111316 - N620 crash for users with McAfee software??? N622 [@ MCSCAN32.DLL]

Status: RESOLVED WORKSFORME

(SeaMonkey :: UI Design, defect, P1)

Description

[Jay Patel [:jay]]

I'm really not sure which component this crash falls under...and we don't have a
good stack, so this might be difficult to figure out.  But this is a topcrasher
with Netscape 6.20 on all flavors of Windows.  Here is the latest info from
Talkback:

MCSCAN32.DLL   187 
BBID range: 37823660 - 38255743
Min/Max Seconds since last crash: 11 - 807204
Min/Max Runtime: 18 - 807204
Crash data range: 2001-11-10 to 2001-11-19
Build ID range: 2001102218 to 2001102218
Keyword List : download(4), load(5), mail(10), netscape(12), play(4), start(4),
back(5), 
Stack Trace: 

	 MCSCAN32.DLL + 0xab30 (0x1200ab30)
	 0x050eeb68
	 MCSCAN32.DLL + 0xaa40 (0x1200aa40)
	 0xffffffe8     (38254800)	Comments: clicked the back button
     (38242600)	Comments: downloading new themes when they are first used
     (38237064)	URL: www.esmas.com
     (38236034)	Comments: going to another page
     (38233557)	URL: www.justatip.com
     (38228658)	Comments: error message - illegal operation
     (38227947)	URL: http://www.kkht.com/ministries
     (38226288)	URL: startup - www.usatoday.com
     (38226288)	Comments: opening navigator
     (38224875)	Comments: loading of mail & newsgroup
     (38211146)	URL: loading mynetscape.com
     (38196813)	Comments: trying to change to a new web page.  V 6.2 has some serious bugs
tht need immediate attention.  I am about ready to go back to V 4.7
     (38193137)	Comments: failed during browser startup (using quick start)
     (38185750)	URL: http://www.datalounge.com/datalounge/index.html
     (38185750)	Comments: Going from ImDb to this page.
     (38157889)	URL: www.gn.apc.org/whales/order.shtml
     (38157889)	Comments: changing screens.
     (38153562)	Comments: I tried to open netscape mail and thenrecieved an error that it
was going to be shut down. No further data to provide.
     (38146563)	Comments: I had been booted and tried to re-enter Real Player download  now
I can't get on Netscape 6.2  It tells me I have performed an illegal action.  I
was trying to load a free game  it stopped 1/2 way through and I lost the
connection.  Since reconnection I
     (38146563)	Comments:  have had difficulty.
     (38140001)	Comments: I was trying to open up the application
     (38134191)	URL: www.egroups.com
     (38134191)	Comments: returning to a previous screen
     (38132629)	Comments: downloading and exe. file
     (38126721)	URL: www.my.yahoo.com
     (38126047)	Comments: Nothing special.  I was in Amazon.com
     (38120488)	URL: http://www.kkht.com/ministries
     (38113080)	URL: http://www.kkht.com/ministries
     (38068697)	Comments: in mail reader  clicked on messages before the display caught up.
 mail was pop on the lan.click msg1  click delete  click msg2  click delete 
click msg3  wait for display to catch up. crash.the fetching of messages and
update of the display was
     (38068697)	Comments:  horribly slow compared to Opera or Outlook or even Netscape back
when I had communicator installed.
     (38066612)	URL: www.esmas.com
     (38063247)	URL: www.honda.com
     (38063247)	Comments: Tried to close a secondary window opened to www.honda.com
     (38063035)	URL: http://www.kkht.com/ministries
     (38054900)	URL: http://www.kkht.com/ministries
