107882 - McAfee WebScanX causes N622 crash [@ WBHOOK32.DLL ]

Status: VERIFIED WORKSFORME

(Core :: Networking, defect, P1)

Description

[Jan Carpenter]

This bug is a topcrasher for N620.

(networking?)

Here is a recent stack trace. (most of them look like this):
 Stack trace(Frame) 

	 WBHOOK32.DLL + 0x7599 (0x11c07599)  
	 WS2_32.DLL + 0x590f (0x7600590f)  
	 WS2_32.DLL + 0x53dc (0x760053dc)  
	 WS2_32.DLL + 0x78bb (0x760078bb)  
	 WS2_32.DLL + 0x7822 (0x76007822)  
	 WS2_32.DLL + 0x4b6f (0x76004b6f)  
	 WS2_32.DLL + 0x4811 (0x76004811)  
	 WS2_32.DLL + 0x1a08 (0x76001a08)  
	 WS2_32.DLL + 0x194d (0x7600194d)  
	 0x043e8008

 
Here are the offsets with their comments:

WBHOOK32.DLL + 0x7599
WBHOOK32.DLL + 0x7589
WBHOOK32.DLL + 0x831e
WBHOOK32.DLL + 0x2e6a
 (37411534)	Comments: I was attempting to open Netscape 6.2 for the first time after
installation

WBHOOK32.DLL + 0x7ecf
 (37419602)	Comments: Loading the program


The last offset has this different stack signature:

 Stack trace(Frame) 

	 WBHOOK32.DLL + 0x7ecf (0x11c07ecf)  
	 _PR_MD_SEND
[../../../../../pr/src/md/windows/w95sock.c  line 231] 
	 SocketSend
[../../../../pr/src/io/prsocket.c  line 682] 
	 SocketWrite
[../../../../pr/src/io/prsocket.c  line 702] 
	 PR_Write
[../../../../pr/src/io/priometh.c  line 142] 
	 PR_SetPollableEvent
[../../../../pr/src/io/prpolevt.c  line 499] 
	 nsSocketTransportService::AddToWorkQ
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsSocketTransportService.cpp  line
199] 
	 0x008a99f0  
	 _pr_PolEvtClose
[../../../../pr/src/io/prpolevt.c  line 474] 
	 0xf000e2c3  
	 0x6c6f5063

Comment 1

[Darin Fisher]

how frequent is this crasher?

Comment 2

[Jay Patel [:jay]]

In 2 days since the Netscape 6.20 release, we have seen 26 of these crashes from
a total incident count of 2166...so about 1.2% of crashes with N620 are of this
kind so far.  That number will rise as we get more and more users downloading it
and running it for the first time.  Here are some more user comments:

(37478258)
Comments: Launching the browser 
     (37475737)	Comments: startup
     (37468540)	Comments: After experiencing multiple "Page Faults" with 6.1  we upgraded to
6.2 and we are still getting (see also user [e-mail]):NETSCP6 caused
an invalid page fault inmodule WBHOOK32.DLL at
0167:11c073b6.Registers:EAX=00000030 CS=0167
     (37468540)	Comments:  EIP=11c073b6 EFLGS=00010246EBX=061a5a60 SS=016f ESP=05b6fb78
EBP=80000000ECX=ce210cb0 DS=016f ESI=00000000 FS=6707EDX=875de4cc ES=016f
EDI=00000000 GS=0000Bytes at CS:EIP:8d 4c 24 04 51 68 18 17 c3 11 e8 0b 92 00 00
83 Stack dump:000001d4
     (37468540)	Comments:  505c3a43 52474f52 46204d41 53454c49 54454e5c 50414353 454e5c45
41435354 36204550 54454e5c 36504353 4558452e 05b6fc00 061a1070 60f118d6 
     (37468451)	URL: netscape.com
     (37468405)	URL: netscape.com
     (37468405)	Comments: booting software
     (37464691)	Comments: won't load netscape6.2
     (37419602)	Comments: Loading the program

Comment 3

[Darin Fisher]

