Read first: Previous version support information

1Password 7 crash, refuses to run

setigamer
setigamer
Community Member
edited April 2023 in 1Password 7 for Windows

I have not been able to run 1Password7 on my laptop for some time. Here's what I have...

1Password 7.2.576, installed 8/24, on Windows 10 laptop.I should have 2 images attached to this email. One is from msinfo32 describing my system info, and the second is the windows application event log showing the crash details. The issue is that 1Password7 worked fine until I applied a windows update, shown below. I haven't been able to get the desktop app to work since.
https://support.microsoft.com/en-us/help/4100347/intel-microcode-updates-for-windows-10-version-1803-and-windows-server

I do have the Firefox browser addon working just fine. That is what is what I'm using for now when I have to use the laptop.


1Password Version: 7.2.576
Extension Version: Not Provided
OS Version: Windows 10.0.1734s
Sync Type: Not Provided

Comments

  • MikeT
    MikeT

    Hi @setigamer,

    Thanks for reporting this.

    We need the .NET error that follows after the 1Password.exe error in the Event Viewer, the error isn't from 1Password but Microsoft's .NET runtime on your Windows PC. Windows 10 updates have .NET updates built in, so that could explain why this started after the update was installed.

    Instead of the screenshot of the .NET error in Event Viewer, you can right-click on the error to select Copy > Copy details as text and paste it here.

    After that, try to uninstall 1Password and then install a fresh copy from here: https://1Password.com/downloads/ to see if that'll help. Uninstalling from Apps & Features list will not remove your 1Password data.

  • setigamer
    setigamer
    Community Member

    You got it ... I got it and then reinstalled, same version, same error.

    Log Name: Application
    Source: Application Error
    Date: 9/12/2018 11:35:35 AM
    Event ID: 1000
    Task Category: (100)
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: SETINDUSTRY
    Description:
    Faulting application name: 1Password.exe, version: 7.2.576.0, time stamp: 0x5b69b6af
    Faulting module name: ntdll.dll, version: 10.0.17134.228, time stamp: 0x2c71c7b8
    Exception code: 0xc0000409
    Fault offset: 0x0005be3e
    Faulting process id: 0x108
    Faulting application start time: 0x01d44acfc6864779
    Faulting application path: C:\Users\noone\AppData\Local\1password\app\7\1Password.exe
    Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
    Report Id: 59f158ea-0d58-48c1-a6ff-89002a7f3f9f
    Faulting package full name:
    Faulting package-relative application ID:
    Event Xml:



    1000
    2
    100
    0x80000000000000

    28256
    Application
    SETINDUSTRY



    1Password.exe
    7.2.576.0
    5b69b6af
    ntdll.dll
    10.0.17134.228
    2c71c7b8
    c0000409
    0005be3e
    108
    01d44acfc6864779
    C:\Users\noone\AppData\Local\1password\app\7\1Password.exe
    C:\WINDOWS\SYSTEM32\ntdll.dll
    59f158ea-0d58-48c1-a6ff-89002a7f3f9f





  • setigamer
    setigamer
    Community Member

    Forgot to mention, this app used to work fine. I believe the problems coincided with the install of 2018-7 Update for Windows 10 Version 1803 (KB4100347)

    For grins I'll uninstall that and see what's up. Thanks for the help.

  • setigamer
    setigamer
    Community Member

    Uninstalling that didn't fix anything. Lot's of windows updates coming through now, I'll try the app again after they're done.

  • MikeT
    MikeT

    Hi @setigamer,

    I don't see any .NET errors in your log, did you select the .NET source right under 1Password?

    If you have a lot of Windows updates, then that may be the issue. We've seen crashes because of incomplete updates that is resolved when all updates are finished. We're not sure why it happens but hopefully, it is the case here for you.

  • setigamer
    setigamer
    Community Member
    edited September 2018

    I don't see any options to select any .NET source. The only thing after the 1pass error is the windows error reporting notice. I'll grab the .wer report.

    I had 3 updates, including the one that I uninstalled. I'm running sfc to verify integrity. I'll run dism and see if that finds anything too.
    I'm seriously contemplating resetting the darn thing.

  • setigamer
    setigamer
    Community Member

    Interesting, I didn't notice it before as I haven't run it in a while, but Acrobat Reader DC also crashes with the same fault.

  • MikeT
    MikeT

    Hi @setigamer,

    What's more interesting is that you didn't see .NET error. 1Password runs on .NET, .NET loads first and the last to exit the crash, meaning they should always be there to capture the crash report.

    Try to look at your Reliability History, see if there were any other updates that were installed. Open the Start menu and search for Reliability History to open it. See if there are other internal crashes you may not be seeing. If you see a lot of crashes, it is possible you may want to revert back to a system point created before the last update that worked fine.