     (38053217)	URL: www.spinner.com
     (38053217)	Comments: opened spinner web site  and was given the warning "this program
has performed an illegal operation and will be shut down"
     (38052021)	Comments: i was minimizing my e-mail(netscape)and clicked on the netscape 6
icon to open it.the error then appeared.
     (38049523)	Comments: opening email folder
     (38037603)	Comments: I was writing mail password. After  Netscape crash
     (38026395)	URL: www.my.yahoo.com
     (38012522)	URL: http://www.online.com.ua/mass_media/tv_e.html
     (38011802)	Comments: opening web page on techrepublic
     (38006690)	URL: http://www.kkht.com/ministries
     (38003488)	URL: carpoint.msn.com
     (38003488)	Comments: clicked on a link to take me back to the main page for nissan maximas.
     (38003223)	URL: http://www.kkht.com/ministries
     (38000844)	URL: support/agfa.com
     (37985525)	Comments: it keeps shutting down
     (37977615)	URL: www.my.yahoo.com
     (37976856)	URL: www.my.yahoo.com
     (37963440)	Comments: opened netscape  it closed.
     (37949652)	URL: http://www.kkht.com/ministries
     (37949652)	Comments: clicked on hyperlink
     (37948172)	Comments: Installed Netscape 6.2 and it was installing Java
     (37936508)	Comments: returning to my netscape from aol anywhere 
     (37933884)	Comments: trying to open netscape
     (37924783)	Comments: moving between a japanese site and Yahoo.ca site
     (37924399)	Comments: moving within yahoo groups
     (37920891)	Comments: browsing the web at excaliburelectronics.com
     (37920672)	Comments: Browsing  the web
     (37919060)	URL: www.esmas.com
     (37919060)	Comments: I was listening music  sending an email via Outlook and when I
refreshed the page www.esmas.com the system sent a Dr.Watson Alert that
indicates ....  Netscape6 has an error and the application will close.
     (37913907)	Comments: trying to pull up Verizon home page
     (37910199)	URL: www.my.yahoo.com
     (37907755)	Comments: Openning multiple pages simultaneously from www.drudgereport.com
     (37907431)	Comments: Reading email from Morningstar.com
     (37906155)	URL: www.gay.com
     (37897016)	URL: my.netscape.com
     (37897016)	Comments: I was trying to scroll down to see the bottom of the right column.
 I had just finished customizing my setup.
     (37871100)	Comments: Trying to access the internet home page.
     (37867404)	Comments: I have been having trouble with your browser as well as thjat
other "companies" ever since I installed mcafee fire wall protection.
     (37864656)	Comments: reading emailIt is very slow to display selected mail
     (37862033)	Comments: Trying to start it
     (37861714)	URL: http://www.amarillonet.com/
     (37861714)	Comments: Merely reading this URL's news pages.
     (37857662)	Comments: trying to start Netscape 6.2.
     (37849583)	Comments: I was surfing with a few programs open.
     (37829460)	Comments: this quicktime is a piece of SHIT!!!!!!!!!!!!!
     (37826747)	Comments: i was looking at wallpaper when netscape locked up so i had to
restart my computer. When i got it back up i got an error: netscape 6 has caused
an error in WBHOOK32.DLL.
     (37824127)	Comments: Reading mailThe mail reader is very slow to display a messageand
very slow to delete a message.
     (37823660)	Comments: Downloading eamil


