HS3 ntdll.dll Crash

[Mark S.]

I have a recurring problem where HS3 crashes every few days. The event viewer shows:
Description:
Faulting application name: HS3.exe, version: 3.0.0.297, time stamp: 0x57c733ef
Faulting module name: ntdll.dll, version: 10.0.14393.206, time stamp: 0x57dacde1
Exception code: 0xc0000374
Fault offset: 0x000d9841
Faulting process id: 0x1c08
Faulting application start time: 0x01d22e5a3709ff4d
Faulting application path: C:\Program Files (x86)\HomeSeer HS3\HS3.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 417fc19c-0ad6-4a84-8098-3ee0ed282220
Faulting package full name:
Faulting package-relative application ID:

Based on what I see on the interwebs, HS3 is crashing when it asks ntdll.dll to do something it can't do. The Exception code suggests a "heap memory" corruption or problem, apparently caused by an unspecified application.

I'm running HS3 (.297) on Windows 10 Pro (version 1607), plugins are latest of BLAB8SS, BLBackup, Blue Iris, Easy Trigger, HSTouch Server, Open Sprinkler, Sonos, UltraM1G, Ultra1Wire, Weather XML and ZWave. I use Chrome as my browser. No other software runs on this PC. My gut tells me this crash problem started after an update of one of the above (Windows, HS3, Chrome or a plugin).

I do see that my memory can run at 45-50% of 8 GB (much of it Chrome), but it is always HS3 that crashes (followed by Open Sprinkler and HSTouch, but I assume that is because HS crashed first).

Any thoughts or ideas how to fix this?

[sparkman]

Try running a .net repair. https://www.microsoft.com/en-ca/down....aspx?id=30135.

Cheers
Al

[Mark S.]

Thanks, Al. I've tried that several times. All it does is restart Windows Installer Service - nothing else. Then sometimes it tells me to re-install .NET Framework, but for the life of me I can't see how to do that because it is apparently built into Windows 10.

[sparkman]

You may want to try some of the options here: https://www.raymond.cc/blog/uninstal...-cleanup-tool/ and maybe try uninstalling HS and reinstalling it. Make sure to do a backup first. You can try to reinstall .net using this as well: https://www.microsoft.com/en-us/down....aspx?id=53344

Cheers
Al

[Mark S.]

Thanks, again. I think the problem is that most of the .Net repair stuff is made for Windows 7 and does not work for 10. The only advice I've seen from MS for a .Net repair is to reinstall Windows 10 (there is no Windows repair option). Apparently, this would require me to re-install everything (HS, plugins, yada yada) from scratch - not a pretty proposition to do a complete do-over. Windows 10 is a very different experience - nothing works the way it used to with 7 or XP. So I'm hoping for options other than a re-build.

I tried a HS3 repair - no change.

[sparkman]

Yes, that's a large part of the reason I'm running HS on W7. Have you tried some of these tools: http://www.howtogeek.com/222532/how-...dism-commands/

Cheers
Al

[vasrc]

Thanks, again. I think the problem is that most of the .Net repair stuff is made for Windows 7 and does not work for 10. The only advice I've seen from MS for a .Net repair is to reinstall Windows 10 (there is no Windows repair option). Apparently, this would require me to re-install everything (HS, plugins, yada yada) from scratch - not a pretty proposition to do a complete do-over. Windows 10 is a very different experience - nothing works the way it used to with 7 or XP. So I'm hoping for options other than a re-build.

I tried a HS3 repair - no change.

Couple of thoughts:
Do you use the Nvidia driver? It's known to cause this issue.
Did you do and sfc /VERIFYONLY on your W10 box?
What does the HS3 log/Event Mgr say was occurring before the crash? Any similarities between that and previous crashes?

Z

[Mark S.]

Yes, that's a large part of the reason I'm running HS on W7. Have you tried some of these tools: http://www.howtogeek.com/222532/how-...dism-commands/

Yes, tried that before, but just tried again. Apparently, DISM found nothing. Subsequently, sfc /scannow also found nothing - "Windows Resource protection did not find any integrity violations".

[Mark S.]

Couple of thoughts:
Do you use the Nvidia driver? It's known to cause this issue.
Did you do and sfc /VERIFYONLY on your W10 box?
What does the HS3 log/Event Mgr say was occurring before the crash? Any similarities between that and previous crashes?

Thanks, Z.