-> 0.9.7

Comment 4

[Jan Carpenter]

This crash has 363 incidents on todays topcrash report.  This makes it #12 of
the top 40.  Here are the offsets and their associated comments:

 Count   Offset    Real Signature
[ 41   WBHOOK32.DLL + 0x73b6 (0x11c073b6) e6ab47bf - WBHOOK32.DLL + 0x73b6
(0x11c073b6) ]
[ 34   WBHOOK32.DLL + 0x73a6 (0x11c073a6) 87138c17 - WBHOOK32.DLL + 0x73a6
(0x11c073a6) ]

 Keyword List : load(6), netscape(15), start(8), browser(4),  
     Count   Platform List 
     33   Windows 98 4.10 build 67766446
     27   Windows 98 4.90 build 73010104
     11   Windows 98 4.10 build 67766222
     2   Windows 95 4.0 build 67306684
     2   Windows 95 4.0 build 67109975
  
     No of Unique Users        64

     (37971177)	URL: www.rummelreaiders.com
     (37962281)	Comments: Lauching!
     (37957414)	Comments: start up of browser
     (37944293)	Comments: Trying to open Netscape 6.2.
     (37934318)	Comments: Ptogram has performed an illegal operation & will be shut down
     (37932400)	URL: www.yahoo.com
     (37929569)	Comments: i tried to go into my internet browser
     (37913708)	Comments: I was just logging on.
     (37902486)	Comments: Opening it.
     (37868750)	Comments: we keep getting an "illegal operation" message and then netscape
will shut down.why is this happening??  will it stop soon???
     (37858173)	Comments: Starting it
     (37856062)	URL: www.rummelreaiders.com
     (37849620)	URL: www.rummelreaiders.com
     (37845565)	Comments: started up  crashey crashey
     (37845003)	Comments: This version is proving to be quite a problem.  I had trouble
installing it  then setting it up (not my problem by the way) and now it keeps
failing on start up - but only sporadically.  Not to mention that it's slower
than 4.7.
     (37836946)	URL: www.ihcatalog.com
     (37836946)	Comments: I was searching within the above catalog  and the screen kept
snapping down into about a 1" by 2" size  no matter how many times I maximized
it. I closed and reopened Netscape  but it would shrink each time I performed
the search.  After the third try I
     (37836946)	Comments:  got the  "must be terminated" box and then this.
     (37826870)	Comments: it was just loading....i think i should uninstall
     (37808151)	Comments: netscape crashed after starting
     (37807193)	Comments: launching netscape
     (37795431)	Comments: The failure occured while launching Netscape  simply.
     (37778344)	URL: http://www.cuttingedgemedia.com/ 
     (37778344)	Comments: Just went to start the program by click on a link in my email. 
Using Outlook 2000 on Win 95.  I like netscape better than explorer but this new
version 6.2 loads slow on my Athlon 1600 Mhz Athon XP
     (37774153)	Comments: checking for virus updates for mcafee
     (37771617)	Comments: starting up
     (37768381)	Comments: downloading java
     (37743105)	URL: www.rummelreaiders.com
     (37743105)	Comments: Opening program
     (37739365)	Comments: Launching Netscape
     (37717872)	Comments: loading Netscape
     (37707462)	Comments: During the start of the browser and sometimes when changing the
web addresses  the browser gives a message "An unknown error has occurred and
the browser will close now.  If the problem recurs  try restarting the
computer".  This error occurred many times
     (37707462)	Comments:  in Netscape6.1; I was disappointed it happened in v6.2 also which
I installed this morning.  Due to this lack of reliability  I am using MSN
Explorer 5.5  which seems to work well without any problems.  
     (37685782)	Comments: Loading Netscape.
     (37676278)	Comments: Mcaffee virus scan and crash protector continues to crash Netscape
6.2.  I just upgraded from netscape 6.1  hoping to solve the problem and it
still crashes.
     (37675450)	Comments: surfing
     (37672882)	Comments: opening the communicator
     (37634696)	Comments: opening program in win98se enviormentcompuserve 2000 connection
minimized but connected - has IE running as browser there 
     (37625966)	Comments: Loading Netscape  to check email
     (37595918)	URL: www.netscape.com
     (37595918)	Comments: Opening Netscape
     (37589478)	Comments: Pasting a URL from IE Explorer to Netscape
 

