This crash signature currently has rather high volume. It has evolved compared to the initial description. Currently, all reports are from Windows 11 22H2 10.0.22621 users (or above 10.0.22631), using ZoneAlarm Anti-Keylogger. The crash occurs because of a DLL injected by the product: `icsak.dll`. New example crash report: [here](https://crash-stats.mozilla.org/report/index/e423a9ed-a820-47af-bf16-892980230714) New example crashing stack (partially incorrect because `icsak.dll` is unavailable): ``` 0 msctf.dll TF_Notify 1 icsak.dll icsak.dll@0x3a17 2 icsak.dll icsak.dll@0x5df27 3 icsak.dll icsak.dll@0x8cdf7 4 icsak.dll icsak.dll@0x8ce97 5 icsak.dll icsak.dll@0x8cdf7 6 user32.dll CtfHookProcWorker(int, uint64_t, int64_t, uint64_t) scan 7 user32.dll CallHookWithSEH(_GENERICHOOKHEADER*, void*, unsigned long*, uint64_t) cfi 8 user32.dll _fnHkINLPCHARHOOKSTRUCT cfi 9 ntdll.dll KiUserCallbackDispatch cfi 10 win32u.dll ZwUserPeekMessage cfi 11 icsak.dll icsak.dll@0x50b3 cfi 12 user32.dll _PeekMessage(tagMSG*, HWND__*, unsigned int, unsigned int, unsigned int, unsigned int, int) scan 13 user32.dll PeekMessageW cfi 14 icsak.dll icsak.dll@0x4e3c cfi 15 user32.dll PeekMessageW scan 16 icsak.dll icsak.dll@0x4a20 cfi 17 icsak.dll icsak.dll@0x8ccff scan 18 icsak.dll icsak.dll@0x8cdf7 scan 19 icsak.dll icsak.dll@0x8ce07 scan 20 icsak.dll icsak.dll@0x4fdc scan 21 xul.dll mozilla::widget::WinUtils::WaitForMessage(unsigned long) widget/windows/WinUtils.cpp:509 scan 22 xul.dll mozilla::widget::WinUtils::PeekMessage(tagMSG*, HWND__*, unsigned int, unsigned int, unsigned int) widget/windows/WinUtils.cpp:419 inlined 22 xul.dll nsAppShell::ProcessNextNativeEvent(bool) widget/windows/nsAppShell.cpp:717 cfi 23 xul.dll nsBaseAppShell::DoProcessNextNativeEvent(bool) widget/nsBaseAppShell.cpp:131 inlined 23 xul.dll nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) widget/nsBaseAppShell.cpp:267 inlined 23 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1154 inlined 23 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:479 cfi 24 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:107 cfi 25 xul.dll MessageLoop::RunInternal() ipc/chromium/src/base/message_loop.cc:368 inlined 25 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:361 cfi 26 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:343 cfi 27 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148 cfi 28 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp:615 cfi 29 xul.dll nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:295 cfi 30 xul.dll XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:5659 cfi 31 xul.dll XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:5859 cfi 32 xul.dll XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:5915 cfi 33 firefox.exe do_main(int, char**, char**) browser/app/nsBrowserApp.cpp:227 inlined 33 firefox.exe NS_internal_main(int, char**, char**) browser/app/nsBrowserApp.cpp:445 inlined 33 firefox.exe wmain(int, wchar_t**) toolkit/xre/nsWindowsWMain.cpp:167 cfi 34 firefox.exe invoke_main() /builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl:90 inlined 34 firefox.exe __scrt_common_main_seh() /builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl:288 cfi 35 kernel32.dll BaseThreadInitThunk cfi 36 ntdll.dll RtlUserThreadStart ``` User comments suggest that the crash happens with other browsers as well (possibly Opera and Chrome, but not Edge and Brave?), and that it occurs after they start to type a message, e.g. when sending a message on a Facebook Messenger or when searching on DuckDuckGo. `icsak.dll` is part of [a feature of ZoneAlarm called Anti-Keylogger](https://www.zonealarm.com/learning-center/web-privacy-and-security) which requires a premium account and presumably a manual activation. We should block the current versions of `icsak.dll` and ping Check Point Software about this crash so that they fix it. Most likely, they don't adapt well to something new with Windows 11 22H2. NI [:gstoll] to be sure this gets proper attention.
