Avast Causing Windows Push Notifications User Service to Crash

[REDACTED]

Since 9/1/2018 the wpnuserservice has been constantly crashing, causing all notifications not to come in.

(notable symptoms include the focus assist button not working in the action center and visiting the focus assist page in the settings app causing the app to immediately crash.) The service crash seems to correlate with incoming notifications, such as receiving a new message in Skype.

Strangely the attempted service recovery actions (restart the service) fails all 3 times stating that and instance of the service is already running, despite clearly not running. However, manually starting the service via net start <servicename> works every time, and restores all functionality, until the next crash. I wonder if the restart fails because it is one of those new annoying "user services" where the name changes each time (the ones with the random numbers after the name).

I wrote my own script to manually find the new service name from sc query start and start the service via net start <servicename>, but it's hardly elegant, and the service still crashes.

After troubleshooting with the folks on the Microsoft Community Forum I have reliably determined that this only occurs with Avast installed. Uninstalling Avast (using avastclear) completely alleviates the problem. Reinstalling Avast causes the problem to return. Uninstalling Avast again alleviates the problem again.

I was running Avast free of the latest version as of this posting. I don't know the exact version as it is currently uninstalled.


The following are Event Viewer logs and basic system info.

Code: [Select]

Event 1000, Application Error

Faulting application name: svchost.exe_WpnUserService, version: 10.0.17134.1, time stamp: 0xa38b9ab2
Faulting module name: NotificationController.dll, version: 10.0.17134.165, time stamp: 0xe0385185
Exception code: 0xc0000005
Fault offset: 0x000000000007c686
Faulting process id: 0x46c
Faulting application start time: 0x01d44e4bd223d85c
Faulting application path: C:\WINDOWS\system32\svchost.exe
Faulting module path: C:\Windows\System32\NotificationController.dll
Report Id: 293fd13e-fb95-4408-a9ae-ec680215c0b1
Faulting package full name:
Faulting package-relative application ID:

Event 7032, Service Control Manager

The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Push Notifications User Service_67bb9 service, but this action failed with the following error:
An instance of the service is already running.
Other System Info

Code: [Select]

OS: Windows 10 Pro, Version 1803, OS build 17134.285

Processor: AMD FX 8320 3.50GHz

Chipset: AMD 970

Ram: 12GB

System Type: 64-bit

GPU: Nvidia GTX 970 (Driver Version 398.82)

Any help / ideas would be appreciated.

[Asyn]

Follow instructions: https://support.avast.com/article/33/ and post your File-ID here afterwards.

[kwiq]

Hi saberpeep,
would you share one dump of svchost.exe process we would like to analyze the crash issue.
Faulting module is NotificationController.dll which is windows component not related to avast Av.

Look for *.dmp file in c:\ drive  or use procdump tools (https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) and register it as postmortem debugger with following command :
procdump -ma -i c:\dumps

Thank you

[Tomáš Vybíral]

Hi saberpeep,
Do you have Do not Disturb component installed? If so what apps are you normally using (like what browser, music/video player, ...). Since Avast's DnD mode is stopping Windows Push Notification Service, when you enter fullscreen in any added application, this could be cause of your problem.  It is possible that some of these apps behave differently than others, so we don't start Wpn service again (but you still should be able to start it again, unless it sais its Stopping the service - in that case you need to kill the service svchost process, but that is not caused by Avast, I can reproduce this without Avast, just by simple python script).

[REDACTED]

Follow instructions: https://support.avast.com/article/33/ and post your File-ID here afterwards.

File-ID: UVRFZ
I made sure to run the tool after a crash so hopefully relevant information was collected in the logs
Do you need me to send you the zip file or has it been automatically sent somewhere already?

Hi saberpeep,
would you share one dump of svchost.exe process we would like to analyze the crash issue.
Faulting module is NotificationController.dll which is windows component not related to avast Av.

