.

[GT500 609]

Do you have Google Chrome configured to use AppContainer in chrome://flags?

[Matto 0]

Do you have Google Chrome configured to use AppContainer in chrome://flags?

 

It's set as default.

 

Edit: Setting it to disabled seems to have "fixed" the problem.

[GT500 609]

Interesting, the default setting is supposed to be OK.

I think our developers have been working on this issue, so hopefully it won't be a problem for very long.

[SHvFl 1]

Interesting, the default setting is supposed to be OK.

I think our developers have been working on this issue, so hopefully it won't be a problem for very long.

So when the devs fix the issue you will not have to exclude Chrome and Emsisoft will protect it even when in appcontainer mode?

[Marshall 0]

Hello

I don't know what is "AppContainer" in French but I use Chrome default settings with EIS default settings without any problem.

[GT500 609]

So when the devs fix the issue you will not have to exclude Chrome and Emsisoft will protect it even when in appcontainer mode?

As I understand it, that should be correct. There are some technical limitations in regards to working with programs running in an AppContainer, and I know our developers were at least trying to overcome those since (if I am not mistaken) AppContainers are used for Windows Store apps.

I don't know what is "AppContainer" in French but I use Chrome default settings with EIS default settings without any problem.

It's hard to say for certain, as AppContainer is intended only to be turned on by an application that supports the feature, however it might be possible for something else to cause Google Chrome to run in an AppContainer when the setting in Chrome is configured for "Default" (possibly the "Enhanced Protected Mode" in the Internet Options in the Control Panel and in Internet Explorer, however I have found no proof of that). Most people don't appear to have the problem, as we've received only a few reports of this issue thus far, and many people are using Google Chrome.

[SHvFl 1]

As I understand it, that should be correct. There are some technical limitations in regards to working with programs running in an AppContainer, and I know our developers were at least trying to overcome those since (if I am not mistaken) AppContainers are used for Windows Store apps.

Yeah store apps, Edge, etc. This is good news can't wait to see what they come up with. 

[GT500 609]

Have any of you had a chance to try the new version 12 beta? I know it has some improvements to the Behavior Blocker, however I have not been told exactly what those improvements are, so I don't know for certain if there are any AppContainer related changes.

[SHvFl 1]

Have any of you had a chance to try the new version 12 beta? I know it has some improvements to the Behavior Blocker, however I have not been told exactly what those improvements are, so I don't know for certain if there are any AppContainer related changes.

I use the new version. Same issue as before, you need to exclude Chrome from monitoring if you want appcontainer. 

 

I assume the behaviour blocker and guard is to blame so you need to exclude it from everything(using second exclude box)

[GT500 609]

I would believe it's a hooking related issue, and if I am correct then that means it's the Behavior Blocker and Surf Protection.