  • setigamer
    setigamer
    Community Member

    And there's absolutely no other place it would report .NET errors?

  • MikeT
    MikeT

    As far as we know, it would go straight to Event Viewer.

    You can try to look in this directory but it may not help as it may not capture the .NET errors without 1Password being able to run once: %LOCALAPPDATA%\1Password\logs\events

    The last option is to try moving out your 1Password folder.

    1. Sign in to your 1Password account first using Firefox (https://my.1Password.com) and click your account name on top right to select Get the Apps
    2. Open Windows File Explorer and enter the following in the address bar: %LOCALAPPDATA%
    3. Move the 1Password folder to your desktop
    4. Install the latest 1Password file here: https://1Password.com/downloads/
    5. See if 1Password opens up without crashing. If yes, switch back to Firefox and scroll down to step 2 to find the blue Add your account details button, click it and 1Password should open up waiting for you to enter the master password.

    Hope this helps.

  • setigamer
    setigamer
    Community Member

    Well quite a bit has happened. It was certainly strange the way that both AdobeAcrobat Reader DC and 1Password quit working with similar winnt.dll seg faults. For a time I simply ran 1PasswordX on my laptop (win 10). It's worked flawless on the Mac.
    So yesterday I had something happen that took me by surprise, apparently my laptop has been totally compromised. I've got a persistent connectcion to a 172.19.x.x, private LAN. So I've been spending the better part of my day backing up all my files and I opened up a PDF and Adobe Acrobat fired up... so I was like, well no kidding, and tried 1Password. It has miraculously healed itself and runs like a charm now on my laptop. Hilarious. I upgraded to the latest.

    I did not find an events folder under logs. Frankly, I believe my system has been going through a very careful and slow takeover for the past 2 months. I've noticed weird things, but the straw (camel's back) yesterday I was at a clients' and not only did their internet wan router go down, but all the wifi modules synchronously rebooted. FML (hahaha)

    I know my payment is late, taken care of by later this evening. Close my case, all is well. Thanks a ton to you guys for holding me up for a bit.

    Vic Hanson
    PS. the only logs I have are the main log (which started today, I don't think 1PasswordX uses that location) and the setup from the upgrading. I can email them if wanted?

  • setigamer
    setigamer
    Community Member

    1Password blew up, I think the ghost in my machine tried to run a train on .Net, pretty sure he was trying to inject his own clr.dll. I got the .Net error in the application log this time. Post that first, then it's HitmanPro that debugged the breakin.Anywayhs, hope this helps. I'm rebuilding the laptop so I'll start fresh in a few days.

    Vic

    *** System Log Data ***



    • 1026
      2
      0
      0x80000000000000

      32780
      Application
      SETIDEV


    • Application: 1Password.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.NullReferenceException at AgileBits.OnePassword.ConsoleThread.Post(AgileBits.OnePassword.ConsoleLineType, System.Object) at AgileBits.OnePassword.ConsoleThread.Error(System.Object) at AgileBits.OnePassword.RegistryExpectation.LogException(System.Exception) at AgileBits.OnePassword.RegistryExpectation.Set() at AgileBits.OnePassword.AutoStartRegistration.Register(Boolean) at AgileBits.OnePassword.Program.Main(System.String[])


      *** End System Log Data ***

    **** Sophos Home Anti-virus / Hitman-Pro ****
    Mitigation CallerCheck

    Platform 10.0.17134/x64 v619 06_5e
    PID 54952
    Application C:\Users\noone\AppData\Local\1password\app\7\1Password.exe
    Description 1Password for Windows desktop 7.2

    Callee Type CreateProcess
    C:\Users\noone\AppData\Local\1password\app\7\1Password.exe

    Stack Trace

    Address Module Location

    1 03533D56 (anonymous; clr.dll)
    8b8ddcfeffff MOV ECX, [EBP-0x124]
    c6410801 MOV BYTE [ECX+0x8], 0x1
    833d4010937000 CMP DWORD [0x70931040], 0x0
    7407 JZ 0x3533d70
    50 PUSH EAX
    e861ffda6c CALL 0x702e3cd0
    58 POP EAX
    c785c0feffff00000000 MOV DWORD [EBP-0x140], 0x0
    8985fcfeffff MOV [EBP-0x104], EAX
    e8eb54d96c CALL 0x702c9270
    90 NOP
    8b85fcfeffff MOV EAX, [EBP-0x104]
    89850cffffff MOV [EBP-0xf4], EAX