Look for *.dmp file in c:\ drive  or use procdump tools (https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) and register it as postmortem debugger with following command :
procdump -ma -i c:\dumps

Thank you

Here is the most recent crash dump, the date and time matches the last crash so it should be the right one.
https://drive.google.com/open?id=1p72_cwErsLvPijXaP0VdMozjL7AT46f1

Hi saberpeep,
Do you have Do not Disturb component installed? If so what apps are you normally using (like what browser, music/video player, ...). Since Avast's DnD mode is stopping Windows Push Notification Service, when you enter fullscreen in any added application, this could be cause of your problem.  It is possible that some of these apps behave differently than others, so we don't start Wpn service again (but you still should be able to start it again, unless it sais its Stopping the service - in that case you need to kill the service svchost process, but that is not caused by Avast, I can reproduce this without Avast, just by simple python script).

I do have the DND module installed, but this does not always occur when a fullscreen app is open. Also avast should really not be messing with the windows notification service as it uses its own notifications system. Also if it were avast properly stopping the service, the recovery actions would not have been triggered, but they do. The service enters a stopped state when crashes, thats not me doing that manually.

[Tomáš Vybíral]

I do have the DND module installed, but this does not always occur when a fullscreen app is open.

Yes but some apps have (for some reason) invisible fullscreen window, like for example Edge .

Also avast should really not be messing with the windows notification service as it uses its own notifications system.

Yes avast is using it's own notification system, but DnD mode stops user's WNC when apps are in fullscreen, to prevent push notification to disturb you.

The service enters a stopped state when crashes, thats not me doing that manually.

But if the service really crashes, then there is some other problem, since what I can reproduce blocks the service and doesn't crash it.

EDIT: Ok I was able to fully reproduce your problem (same errors in Event Viewer). I tested it without Avast and the service really gets stuck at Stopping, that's why the recovery actions fail. It seems if you restart the service really quickly (you are alt-tabbing from one fullscreen app to desktop and back) something fails and the service gets stuck at Stopping. DnD mode developer told me he tries to kill the svchost process but sometimes this also fails. Also there should be fix for the alt tabing problem in next version after 18.7. Right now stop using ether Avast's DnD mode or Win10 Focus Assist (or just in Avast's DnD mode settings turn off Silence notifications from 3rd-party apps). Hope this helps you

EDIT2: Can you please tell me your daily used apps (browser, music/video player, ...) to find out if some of them can cause problems with DnD mode that causes this problem.

[REDACTED]

I do have the DND module installed, but this does not always occur when a fullscreen app is open.

Yes but some apps have (for some reason) invisible fullscreen window, like for example Edge .

Also avast should really not be messing with the windows notification service as it uses its own notifications system.

Yes avast is using it's own notification system, but DnD mode stops user's WNC when apps are in fullscreen, to prevent push notification to disturb you.

The service enters a stopped state when crashes, thats not me doing that manually.

But if the service really crashes, then there is some other problem, since what I can reproduce blocks the service and doesn't crash it.

EDIT: Ok I was able to fully reproduce your problem (same errors in Event Viewer). I tested it without Avast and the service really gets stuck at Stopping, that's why the recovery actions fail. It seems if you restart the service really quickly (you are alt-tabbing from one fullscreen app to desktop and back) something fails and the service gets stuck at Stopping. DnD mode developer told me he tries to kill the svchost process but sometimes this also fails. Also there should be fix for the alt tabing problem in next version after 18.7. Right now stop using ether Avast's DnD mode or Win10 Focus Assist (or just in Avast's DnD mode settings turn off Silence notifications from 3rd-party apps). Hope this helps you

Shortly after you mentioned dnd I actually remembered that the "Silence notifications from 3rd-party apps" option would probably have been re-enabled by the re-install, so I disabled it. And I still just had a crash (as a skype notification came in) even with it off. I'm going to uninstall the DND component and see if it helps.

EDIT:

Can you please tell me your daily used apps (browser, music/video player, ...) to find out if some of them can cause problems with DnD mode that causes this problem.

Chrome, Skype, Steam, VLC, Warframe

[kwiq]

Hi reported to microsoft as a bug. 

