Exception 0xc0000374 in ntdll.dll

Avast Free Antivirus / Premium Security
1

Hello, I have a problem that the Avast service stops. There is no warning except that the icon gets a red cross. I have to open Avast regularly to verify that it is indeed working.

I have reinstalled Avast but it does not help.

This is a tablet, Microsoft Surface Pro 4 with Windows 10 Pro Anniversary, all updates.
Avast is updated automatically and calls itself 12.3.2280. I believe this problems appeared with this version - it has worked fine before.

A couple of times every day there is an application error in the Event log that looks like this:

Faulting application name: AvastSvc.exe, version: 12.3.3154.0, time stamp: 0x57b5c39d
Faulting module name: ntdll.dll, version: 10.0.14393.206, time stamp: 0x57dacde1
Exception code: 0xc0000374
Fault offset: 0x000d9841
Faulting process id: 0x300
Faulting application start time: 0x01d2220675c279e8
Faulting application path: C:\Program Files\AVAST Software\Avast\AvastSvc.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 9142417e-6934-4270-bc62-b2f6836ae62f
Faulting package full name: 
Faulting package-relative application ID:

I also get an APPCRASH events like this:

Fault bucket 108430277826, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: AvastSvc.exe
P2: 12.3.3154.0
P3: 57b5c39d
P4: StackHash_87e1
P5: 10.0.14393.206
P6: 57dacde1
P7: c0000374
P8: PCH_22_FROM_ntdll+0x0006E1BC
P9: 
P10: 

Attached files:
\\?\C:\Windows\Temp\WER437F.tmp.appcompat.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER443B.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AvastSvc.exe_b6d2ca30e9e480ce53a1d73d7889ae468f8c3a_a1800e8c_cab_301f4459\memory.hdmp
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AvastSvc.exe_b6d2ca30e9e480ce53a1d73d7889ae468f8c3a_a1800e8c_cab_301f4459\triagedump.dmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AvastSvc.exe_b6d2ca30e9e480ce53a1d73d7889ae468f8c3a_a1800e8c_304bb207

Analysis symbol: 
Rechecking for solution: 0
Report Id: 9142417e-6934-4270-bc62-b2f6836ae62f
Report Status: 0
Hashed bucket: 51e73f7d8b9ad7a05744d7306da0785b

And APPCRASH events like this:

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: AvastSvc.exe
P2: 12.3.3154.0
P3: 57b5c39d
P4: StackHash_b5a1
P5: 10.0.14393.206
P6: 57dacde1
P7: c0000374
P8: PCH_A6_FROM_ntdll+0x0006E1BC
P9: 
P10: 

Attached files:
\\?\C:\Windows\Temp\WERD31A.tmp.appcompat.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3C7.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AvastSvc.exe_f1557febab393f634e3162fb055a38357ec9a90_a1800e8c_cab_33a1d423\memory.hdmp
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AvastSvc.exe_f1557febab393f634e3162fb055a38357ec9a90_a1800e8c_cab_33a1d423\triagedump.dmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AvastSvc.exe_f1557febab393f634e3162fb055a38357ec9a90_a1800e8c_cab_33a1d423

Analysis symbol: 
Rechecking for solution: 0
Report Id: 60d44e86-9497-485f-98e2-45505b01f5f5
Report Status: 4
Hashed bucket:

And like this:

Fault bucket 129195193262, type 5
Event Name: FaultTolerantHeap
Response: Not available
Cab Id: 0

Problem signature:
P1: AvastSvc.exe
P2: 12.3.3154.0
P3: 57B5C39D
P4: ffffbaad
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\SERVIC~2\LOCALS~1\AppData\Local\Temp\FTHD200.tmp\fthempty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD211.tmp.WERInternalMetadata.xml

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: ca0c516c-8979-11e6-8224-5882a893175a
Report Status: 0
Hashed bucket: f75d26d1c78d59efd41bb443a4f72f09

And other events that look like this:

Fault bucket , type 0
Event Name: FaultTolerantHeap
Response: Not available
Cab Id: 0

Problem signature:
P1: AvastSvc.exe
P2: 12.3.3154.0
P3: 57B5C39D
P4: ffffbaad
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\SERVIC~2\LOCALS~1\AppData\Local\Temp\FTHA19F.tmp\fthempty.txt

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: 1606b91f-8c78-11e6-8225-bf1bbe1f02ae
Report Status: 2
Hashed bucket:
2
I have reinstalled Avast but it does not help.
Did you use aswclear ? If not, please do so and see if solves the problem.
3

I ran avastclear.exe downloaded from http://www.avast.com/uninstall-utility/ in Safe Mode, is this what you refer to as aswclear? If so, yes, but the exception in ntdll.dll still occurs after reboot, reinstall and reboot.

Just a minute ago, I got this

Faulting application name: AvastSvc.exe, version: 12.3.3154.0, time stamp: 0x57b5c39d
Faulting module name: ntdll.dll, version: 10.0.14393.206, time stamp: 0x57dacde1
Exception code: 0xc0000374
Fault offset: 0x000d9841
Faulting process id: 0x6f8
Faulting application start time: 0x01d22219ab026268
Faulting application path: C:\Program Files\AVAST Software\Avast\AvastSvc.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: d5988430-c53c-4a6b-8b25-6cabec86b504
Faulting package full name: 
Faulting package-relative application ID:

Is is my impression that it may have to do with hibernation. At least it often happens just a few minutes after I have resumed from hibernation.

This time the service recovered, I saw the “You are unprotected” message but then it switched back to “protected”. But it may be the same error that at other times causes the service to stop permanently, so I’m reporting it anyway.

4

I suggest to send avast a support package.
https://www.avast.com/faq.php?article=AVKB33