    2 03533858 (anonymous; clr.dll)
    3 035333A3 (anonymous; clr.dll)
    4 03532530 (anonymous; clr.dll)
    5 6EBE12B9 mscorlib.ni.dll
    6 6EC029A5 mscorlib.ni.dll
    7 6EC028B6 mscorlib.ni.dll
    8 6EBE121B mscorlib.ni.dll
    9 6EBE159B mscorlib.ni.dll
    10 6EBACB72 mscorlib.ni.dll

    Process Trace
    1 C:\Users\noone\AppData\Local\1password\app\7\1Password.exe [54952]
    C:\Users\noone\AppData\Local\1password\app\7\1Password.exe chrome-extension://aomjjhallfgjeglblehebfpbcfeobpgk/ --parent-window=0
    2 C:\Windows\System32\cmd.exe [54900]
    C:\WINDOWS\system32\cmd.exe /d /c "C:\Users\noone\AppData\Local\1password\app\7\1Password.exe" chrome-extension://aomjjhallfgjeglblehebfpbcfeobpgk/ --parent-window=0 < \.\pipe\chrome.nativeMessaging.in.47f651532e9ac9a4 > \.\pipe\chrome.nativeMessaging.o
    3 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [53904]
    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "https://home.sophos.com/"
    4 C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe [54124]
    "C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe" /savalerts
    5 C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe [34948]
    6 C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [9472]
    7 C:\Windows\SysWOW64\runonce.exe [9392]
    C:\WINDOWS\SysWOW64\runonce.exe /Run6432
    8 C:\Windows\explorer.exe [7108]
    9 C:\Windows\System32\userinit.exe [5928]
    10 C:\Windows\System32\winlogon.exe [528]
    winlogon.exe

    Thumbprint
    2fb933fd62d97e9e6644863b753b68f33a07e96bc5a732fee9613149700155f4

  • setigamer
    setigamer
    Community Member

    I ran this problem down quite a bit. I ended up resetting my laptop to a fresh install, not trusting what was on it. I got Win10 installed and got the standalone 1Pass working great... until I installed firefox and allowed it to sync my profile. Boom, same anonymous clr.dll attempting to inject. I uninstalled it and system is running fine.

    Hoping that's the last of this LOL

  • AGAlumB
    AGAlumB
    1Password Alumni

    Jeez. I hope so too. Thanks for the update. I'm not sure how Firefox could sync a DLL, and from what I understand clr.dll is part of .Net Framework anyway. Hopefully it will be smooth sailing for you from now on!

  • MikeT
    MikeT

    Hi @setigamer,

    I see these in the stack trace:

    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "https://home.sophos.com/"
4 C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe [54124]
"C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe" /savalerts
5 C:\Program Files (x86)\Sophos\Sophos Home\SophosUI.exe [34948]

    Did you have Sophos extension installed in Firefox before? Sophos dislike 1Password's .NET JIT process, it'd block it by default as it flags it as a false positive, thinking it is infected with CallerCheck.

  • VicHanson
    VicHanson
    Community Member

    Mike, It's setigamer, I'm pretty sure I tried excluding the 1Password folder from Sophos.
    That said, I had to wipe all my systems this week. My Authy backup decryption password is inside my vault but I have 2-Factor auth enabled on 1Password. Is there a way to disable that so I can get in? I had to create a new user as my forum password for vkhanson is also in the vault :(.

  • MikeT
    MikeT

    Hi @VicHanson,

    Is there no single authorized device you can use that hasn't been reset, like an iPhone or Android device? Do you still have access to your original email address you used to sign up for 1Password?

    The point of 2FA was to make it very difficult to get into the account and we don't have an easy button to reset it, it's not within our powers to do so. With that said, we can try to help you figure out a way to recover your access. Please reach out to us at support+urgent@1password.com.

  • VicHanson
    VicHanson
    Community Member

    It's hard to describe, Mike, 2 weeks ago I realized someone was on my windows laptop (where 1passwd kept crashing). Full admin privs, by the time I found out they had me. Win10Pro with Sophos, then Mac OS X 10.13.6, and then my android cell phone. The forensics I managed to dig up before they deleted all their work was just shy of miraculous.
    I've been in damage control the last couple of days, the only REAL loss for me is my Discord account, I will no longer be setigamer. sigh
    I've already recovered my windows and google array of accounts, so easier to just set up a new vault. How about you reset my account and turn off that 2-FA so I can start fresh?

    Vic Hanson

  • MikeT
    MikeT
    edited October 2018

    Hi @VicHanson,

    You'll have to email us directly, we can't simply do it just because you asked nicely on a public forum, we don't know if it is you that owns either accounts here. support+urgent@1Password.com

This discussion has been closed.