Closed Bug 111316 Opened 23 years ago Closed 22 years ago

N620 crash for users with McAfee software??? N622 [@ MCSCAN32.DLL]


(SeaMonkey :: UI Design, defect, P1)

Windows NT


(Not tracked)



(Reporter: jay, Assigned: law)


(4 keywords, Whiteboard: Non Reproducible)

Crash Data

I'm really not sure which component this crash falls under...and we don't have a
good stack, so this might be difficult to figure out.  But this is a topcrasher
with Netscape 6.20 on all flavors of Windows.  Here is the latest info from

MCSCAN32.DLL   187 
BBID range: 37823660 - 38255743
Min/Max Seconds since last crash: 11 - 807204
Min/Max Runtime: 18 - 807204
Crash data range: 2001-11-10 to 2001-11-19
Build ID range: 2001102218 to 2001102218
Keyword List : download(4), load(5), mail(10), netscape(12), play(4), start(4),
Stack Trace: 

	 MCSCAN32.DLL + 0xab30 (0x1200ab30)
	 MCSCAN32.DLL + 0xaa40 (0x1200aa40)
	 0xffffffe8     (38254800)	Comments: clicked the back button
     (38242600)	Comments: downloading new themes when they are first used
     (38237064)	URL:
     (38236034)	Comments: going to another page
     (38233557)	URL:
     (38228658)	Comments: error message - illegal operation
     (38227947)	URL:
     (38226288)	URL: startup -
     (38226288)	Comments: opening navigator
     (38224875)	Comments: loading of mail & newsgroup
     (38211146)	URL: loading
     (38196813)	Comments: trying to change to a new web page.  V 6.2 has some serious bugs
tht need immediate attention.  I am about ready to go back to V 4.7
     (38193137)	Comments: failed during browser startup (using quick start)
     (38185750)	URL:
     (38185750)	Comments: Going from ImDb to this page.
     (38157889)	URL:
     (38157889)	Comments: changing screens.
     (38153562)	Comments: I tried to open netscape mail and thenrecieved an error that it
was going to be shut down. No further data to provide.
     (38146563)	Comments: I had been booted and tried to re-enter Real Player download  now
I can't get on Netscape 6.2  It tells me I have performed an illegal action.  I
was trying to load a free game  it stopped 1/2 way through and I lost the
connection.  Since reconnection I
     (38146563)	Comments:  have had difficulty.
     (38140001)	Comments: I was trying to open up the application
     (38134191)	URL:
     (38134191)	Comments: returning to a previous screen
     (38132629)	Comments: downloading and exe. file
     (38126721)	URL:
     (38126047)	Comments: Nothing special.  I was in
     (38120488)	URL:
     (38113080)	URL:
     (38068697)	Comments: in mail reader  clicked on messages before the display caught up.
 mail was pop on the msg1  click delete  click msg2  click delete 
click msg3  wait for display to catch up. crash.the fetching of messages and
update of the display was
     (38068697)	Comments:  horribly slow compared to Opera or Outlook or even Netscape back
when I had communicator installed.
     (38066612)	URL:
     (38063247)	URL:
     (38063247)	Comments: Tried to close a secondary window opened to
     (38063035)	URL:
     (38054900)	URL:
     (38053217)	URL:
     (38053217)	Comments: opened spinner web site  and was given the warning "this program
has performed an illegal operation and will be shut down"
     (38052021)	Comments: i was minimizing my e-mail(netscape)and clicked on the netscape 6
icon to open it.the error then appeared.
     (38049523)	Comments: opening email folder
     (38037603)	Comments: I was writing mail password. After  Netscape crash
     (38026395)	URL:
     (38012522)	URL:
     (38011802)	Comments: opening web page on techrepublic
     (38006690)	URL:
     (38003488)	URL:
     (38003488)	Comments: clicked on a link to take me back to the main page for nissan maximas.
     (38003223)	URL:
     (38000844)	URL: support/
     (37985525)	Comments: it keeps shutting down
     (37977615)	URL:
     (37976856)	URL:
     (37963440)	Comments: opened netscape  it closed.
     (37949652)	URL:
     (37949652)	Comments: clicked on hyperlink
     (37948172)	Comments: Installed Netscape 6.2 and it was installing Java
     (37936508)	Comments: returning to my netscape from aol anywhere 
     (37933884)	Comments: trying to open netscape
     (37924783)	Comments: moving between a japanese site and site
     (37924399)	Comments: moving within yahoo groups
     (37920891)	Comments: browsing the web at
     (37920672)	Comments: Browsing  the web
     (37919060)	URL:
     (37919060)	Comments: I was listening music  sending an email via Outlook and when I
refreshed the page the system sent a Dr.Watson Alert that
indicates ....  Netscape6 has an error and the application will close.
     (37913907)	Comments: trying to pull up Verizon home page
     (37910199)	URL:
     (37907755)	Comments: Openning multiple pages simultaneously from
     (37907431)	Comments: Reading email from
     (37906155)	URL:
     (37897016)	URL:
     (37897016)	Comments: I was trying to scroll down to see the bottom of the right column.
 I had just finished customizing my setup.
     (37871100)	Comments: Trying to access the internet home page.
     (37867404)	Comments: I have been having trouble with your browser as well as thjat
other "companies" ever since I installed mcafee fire wall protection.
     (37864656)	Comments: reading emailIt is very slow to display selected mail
     (37862033)	Comments: Trying to start it
     (37861714)	URL:
     (37861714)	Comments: Merely reading this URL's news pages.
     (37857662)	Comments: trying to start Netscape 6.2.
     (37849583)	Comments: I was surfing with a few programs open.
     (37829460)	Comments: this quicktime is a piece of SHIT!!!!!!!!!!!!!
     (37826747)	Comments: i was looking at wallpaper when netscape locked up so i had to
restart my computer. When i got it back up i got an error: netscape 6 has caused
an error in WBHOOK32.DLL.
     (37824127)	Comments: Reading mailThe mail reader is very slow to display a messageand
very slow to delete a message.
     (37823660)	Comments: Downloading eamil

There are so many different user comments, that it's difficult to find any one
testcase...but looking at the stack signature this one comment stood out to me:

Comments: I have been having trouble with your browser as well as thjat other
"companies" ever since I installed mcafee fire wall protection.