I have an ASRock motherboard with an Intel chipset, and on-board Intel graphics, audio, and ethernet. I am not aware of any Nvidia components. I do wonder about a driver problem. But the only drivers I use are the Intel stuff on the MB, basic Windows drivers, Epson and Brother printer drivers, a Realtek audio driver, and the Hi-Phone driver for HSPhone.

As described above, I tried DISM and sfc/scannow with nothing found. I tried sfc/verifyonly - again nothing.

I saw nothing unusual in the HS log before today's crash. At the time of the crash, a few events triggered to announce a "car going down the driveway", which involves Sonos plugin activity and executing four immediate script commands. But I see no errors in the log. Interestingly, yesterday's crash occurred at the time my "car coming up the driveway" event was happening, but again, no errors. So thank you for the suggestion, Z, there may be a common issue with these 2 events. I will disable the Drive Up and Drive Down events to see if that stops the crashes. But these events trigger several times per day, and a crash does not happen every time. The lack of errors is confusing.

Regarding other stuff in the Event Viewer, I do see this in System log at the same time as today's crash:
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 10/27/2016 1:55:42 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: LOCAL SERVICE
Computer: Audrey4
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3185A766-B338-11E4-A71E-12E3F512A338}
and APPID
{7006698D-2974-4091-A424-85DD0B909E23}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

I have no idea what any of that means.

Other than that, nothing else unusual in Event Viewer logs.

Thanks.

[vasrc]

Thanks, Z.

I have an ASRock motherboard with an Intel chipset, and on-board Intel graphics, audio, and ethernet. I am not aware of any Nvidia components. I do wonder about a driver problem. But the only drivers I use are the Intel stuff on the MB, basic Windows drivers, Epson and Brother printer drivers, a Realtek audio driver, and the Hi-Phone driver for HSPhone.

As described above, I tried DISM and sfc/scannow with nothing found. I tried sfc/verifyonly - again nothing.

I saw nothing unusual in the HS log before today's crash. At the time of the crash, a few events triggered to announce a "car going down the driveway", which involves Sonos plugin activity and executing four immediate script commands. But I see no errors in the log. Interestingly, yesterday's crash occurred at the time my "car coming up the driveway" event was happening, but again, no errors. So thank you for the suggestion, Z, there may be a common issue with these 2 events. I will disable the Drive Up and Drive Down events to see if that stops the crashes. But these events trigger several times per day, and a crash does not happen every time. The lack of errors is confusing.

Regarding other stuff in the Event Viewer, I do see this in System log at the same time as today's crash:
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 10/27/2016 1:55:42 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: LOCAL SERVICE
Computer: Audrey4
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3185A766-B338-11E4-A71E-12E3F512A338}
and APPID
{7006698D-2974-4091-A424-85DD0B909E23}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

I have no idea what any of that means.

Other than that, nothing else unusual in Event Viewer logs.

Thanks.

Looks like you're down to basic troubleshooting then. Intermittents are a pain to track down, especially when they only occur every couple of days. You may have to disable one PI/Event at a time to see if you can isolate it. The driveway alarms do sound suspicious. Just because one time it crashes and not another doesn't mean that's not the problem still, it may be related to another process as well. Typically when a problem isn't easily isolated, it can mean more than one failure is occurring (ie 2 things have to occur) to cause the problem.

Z

[sparkman]

For the errors that you are seeing in the log, try the steps outlined in this thread: https://social.technet.microsoft.com...w8itprogeneral.

Cheers
Al

[Michel]

Mark S,

There is a bunch of peoples having this problem at the moment https://forums.homeseer.com/showthre...=1#post1327205 and https://forums.homeseer.com/showthread.php?t=189890 and I noticed that you had encountered this a year ago. Did you ever resolve this "ntdll.dll" problem?

If so, your input would be greatly appreciated.

[Mark S.]

I'm sorry, Michel, but I never did figure out a solution. I gave up and went back to Windows 7 - crashes are rare now, and for different reasons.

[Michel]

The "ntdll.dll" crash discussed when this thread was re-opened in Oct 2017 was tied to the Bitdefender Anti-virus. The problem arised with many users following an automatic Bitdefender update from 2017 to 2018.

A solution that seems viable can be found in this thread/post :

https://forums.homeseer.com/showpost...&postcount=511

[Mark S.]

Perhaps BitDefender is one source. But I never used it.