Random CTDs in games, same exception code c0000005

[Zakarro]

Funny part is googling the event code and locale id comes up with a tons of matches.

I think I understand what the problem is, I think its a memory buffer overflow. Thing is I don't know if its malware causing it or just conflicting software.

 

[Zakarro]

The problem is not only happening with games, it used to happen sometimes to Avira antivirus and now its happening again.

Im really out of ideas here.....

 

[Zakarro]

If this is of any relevance event viewer shows this happening right at the same time as the avira crash.
These are the two crash reports at same exact time.

Log Name: Application
Source: .NET Runtime
Date: 7/26/2014 8:00:10 AM
Event ID: 1026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: xxxxxxxx
Description:
Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66C1EE4C
Stack:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-07-26T15:00:10.000000000Z" />
<EventRecordID>1733</EventRecordID>
<Channel>Application</Channel>
<Computer>xxxxxxx</Computer>
<Security />
</System>
<EventData>
<Data>Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66C1EE4C
Stack:
</Data>
</EventData>
</Event>

And this is the actual avira crash at same exact time.

Log Name: Application
Source: Application Error
Date: 7/26/2014 8:00:10 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: xxxxxx
Description:
Faulting application name: Avira.OE.Systray.exe, version: 1.1.17.31000, time stamp: 0x53ba89f5
Faulting module name: AppProfiles.dll, version: 1.0.5.5, time stamp: 0x5277f418
Exception code: 0xc0000005
Fault offset: 0x0002ee4c
Faulting process id: 0xf70
Faulting application start time: 0x01cfa8e1f9670f2b
Faulting application path: C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
Faulting module path: C:\Program Files (x86)\RadeonPro\AppProfiles.dll
Report Id: 89a0d1e5-14d5-11e4-826d-d050991a2af0
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-07-26T15:00:10.000000000Z" />
<EventRecordID>1734</EventRecordID>
<Channel>Application</Channel>
<Computer>xxxxxxx</Computer>
<Security />
</System>
<EventData>
<Data>Avira.OE.Systray.exe</Data>
<Data>1.1.17.31000</Data>
<Data>53ba89f5</Data>
<Data>AppProfiles.dll</Data>
<Data>1.0.5.5</Data>
<Data>5277f418</Data>
<Data>c0000005</Data>
<Data>0002ee4c</Data>
<Data>f70</Data>
<Data>01cfa8e1f9670f2b</Data>
<Data>C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe</Data>
<Data>C:\Program Files (x86)\RadeonPro\AppProfiles.dll</Data>
<Data>89a0d1e5-14d5-11e4-826d-d050991a2af0</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>

I think the problem might have to do with .NET runtime since that's what the first crash points too as source, thing is I have both .NET framework 3.5 and 4.5 installed, I don't know what the problem could be.

 

[usasma]

As I stated earlier, I am out of ideas.
If you want to pursue this further, please post over in the General forums here: General Support - Windows 8 Forums

 

[Zakarro]

As I stated earlier, I am out of ideas.
If you want to pursue this further, please post over in the General forums here: General Support - Windows 8 Forums

Isnt this the general support forum? You moved the post here after all.....

 

[usasma]

My mistake! I don't know who moved it here - and I was never notified that the topic had been moved.

I wonder if no one else is responding because we've already established a continuing topic (they don't want to interfere in the work that was ongoing).

I strongly suggest that you start a new topic - that way others will feel free to chime in and make suggestions.
Good luck!

 

[Zakarro]

I tihnk the problem has to do with this since according to event viewer a second before each crash I get the above kind of security audit as above.

http://www.eightforums.com/system-s...curity-audit-events-my-sytem-compromised.html

This has happened on passed 3 computers all new hardware. So I tihink its safe to say network is comprised and there is an attack coming from the outside.

 

[usasma]

Based on the info in the PM that you sent me:

From here ( joeware ) that logon session ID belongs to Session 0
Along with the rest of the stuff that you posted, I suspect it's a problem with the rogame.exe process making memory access' that it doesn't have permission to do.

First step is to uninstall the game and see if that stops the errors.
If that does it, then the next step is to install the latest, Win8.1 compatible version of the game (on a fully updated system) and see if the problem returns.

If you're worried about a hijack/compromise of your system, I'd suggest doing several independent scans of your system.
Here's a link to an older list of free scans that I made: Free Online AntiMalware Resources
It's an older list, so some of them may not work with Win8.1

 

[Zakarro]

Actually a lot of appz were crashing not the just the game, I think I solved it from help from a friend who said it may have to do with a service, in concrete the windows error reporting service, I had it on manual and set it to auto and so far no crashes. Either that or it has to do with API monitoring on video tweaking tool called radeon pro, I just found out that was causing Razer mouse driver to crash with same exception code and locale id as games.

As far as system compromised is concerned it has happened in the past but were not baby viruses. They were hacking in and dropping custom rootkits and firmware rootkits for the hardware.

Which is why Im buying kaspersky UEFI av as soon as its realeased to the public.