 Count   Offset    Real Signature
[ 17   WBHOOK32.DLL + 0x7599 (0x11c07599) 36828246 - WBHOOK32.DLL + 0x7599
(0x11c07599) ]

 Keyword List : netscape(4),  
     Count   Platform List 
     17   Windows 98 4.90 build 73010104
  
     No of Unique Users        15
     (37980835)	Comments: starting up
     (37923958)	URL: www.planetdreamcast.com/sonic/sonic.html
     (37912531)	Comments: just clicked to open browser is afrequent error may click to open
2-3 times and it will finally open
     (37908778)	URL:
http://www.moviefone.com/showtimes/movie.adp?page=previews&movieid=9548&date=20011112&uid=5620
     (37833522)	Comments: Just launched Netscape. This error occors often.
     (37827350)	Comments: Loading Netscape
     (37764638)	Comments: I am running windows me I just loaded it tonight I can not open it
i tried and treid this program worked on my win 98 I liked it  but I thought
netscape could build a program that would work on anything  I can see now why
people do not like netscape  this
     (37764638)	Comments:  program should be trashed your old 4.7 is way better   sorry I do
not like it msn 6 is way better that is what I am going to use from now on  no
more netscape for me this is junk!!
     (37636882)	Comments: Netscape never works when other applications are open  it must be
the only one or else it gets an error!
     (37625092)	URL:
http://64.4.32.251/cgi-bin/linkrd?_lang=EN&lah=fd621fcc6d72cef296f5e1e3e5300661&lat=1005052606&hm___action=http%3a%2f%2fclubs%2eyahoo%2ecom%2fclubs%2ftempleoftheblood
     (37625092)	Comments: Was trying to open the Browser

 Count   Offset    Real Signature
[ 16   WBHOOK32.DLL + 0x7599 (0x11c07599) af34effb - WBHOOK32.DLL + 0x7599
(0x11c07599) ]
 
     Count   Platform List 
     16   Windows 98 4.90 build 73010104
 
     No of Unique Users        15
 
     (37911195)	URL: www.alwaysfreebingo.com
     (37910668)	URL: home.netscape.com
     (37910668)	Comments: Opening the browser.  Said some program failed and it was closing
the browser.
     (37883293)	Comments: doing nothing
     (37868766)	Comments: Opening application
     (37838627)	Comments: I tryed to log on
     (37775816)	Comments: i opened it
     (37625460)	Comments: Trying to open Netscape to get my email.

 Count   Offset    Real Signature
[ 16   WBHOOK32.DLL + 0x7599 (0x11c07599) 878fc2f6 - WBHOOK32.DLL + 0x7599
(0x11c07599) ]

     Count   Platform List 
     16   Windows 98 4.10 build 67766446
 
     No of Unique Users        12

     (37861955)	URL: www.cnn.com
     (37861955)	Comments: Just starting the application.  bombs before it really starts
completely.  Still think it is a Macafee conflict.
     (37835199)	Comments: started up  and cause error.  I had 6.1  and it stopped alll of
the time.  Just downloaded 6.2  but now it starts
     (37807422)	URL: returning to mynetscape.com from e-mail
     (37807422)	Comments: opening browser in win98seOther Notes:In E-mail when filing a
message to a folder using right click menu-- the folder may not open and reveal
the sub-folders -- It will  on the second try usually
     (37791577)	Comments: Trying to go to LL Bean on sale site.
     (37753338)	URL: returning to mynetscape.com from e-mail
     (37753338)	Comments: Opening browser usually get illegal operation message from windows
and requires a second try to get opened sucessfullyIn win98se
     (37663303)	Comments: log on!!!!!!!
     (37660818)	Comments: logging onto netscape
     (37634741)	Comments: opening browser in win98se after minimizing compuserve 2000
browser connection which is running IE
 

