Microsoft Outlook Application Crash due to UCRTBASE.DLL

Anonymous
2020-12-07T17:43:25+00:00

Windows 10 Build 2004

Outlook crashes intermittently and generates the following Application Event Log error.

Event 1000, Application Error (11:06AM, 12/7/2020) Faulting application name: OUTLOOK.EXE, version: 16.0.13426.20308, time stamp: 0x5fc6ea9b Faulting module name: ucrtbase.dll, version: 10.0.19041.546, time stamp: 0x73123758 Exception code: 0xc0000409 Fault offset: 0x0009edbb Faulting process id: 0x41c0 Faulting application start time: 0x01d6ccaedccaa9fa Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Faulting module path: C:\WINDOWS\System32\ucrtbase.dll Report Id: f8791f7b-faf7-452a-8ff2-7268662a6db2 Faulting package full name: Faulting package-relative application ID:

I have run SFC /SCANNOW

I have completely uninstalled and reinstalled Microsoft Office 365

Here are the properties of the failing file:

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

69 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2021-01-18T13:36:13+00:00

    Latest test results with Sophos completely turned-off: no new crashes of Outlook.

    I just created a support ticket by Sophos.

    For the meantime I added

    C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

    and

    C:\WINDOWS\System32\ucrtbase.dll

    to the Global Exclusion list within Sophos Central, hopefully to prevent our users from getting annoyed by sudden crashes of Outlook.

    At Microsoft support's request I have completely uninstalled and reinstalled Sophos on the affected computers.  Waiting to see if this actually resolves the issue, if not I will be implementing these exclusions myself.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2021-01-18T13:58:15+00:00

    Sophos have replied with following request:

     1) Access the following folder: C:\Windows\System32\drivers\

        2) Rename hmpalert.sys to hmpalert.orig

        3) Reboot the computer.

        4) Test the issue and share result

        5) Revert the changes

        1) Access the following folder: C:\Windows\System32\

        2) Rename hmpalert.dll to hmpalert.orig

        3) Access the following folder:C:\Windows\SysWOW64\

        4) Rename hmpalert.dll to hmpalert.orig

        5) Reboot the computer

        6) Test the issue and share result

        7) Revert the changes

        1) Access the following folder: C:\Windows\System32\drivers\

        2) Rename savonaccess.sys to savonaccess.orig

        3) Reboot the computer.

        4) Test the issue and share result

        5) Revert the changes

    Unfortunately, the crashes can go hours between occurences so thats a lot of reboots and waiting.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2021-01-18T15:23:37+00:00

    I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

    I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

    • create a new e-mail
    • write some lines in the body
    • discard the e-mail

    repeat that for 100 times.

    With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

    With all Sophos components disabled, all 100 times are succesful.

    But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 100 tries.

    A few more Sophos components te go...

    Was this answer helpful?

    0 comments
  4. Anonymous
    2021-01-18T21:02:54+00:00

    I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

    I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

    • create a new e-mail
    • write some lines in the body
    • discard the e-mail

    repeat that for 100 times.

    With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

    With all Sophos components disabled, all 100 times are succesful.

    But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 1000 tries.

    A few more Sophos components te go...

    Did the exceptions for OUTLOOK.EXE and UCRTBASE.DLL stop the crashes?  I added the exceptions this afternoon (18, Jan 2021) but I will remove them again if this has already proven to be ineffective.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2021-01-19T08:28:45+00:00

    No they did not help. I will remove them as well.

    Was this answer helpful?

    0 comments