00 00000015`f4efd808 00007fff`41056099 ntdll!NtWaitForMultipleObjects+0x14
01 00000015`f4efd810 00007fff`41055f8e KERNELBASE!WaitForMultipleObjectsEx+0xf9
02 00000015`f4efdb10 00007fff`43d970bb KERNELBASE!WaitForMultipleObjects+0xe
03 00000015`f4efdb50 00007fff`43d96b6c kernel32!WerpReportFaultInternal+0x51b
04 00000015`f4efdc70 00007fff`410fc26b kernel32!WerpReportFault+0xac
05 00000015`f4efdcb0 00007fff`44498e42 KERNELBASE!UnhandledExceptionFilter+0x35b
06 00000015`f4efddc0 00007fff`4443122d ntdll!TppWorkerpInnerExceptionFilter+0x1a
07 00000015`f4efddf0 00007fff`4441ab36 ntdll!TppWorkerThread$filt$0+0x19
08 00000015`f4efde30 00007fff`44429aee ntdll!_C_specific_handler+0x96
09 00000015`f4efdea0 00007fff`4442ed2d ntdll!_GSHandlerCheck_SEH+0x6a
0a 00000015`f4efded0 00007fff`44396c86 ntdll!RtlpExecuteHandlerForException+0xd
0b 00000015`f4efdf00 00007fff`4442dc5e ntdll!RtlDispatchException+0x3c6
0c 00000015`f4efe600 00007fff`06c6c686 ntdll!KiUserExceptionDispatch+0x2e
0d 00000015`f4efed20 00007fff`06c6247f NotificationController!DefaultToastFilterSink::Shutdown+0x42
0e 00000015`f4efed60 00007fff`2f6690c8 NotificationController!WpnPlatformShellHelper::Shutdown+0x4f
0f 00000015`f4efedf0 00007fff`436f7329 wpnuserservice!WpnUserService::RevokeClassFactoryCallback+0x88
10 00000015`f4efee40 00007fff`436f7ea8 combase!EnterForCallback+0x18d [onecore\com\combase\dcomrem\crossctx.cxx @ 2070]
11 00000015`f4efef50 00007fff`436ee300 combase!SwitchForCallback+0x28c [onecore\com\combase\dcomrem\crossctx.cxx @ 1692]
12 00000015`f4eff410 00007fff`436ea81f combase!PerformCallback+0x10c [onecore\com\combase\dcomrem\crossctx.cxx @ 1571]
13 00000015`f4eff470 00007fff`436eaaff combase!CObjectContext::InternalContextCallback+0x12f [onecore\com\combase\dcomrem\context.cxx @ 4420]
14 00000015`f4eff590 00007fff`4374a190 combase!CObjectContext::ContextCallback+0x8f [onecore\com\combase\dcomrem\context.cxx @ 4303]
15 00000015`f4eff630 00007fff`2f668c82 combase!CContextSwitcher::ContextCallback+0x50 [onecore\com\combase\dcomrem\ctxconnmgr.cxx @ 409]
16 00000015`f4eff680 00007fff`2f66d8fe wpnuserservice!WpnUserService::OnStopping+0x132
17 00000015`f4eff740 00007ff6`e9f12e61 wpnuserservice!ServiceBase::ServiceStop+0x82
18 00000015`f4eff770 00007fff`443d2e8b svchost!SvchostStopCallback+0x51
19 00000015`f4eff7a0 00007fff`443d2d34 ntdll!RtlpTpWaitCallback+0x9b
1a 00000015`f4eff810 00007fff`443af5c9 ntdll!TppExecuteWaitCallback+0xa0
1b 00000015`f4eff860 00007fff`43d43034 ntdll!TppWorkerThread+0x2a9
1c 00000015`f4effb50 00007fff`44401461 kernel32!BaseThreadInitThunk+0x14
1d 00000015`f4effb80 00000000`00000000 ntdll!RtlUserThreadStart+0x21

Here is a link to microsofts windows feedback with your report :
https://partner.microsoft.com/en-us/dashboard/collaborate/engagements/1485/feedback/wits/Bugs/133351

Thank you !

[kwiq]

Hi,
today we got a response from microsoft : The crash has been resolved. QuietHours will no longer crash on shutdown !