     Count   Offset    Real Signature
[ 16   WBHOOK32.DLL + 0x7589 (0x11c07589) d1fa3d33 - WBHOOK32.DLL + 0x7589
(0x11c07589) ]
 
     Keyword List : netscape(4),  
     Count   Platform List 
     16   Windows 98 4.10 build 67766446
 
     No of Unique Users        15

     (37934296)	URL: www.ihcatalog.com
     (37934296)	Comments: It hadn't even finished opening when it crashed. Netscape sucks.
     (37925035)	Comments: I have had reliability problems with 6.2 over the last several
weeks. I am going to quit using it.
     (37875734)	Comments: I was logging on. My home page is the New York Times. I got the
"...performed an illegal operation..." box.
     (37802251)	Comments: crashed at start up - didn't even load
     (37718798)	Comments: Opening Netscape.  Got Warning that Netscape performed an Illegal
Operation
     (37683057)	Comments: After leaving netscape I reload netscape and received  an illegal
operation error.Must reboot  using windows98 and novell client.
     (37612725)	URL: www.baish.net
     (37612725)	Comments: Just opening my home page. First time I've used the new version of
Netscape (apart from the installation)


 Count   Offset    Real Signature
[ 12   WBHOOK32.DLL + 0x7599 (0x11c07599) a6f202b8 - WBHOOK32.DLL + 0x7599
(0x11c07599) ]
 
     Count   Platform List 
     12   Windows 98 4.10 build 67766446
 
  No of Unique Users        10

     (37948935)	Comments: trying to go to priceline.com
     (37828509)	URL: www.palm.com
     (37828509)	Comments: trying to open this web page from within the plam desktop.
     (37805699)	Comments: trying to go to norsdom
     (37661188)	Comments: logging onto netscape
 

 Count   Offset    Real Signature
[ 11   WBHOOK32.DLL + 0x7599 (0x11c07599) 5dcdfbb4 - WBHOOK32.DLL + 0x7599
(0x11c07599) ]

 Count   Platform List 
     11   Windows 98 4.90 build 73010104
 
     No of Unique Users         7

     (37925322)	Comments: Loading Communicator
     (37875027)	Comments: Loading Netscape 6.2 over NS6.1 on an Compaq Presarion with Athlon
processor and 385MB RAM.
     (37835775)	Comments: i just downloaded 6.2 and installed..when i got this error
     (37824820)	Comments: signing on to netscape 6.0


 Count   Offset    Real Signature
[ 9   WBHOOK32.DLL + 0x7589 (0x11c07589) 3fe5e0c5 - WBHOOK32.DLL + 0x7589
(0x11c07589) ]

     Count   Platform List 
     9   Windows 98 4.10 build 67766222

     No of Unique Users         6

     (37795692)	Comments: loading program.
     (37773488)	Comments: I accidently hit a icon accessing netscape. Netscape loaded  then
I received an error.
     (37699218)	Comments: attempting to start netscape 6.2
     (37698923)	Comments: "illegal operation message" as I was going through the setup
sequence of Netscape 6.2


 Count   Offset    Real Signature
[ 9   WBHOOK32.DLL + 0x7589 (0x11c07589) 0bb80471 - WBHOOK32.DLL + 0x7589
(0x11c07589) ]
 
      Count   Platform List 
     9   Windows 98 4.90 build 73010104
  
     No of Unique Users         8
 
     (37901581)	Comments: starting the communicator
     (37852943)	URL: www.elibraryhub.com
     (37811761)	Comments: Signing on - this happens far too often.I have been sending you
messages with error informatnion with no feedback.  what gives?
     (37741117)	Comments: every time i start netscap i get this error-wbhook32.dll-please
tell me how to fix this thank you
     (37718984)	Comments: Installing quicktime
     (37624920)	Comments: Opening my browser only....

Comment 5

[Darin Fisher]

wtc: are there any known problems with PR_SetPollableEvent on win9x?