Adding qawanted keyword to see if we can get QA to test using Netscape 6.20 on a
machine with various McAfee software (VirusScan, Firewall Protection, etc).
Keywords: crash, qawanted, topcrash
Assignee: asa → trudelle
Component: Browser-General → XP Apps
QA Contact: doronr → sairuh
->law, p1/098
Assignee: trudelle → law
Priority: -- → P1
Target Milestone: --- → mozilla0.9.8
Not getting to this, either.
Target Milestone: mozilla0.9.8 → mozilla0.9.9
Spam: Dropping off my list for MachV/mozilla1.0.  If you have issues, please 
make your case by stating which of my mozilla0.9.9 or mozilla1.0 bugs you think 
are of lesser importance.

Please note that *some* of these might be fixed elsewhere if there is work 
being done in the same area of code.  In most of those cases, I will have 
marked such bugs by putting the *real* bug in the "depends on" field.
Keywords: helpwanted
Target Milestone: mozilla0.9.9 → Future
nominating topcrash bugs for nsbeta1. 
Keywords: nsbeta1
nsbeta1- per ADT triage team, please renominate if this shows up in current builds.
Keywords: nsbeta1nsbeta1-
QA Contact: sairuh → tpreston
Is this a crash in the trunk builds for topcrash?
This particular crash is a topcrash in all the Netscape Releases like 6.0, 6.1,
6.21, 6.22 and not in the Mozilla Releases or Trunk builds.

Summary: N620 crash for users with McAfee software??? [@ MCSCAN32.DLL] → N620 crash for users with McAfee software??? N622 [@ MCSCAN32.DLL]
Since the dll appears to be on our stack trace, is this a plugin they've
created?  Who is trying to reproduce this at Netscape?
this is unfortunately an instability in mcafee's virus software - and actually
this should be affecting any application that is writing file to disk

what's going on is they have somehow hooked into any system calls that write to
disk, so any writes we make (such as the cache, etc) get piped through mcafee's
software, which essentially means we're executing their code in our process space.

more than likely, we are passing a somewhat illegal value as a parameter to a
windows system call when we write - windows handles the illegal value just fine,
but if mcafee intercepts the call, it probably barfs. Since many of us with
mcafee installed (like me) have never seen this crash (like me) my guess is that
they fixed it in later versions...some ideas:
* a -1 to an API that only accepts positive values
* a write() of 0 or <0 bytes
* a seek() beyond the end of a file, or <0

that said, I think places to look are the cache and the file-save code (Which
probably uses some necko or xpcom Output Stream API) and we should look for
strange calls to the NSPR or Windows equivalent of seek() and write()

cc'ing gordon for some possible insight into the cache code.
It would be interesting to see which version of McAfee software these users (who
reported incidents) have.   Do you have a system set up where we can email a
certain group of reporters all at once to gather more info?
chofmann wrote:
> we could use some widespread help on this.
> could anyone with a .dll named MCSCAN32.DLL
> on their system step forward and identify themselves in this bug... ;-)

C:\Program Files\Common Files\Network Associates\VirusScan
According to the Properties, the version is 4.1.60

Running on W2K 5.00.2195, Service Pack 2
I have MCScan32.dll versions (Private Build Description API V5.20) on
Win2k Server and (Private Build Description API: V8.52) on Win2k Pro
both SP2.
I have the dll, with the same version and system info as bobj.
I have the DLL on Win2000SP2, and mach-V runs great. was running 6.2.1
before, and experienced very little crashes...
on a somewhat related note...

McAfee virus scanner has an advanced option that is not enabled by default.  the
option turns on a web-scanning feature, where upon McAfee intersects all
winsock2 system calls.  doing so has been reported to cause many networking apps
including netscape to crash.  McAfee even suggested in their release notes that
users not enable their web-scanning feature if it causes other applications to
crash.  i'm not sure if this crash could be a duplicate of the winsock problem.

i just did a google search for "MCSCAN32 crash" and found a number of news group
postings reporting complaints of this DLL causing instability in users' systems.

here's a document from microsoft explaining what to do if IE crashes in

so, in summary... i'd bet that this bug is not our fault.
Darin:  I found the MCSCAN32.DLL. My installation doesn't show option for
web-scanning. Pl. update the bug with steps to enable web-scanning and How to
reproduce. I am using Windows 2000. 
Seems to be working fine on build 4-8-2002, using Win 98
Whiteboard: Non Reproducible
McAfee will be looking at this Bugzilla bug shortly. 
Marking this worksforme.  This crash last appeared with Netscape 6.23...and is
no longer an issue with either the MozillaTrunk or Gecko1.0 Branch.
Closed: 22 years ago
Keywords: topcrashtopcrash-
Resolution: --- → WORKSFORME
Product: Core → Mozilla Application Suite
Crash Signature: [@ MCSCAN32.DLL]
You need to log in before you can comment on or make changes to this bug.