Bug 1777960 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This crash signature currently has rather high volume. It has evolved compared to the initial description. Currently, all reports are from Windows 11 22H2 10.0.22621 users (or above: 10.0.22631), using ZoneAlarm Anti-Keylogger. The crash occurs because of a DLL injected by the product: `icsak.dll`. New example crash report: [here](https://crash-stats.mozilla.org/report/index/e423a9ed-a820-47af-bf16-892980230714) New example crashing stack (partially incorrect because `icsak.dll` is unavailable): ``` 0 msctf.dll TF_Notify 1 icsak.dll icsak.dll@0x3a17 2 icsak.dll icsak.dll@0x5df27 3 icsak.dll icsak.dll@0x8cdf7 4 icsak.dll icsak.dll@0x8ce97 5 icsak.dll icsak.dll@0x8cdf7 6 user32.dll CtfHookProcWorker(int, uint64_t, int64_t, uint64_t) scan 7 user32.dll CallHookWithSEH(_GENERICHOOKHEADER*, void*, unsigned long*, uint64_t) cfi 8 user32.dll _fnHkINLPCHARHOOKSTRUCT cfi 9 ntdll.dll KiUserCallbackDispatch cfi 10 win32u.dll ZwUserPeekMessage cfi 11 icsak.dll icsak.dll@0x50b3 cfi 12 user32.dll _PeekMessage(tagMSG*, HWND__*, unsigned int, unsigned int, unsigned int, unsigned int, int) scan 13 user32.dll PeekMessageW cfi 14 icsak.dll icsak.dll@0x4e3c cfi 15 user32.dll PeekMessageW scan 16 icsak.dll icsak.dll@0x4a20 cfi 17 icsak.dll icsak.dll@0x8ccff scan 18 icsak.dll icsak.dll@0x8cdf7 scan 19 icsak.dll icsak.dll@0x8ce07 scan 20 icsak.dll icsak.dll@0x4fdc scan 21 xul.dll mozilla::widget::WinUtils::WaitForMessage(unsigned long) widget/windows/WinUtils.cpp:509 scan 22 xul.dll mozilla::widget::WinUtils::PeekMessage(tagMSG*, HWND__*, unsigned int, unsigned int, unsigned int) widget/windows/WinUtils.cpp:419 inlined 22 xul.dll nsAppShell::ProcessNextNativeEvent(bool) widget/windows/nsAppShell.cpp:717 cfi 23 xul.dll nsBaseAppShell::DoProcessNextNativeEvent(bool) widget/nsBaseAppShell.cpp:131 inlined 23 xul.dll nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) widget/nsBaseAppShell.cpp:267 inlined 23 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1154 inlined 23 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:479 cfi 24 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:107 cfi 25 xul.dll MessageLoop::RunInternal() ipc/chromium/src/base/message_loop.cc:368 inlined 25 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:361 cfi 26 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:343 cfi 27 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148 cfi 28 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp:615 cfi 29 xul.dll nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:295 cfi 30 xul.dll XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:5659 cfi 31 xul.dll XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:5859 cfi 32 xul.dll XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:5915 cfi 33 firefox.exe do_main(int, char**, char**) browser/app/nsBrowserApp.cpp:227 inlined 33 firefox.exe NS_internal_main(int, char**, char**) browser/app/nsBrowserApp.cpp:445 inlined 33 firefox.exe wmain(int, wchar_t**) toolkit/xre/nsWindowsWMain.cpp:167 cfi 34 firefox.exe invoke_main() /builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl:90 inlined 34 firefox.exe __scrt_common_main_seh() /builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl:288 cfi 35 kernel32.dll BaseThreadInitThunk cfi 36 ntdll.dll RtlUserThreadStart ``` User comments suggest that the crash happens with other browsers as well (possibly Opera and Chrome, but not Edge and Brave?), and that it occurs after they start to type a message, e.g. when sending a message on a Facebook Messenger or when searching on DuckDuckGo. `icsak.dll` is part of [a feature of ZoneAlarm called Anti-Keylogger](https://www.zonealarm.com/learning-center/web-privacy-and-security) which requires a premium account and presumably a manual activation. We should block the current versions of `icsak.dll` and ping Check Point Software about this crash so that they fix it. Most likely, they don't adapt well to something new with Windows 11 22H2. NI [:gstoll] to be sure this gets proper attention.