There are so many different user comments, that it's difficult to find any one
testcase...but looking at the stack signature this one comment stood out to me:

(37867404)
Comments: I have been having trouble with your browser as well as thjat other
"companies" ever since I installed mcafee fire wall protection.

Adding qawanted keyword to see if we can get QA to test using Netscape 6.20 on a
machine with various McAfee software (VirusScan, Firewall Protection, etc).

Comment 1

[Asa Dotzler [:asa]]

->apps

Comment 2

[Peter Trudelle]

->law, p1/098

Comment 3

[Bill Law]

Not getting to this, either.

Comment 4

[Bill Law]

Spam: Dropping off my list for MachV/mozilla1.0.  If you have issues, please 
make your case by stating which of my mozilla0.9.9 or mozilla1.0 bugs you think 
are of lesser importance.

Please note that *some* of these might be fixed elsewhere if there is work 
being done in the same area of code.  In most of those cases, I will have 
marked such bugs by putting the *real* bug in the "depends on" field.

Comment 5

[Shiva Thirumazhusai]

nominating topcrash bugs for nsbeta1. 

Comment 6

[Peter Trudelle]

nsbeta1- per ADT triage team, please renominate if this shows up in current builds.

Comment 7

[lchiang]

Is this a crash in the trunk builds for topcrash?

Comment 8

[Shiva Thirumazhusai]

This particular crash is a topcrash in all the Netscape Releases like 6.0, 6.1,
6.21, 6.22 and not in the Mozilla Releases or Trunk builds.

Comment 9

[selmer (gone)]

Since the dll appears to be on our stack trace, is this a plugin they've
created?  Who is trying to reproduce this at Netscape?

Comment 10

[Alec Flett]

this is unfortunately an instability in mcafee's virus software - and actually
this should be affecting any application that is writing file to disk

what's going on is they have somehow hooked into any system calls that write to
disk, so any writes we make (such as the cache, etc) get piped through mcafee's
software, which essentially means we're executing their code in our process space.

more than likely, we are passing a somewhat illegal value as a parameter to a
windows system call when we write - windows handles the illegal value just fine,
but if mcafee intercepts the call, it probably barfs. Since many of us with
mcafee installed (like me) have never seen this crash (like me) my guess is that
they fixed it in later versions...some ideas:
* a -1 to an API that only accepts positive values
* a write() of 0 or <0 bytes
* a seek() beyond the end of a file, or <0

that said, I think places to look are the cache and the file-save code (Which
probably uses some necko or xpcom Output Stream API) and we should look for
strange calls to the NSPR or Windows equivalent of seek() and write()

cc'ing gordon for some possible insight into the cache code.

Comment 11

[Doug Turner (:dougt)]

Check out these two articles.  

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q300028
http://www.techadvice.com/w98/E/errors_mscan32.htm

Comment 12

[lchiang]

It would be interesting to see which version of McAfee software these users (who
reported incidents) have.   Do you have a system set up where we can email a
certain group of reporters all at once to gather more info?

Comment 13

[bobj]

chofmann wrote:
> we could use some widespread help on this.
>
> could anyone with a .dll named MCSCAN32.DLL
> on their system step forward and identify themselves in this bug... ;-)

C:\Program Files\Common Files\Network Associates\VirusScan
Engine\4.0.x.x\mcscan32.dll
According to the Properties, the version is 4.1.60

Running on W2K 5.00.2195, Service Pack 2

Comment 14

[Bob Clary [:bc] (inactive)]

I have MCScan32.dll versions 4.0.70.0 (Private Build Description API V5.20) on
Win2k Server and 4.1.6.0 (Private Build Description API: V8.52) on Win2k Pro
both SP2.

Comment 15

[rudman]

I have the dll, with the same version and system info as bobj.

Comment 16

[Tristan Nitot]

I have the DLL 4.1.6.0 on Win2000SP2, and mach-V runs great. was running 6.2.1
before, and experienced very little crashes...

Comment 17

[Darin Fisher]

on a somewhat related note...

McAfee virus scanner has an advanced option that is not enabled by default.  the
option turns on a web-scanning feature, where upon McAfee intersects all
winsock2 system calls.  doing so has been reported to cause many networking apps
including netscape to crash.  McAfee even suggested in their release notes that
users not enable their web-scanning feature if it causes other applications to
crash.  i'm not sure if this crash could be a duplicate of the winsock problem.

i just did a google search for "MCSCAN32 crash" and found a number of news group
postings reporting complaints of this DLL causing instability in users' systems.

here's a document from microsoft explaining what to do if IE crashes in
MCSCAN32.DLL:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q300028

so, in summary... i'd bet that this bug is not our fault.

Comment 18

[Shiva Thirumazhusai]

Darin:  I found the MCSCAN32.DLL. My installation doesn't show option for
web-scanning. Pl. update the bug with steps to enable web-scanning and How to
reproduce. I am using Windows 2000. 

Comment 19

[Fred Carpio]

Seems to be working fine on build 4-8-2002, using Win 98

Comment 20

[Susie Wyshak]

McAfee will be looking at this Bugzilla bug shortly. 

Comment 21

[Jay Patel [:jay]]

Marking this worksforme.  This crash last appeared with Netscape 6.23...and is
no longer an issue with either the MozillaTrunk or Gecko1.0 Branch.