Exception in svchost

Just in time debugger caught an exception in SVCHOST.EXE.

Unhandled exception at 0x00007FFCA22B6F9F (ntdll.dll) in svchost.exe: 0xC0000005: Access violation writing location 0x0000016CC197A754.

Call stack:
> ntdll.dll!RtlLeaveCriticalSection() Unknown
mbamsi64.dll!00007ffc8a82663d() Unknown
mbamsi64.dll!00007ffc8a8443af() Unknown
amsi.dll!ATL::CComObject<class CAmsiAntimalware>::`vector deleting destructor'(unsigned int) Unknown
amsi.dll!ATL::CComObject<class CAmsiAntimalware>::Release(void) Unknown
amsi.dll!AmsiUninitialize() Unknown
fastprox.dll!JAmsi::JAmsiUninitializeContext(void) Unknown
fastprox.dll!CWbemSvcWrapper::~CWbemSvcWrapper() Unknown
fastprox.dll!CWbemSvcWrapper::`vector deleting destructor'(unsigned int) Unknown
wbemcomn.dll!CUnk::Release(void) Unknown
fastprox.dll!CSvcProxyBuffer::~CSvcProxyBuffer() Unknown
fastprox.dll!CSvcProxyBuffer::`vector deleting destructor'(unsigned int) Unknown
fastprox.dll!CBaseProxyBuffer::Release(void) Unknown
combase.dll!CStdMarshal::ReleaseProxy(tagIPIDEntry * pEntry) Line 8008 C++
[Inline Frame] combase.dll!CStdMarshal::ReleaseAllClientIPIDEntries() Line 7922 C++
[Inline Frame] combase.dll!CStdMarshal::{dtor}() Line 668 C++
[Inline Frame] combase.dll!CStdIdentity::{dtor}() Line 405 C++
combase.dll!CStdIdentity::CInternalUnk::Release() Line 945 C++
wuauengcore.dll!GetComputerInfoFromWMI(wchar_t * *,wchar_t * *,wchar_t * *,wchar_t * *,wchar_t * *) Unknown
wuauengcore.dll!CCommonAttributeProvider::AppendDeviceTarget(wchar_t *,unsigned __int64,wchar_t * *,unsigned __int64 *) Unknown
wuauengcore.dll!CCommonAttributeProvider::GetCommonAttributes(struct _GUID const &,wchar_t *,unsigned __int64,wchar_t * *,unsigned __int64 *,class AADDeviceDataBoundaryInfo *) Unknown
wuauengcore.dll!CSLSRequest::BuildRequest(void) Unknown
wuauengcore.dll!CSLSClient::GetSLSData(struct _GUID const &,enum tagSlsFlags,class CCallerIdentity const *,void *,unsigned long *,char * *,struct _FILETIME *,unsigned __int64 *) Unknown
wuauengcore.dll!CSLSEndpointProvider::GetWUClientData(void *,struct _GUID const &,bool,class CCallerIdentity const *,bool,unsigned long *,char * *,char const *) Unknown
wuauengcore.dll!CSLSEndpointProvider::GetZeroRatingPrefixes(void *,class CCallerIdentity const *,unsigned long *,struct tagZeroRatingPrefixInfo * *,long *) Unknown
wuauengcore.dll!CSusService::IsMOZeroRatingContent(wchar_t const *,void * const &) Unknown
wuauengcore.dll!CAgentDownloadManager::GetMODownloadRestrictionsForCall(bool,struct tagMatchingUpdate const &,struct _GUID const &,wchar_t const *,enum TriState,enum MODownloadRestrictions *) Unknown
wuauengcore.dll!CAgentDownloadManager::CheckCallDownloadState(class CDownloadCallWrap *,class CDynamicDataRefreshResult const *) Unknown
wuauengcore.dll!CAgentDownloadManager::CheckAllCallDownloadStates(struct _GUID const *,class CDynamicDataRefreshResult const *) Unknown
wuauengcore.dll!CAgentDownloadManager:rocessGeneralWorkItem(void) Unknown
wuauengcore.dll!CAgentDownloadManager:rocessWorkItem(enum tagWorkItemType,unsigned long) Unknown
wuauengcore.dll!CWorkItemManager::ExecuteWorkItemWrapper(void *) Unknown
kernel32.dll!BaseThreadInitThunk() Unknown
ntdll.dll!RtlUserThreadStart() Unknown

David

What is it exactly you’re referring to, as far as i know, most if not all of those dll’s are used by Microsoft?

Yes indeed its a fault in a MS service - the question is which one?

Starting in Windows 10, version 1903, if your AMSI provider DLL is not Authenticode-signed, then it may not be loaded (depending on how the host machine is configured). For full details, see IAntimalwareProvider interface.

Your antimalware possibly created the issue.
You should open a new post with appropriate logs and alert @zbook

I never got a BSOD. I'm using Windows Defender

perdrix said:

I never got a BSOD. I'm using Windows Defender

Click to expand...

So no crash? Just an event log exception?
This could have happened because of a process restart triggered by WU as mentioned in the log.
Stay away from the event logs, you'll sleep better.

No, a definite exception but it's being caught by the Just in Time debugger.