Comment 6

[Wan-Teh Chang]

> wtc: are there any known problems with PR_SetPollableEvent on win9x?

I don't remember, and there is none filed in Bugzilla.

Comment 7

[Darin Fisher]

fwiw, this is not showing up as a top 100 crasher in the nightly builds.

another interesting note.  i searched my own win98 machine for a WBHOOK32.DLL
and could find none.  perhaps this is something that is only optionally installed?!?

Comment 8

[Darin Fisher]

a quick google search found this newsgroup posting:

http://www.geocrawler.com/archives/3/117/1999/7/0/2456220/

> I`m no techie. I run McAfee virusscan and I use Gozilla for downloading
> (both licensed). When I start my Navigator it gives me a WBHOOK32.DLL page
> fault. This doesn`t happen when I close Virusscan or start the browser from
> Gozilla. Is there anyone out there who knows what I can do to solve this
> problem?

so perhaps WBHOOK32.DLL is added by the McAfee virusscan program (which i don't
have installed on my win98 box).

adding relnote keyword.

Comment 9

[Darin Fisher]

release notes for v4.5.1 of McAfee virusscan mentions something about
WBHOOK32.DLL causing problems for freecell and other standard stuff...

http://download.nai.com/products/naibeta-download/vsc/readme.txt

this comment seems to describe the bug we're seeing almost exactly:

http://pot-pourri.fltr.ucl.ac.be/files/mcafee/webscanx/patch.txt

looks like it has something to do with McAfee's WebScanX product, which would
make sense since the GPF is being hit from out socket send calls.  seems like
McAfee is intercepting each and every outgoing network packet or something like
that.

we need to get the word out that this is not a netscape/mozilla bug!

Comment 10

[Darin Fisher]

benc: this is the bug i spoke to you about.

Comment 11

[Darin Fisher]

-> benc for relnote... please close this bug once you're done.  thx!

Comment 12

[greer]

benc/darin, did we get a relnote on this one? can we close it? 

Comment 13

[Shiva Thirumazhusai]

nominating topcrash bugs for nsbeta1. 

Comment 14

[basic]

did this make it into the release notes? needs retargeting?

Comment 15

[benc]

opps. I didn't relnote this...

Comment 16

[basic]

can we do this for moz0.9.9 then? Or is this not needed?

Comment 17

[greer]

This one is still huge on N622. Updating summary. Still needs Ben's relnote.

Comment 18

[benc]

Is there anything we can do to prevent this crash, or is it completely external.

(draft relnote):

If you are running McAfee's WebScanX, you may experience crashes at startup.
Please disable the product and see if it prevents the problem. If so, please
contact McAfee for a solution.

(do we want this in NS 622 relnotes?)

Comment 19

[Susie Wyshak]

changed summary line; McAfee will be looking at this bug soon.

Comment 20

[Shiva Thirumazhusai]

-> topcrash- by Talkback triage team

Comment 21

[Susie Wyshak]

What does that mean...no autoreply email to users?

An NDA is now signed with Network Associates so we can share the Talkback data
and hopefully their July release will fix the problem that causes the crasher.
They seem to know what it is.

Comment 22

[Susie Wyshak]

ignore my comments. I thought this was a different bug.

Comment 23

[Darin Fisher]

-> susiew (nothing for networking team to do here)

Comment 24

[Susie Wyshak]

I'm marking this wfm since I haven't heard anything new on it. Please reopen if
need be.

Comment 25

[Matthias Versen [:Matti]]

*** Bug 182468 has been marked as a duplicate of this bug. ***

Comment 26

[Susie Wyshak]

Shiva - Did we get Talkback on the recent crash, that was marked a dupe? Please
reopen if necessary etc. and if this is an issue, if you don't mind,  assign
this but to you since I gave you the contacts to work with. Thanks.

Comment 27

[benc]

-> networking (darin's comments in a dupe said they trap Winsock).
VERIFIED:
This actually was release noted for a while, in Mozilla 1.0.x.