Mag,
there is something more you may try, if you are willing to do some test for me :-)
You can run the Firewall Service with more strict settings for allocating memory. This way, when a memory corruption occurs we might know about it sooner - and hopefully it will be easier to debug it.
If you want, please download the pageheap utility from here (originaly from Microsoft)
http://public.avast.com/~rypacek/pageheap.exePlease download it and run with the following commandline:
pageheap /enable afwserv.exeIt case the Firewall Service crashes again, the memory dump created in the "logs" folder will point closely to the location where the corruption might have occured.
You can then disable the extra heap by:
pageheap /disable afwserv.exeWith this extra setup, afwserv would probably consume more memory that needed, so it should be used just during testing.
Even more advanced command line is this:
pageheap /enable afwserv.exe /debugNow, when the crash occurs, there should appear a window for command line debugger. (see picture). The command I would like you to type here is:
.dump /ma c:\afwserv.dmpThis will create even more detailed dump for me to analyze :-) You can then exit the debugger windows by the
q command.
Thanks a lot.
Lukas
EDIT: As I am looking at the screenshot I realize that for the /debug switch to work, you would probably need to have "Debugging Tools for Windows" installed. Which I don't want to trouble you with right now. If you would like to try just the pageheap /enable afwServ.exe test, it would help as well.