locked
Skype 6.18 crash even after exception provided for EAF RRS feed

  • Question

  • Hi Support, 

    We have deployed EMET 5 to our 50 users. We observed that some Windows 7 x64  and Windows 8.1 x64 are facing issues with Skype. We observed that EMET is causing exe to stop. Uninstalling EMET resolve the problem and EMET 4.1 update 1 works fine with Skype 6.18.32.106 version. Our group policy already specify EAF, EAF+ protection are disabled for Skype.

    It does not work even after downgrading Skype to any lower version. Can you please suggest best way to resolve the problem?

    1. Upgrade EMET 5 from version 4.1 update 1
    2. Upgrade Skype from version 6.14 to 6.18
    3. Quit Skype and Restart application
    Tuesday, August 5, 2014 1:00 PM

All replies

  • Skype throw below error in event viewer

    Faulting application name: Skype.exe, version: 6.18.60.106, time stamp: 0x53d154b0
    Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x53159a86
    Exception code: 0xe06d7363
    Fault offset: 0x0000c42d
    Faulting process id: 0x31ec
    Faulting application start time: 0x01cfb0a510194fc2
    Faulting application path: C:\Program Files (x86)\Skype\Phone\Skype.exe
    Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
    Report Id: 4ea3c722-1c98-11e4-9ab4-f8b156c39b2b

    EMET error:

    Fault bucket , type 0
    Event Name: APPCRASH
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: Skype.exe
    P2: 6.18.60.106
    P3: 53d154b0
    P4: KERNELBASE.dll
    P5: 6.1.7601.18409
    P6: 53159a86
    P7: 000006a6
    P8: 0000c42d
    P9: 
    P10: 

    Attached files:

    These files may be available here:
    C:\Users\username\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_Skype.exe_7e29ea3d4cc8a8552ac2bf4a961b6348a4ac310_314b936e

    Analysis symbol: 
    Rechecking for solution: 0
    Report Id: 0a6699c2-1c98-11e4-9ab4-f8b156c39b2b
    Report Status: 0




    EMET detected DEP mitigation and will close the application: Skype.exe

    DEP check failed:
      Application  : C:\Program Files (x86)\Skype\Phone\Skype.exe
      User Name  : 
      Session ID  : 1
      PID   : 0x2FC8 (12232)
      TID   : 0x2560 (9568)
      Module  : N/A
      Mod Base  : 0x00000000
      Mod Address  : 0x00FAAD78
      Mem Address  : 0x00FAAD78

    • Edited by San_G Tuesday, August 5, 2014 1:35 PM EMET error added
    • Proposed as answer by ST-TPS Monday, September 15, 2014 7:33 AM
    Tuesday, August 5, 2014 1:34 PM
  • Did you try to disable the other mitigations one by one? Maybe the combination with the mitigation Stack Pivot causes the crashes.

    W. Spu

    Tuesday, August 5, 2014 4:04 PM
  • The protections EAF and EAF+ are unchecked by default on my system. I have also unckecked Stack Pivot and now Skype starts....

    W. Spu


    • Proposed as answer by W. Spu Wednesday, August 6, 2014 7:50 AM
    • Edited by W. Spu Wednesday, August 6, 2014 7:52 AM added that EAF and EAF+ are unchecked by default.
    • Unproposed as answer by W. Spu Wednesday, August 6, 2014 2:52 PM
    • Proposed as answer by itpadla Monday, August 18, 2014 6:31 PM
    Wednesday, August 6, 2014 7:49 AM
  • I had to disable DEP to make it working. It is really strange problem as it work for some system and for some it did not work. 
    • Proposed as answer by ST-TPS Monday, September 15, 2014 7:34 AM
    Wednesday, August 6, 2014 10:15 AM
  • I had to change the settings to  "skype.exe -DEP -SEHOP -EAF -StackPivot" to get skype 6.18 going on all computers.

    EMET.admx:
    <item key="Software\Policies\Microsoft\EMET\Defaults" valueName="Skype">
        <value>
            <string>*\Skype\Phone\Skype.exe -DEP -SEHOP -EAF -StackPivot</string>
        </value>
    </item>

    EMET.adml:
    <presentation id="Misc_Text">
        <text>Included products and mitigations:</text>
            <text>- Skype - all mitigations except DEP, SEHOP, EAF, StackPivot</text>

    • Proposed as answer by ST-TPS Monday, September 15, 2014 7:33 AM
    Monday, September 8, 2014 9:10 AM
  • @Fredrikm

    Your Solution worked for me! Thanks

    Wednesday, October 15, 2014 7:19 PM