458667 - Norton's Office document scanning causes crashes when saving some downloads [@ OfficeAV.dll@0x55e1]

Status: RESOLVED INVALID

(Toolkit :: Downloads API, defect)

Description

[Reid Rankin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3

(Check out one of my crash reports at http://crash-stats.mozilla.com/report/index/08d9a414-9350-11dd-9a2f-0013211cbf8a.)

Using Norton Internet Security, selecting "Turn on scanning for Microsoft Office documents" under "Real-time protection" in the options causes intermittent crashes upon trying to scan downloads.

Reproducible: Always

Steps to Reproduce:
1. Open a website where you can download a reasonably small file.
2. Download the file, optionally selecting to open it instead of save it to disk.
3. Once the download is complete, download the same file again.
4. Repeat 2-3 times, until a crash occurs.
Actual Results:  
The browser crashes. If the file was supposed to be opened instead of saved, the file opens successfully before the crash.

Expected Results:  
The download should be scanned and saved without crashing the browser.

I experienced this problem when trying to install vista sidebar gadget files on a computer I was configuring from scratch. Norton Internet Security came with the computer as a 60-day trial, as did Office 2007. The crashes started after I installed an update for NIS and replaces the 60-day trial of Office 2007 with a full install of Office 2007 Professional Plus (which was sold as an educational version).

Crashes occur even in safe mode, and with all plugins disabled. However, turning off browser.download.manager.scanWhenDone or the "Turn on scanning for Microsoft Office documents" option stops the crashes.

Searches on Breakpad (http://crash-stats.mozilla.com/?do_query=1&query_search=signature&query_type=contains&query=OfficeAV.dll&date=&range_value=1&range_unit=months) indicate this problem started on 9/30 with a crash offset of 0x55e1 (which I experienced consistently), and on 10/3 with an offset of 0x5606. However, as of midnight on 10/6, there were 1949 reports for the latter offset and only 230 for the former, so it is more important to fix the 0x5606 crashes. However, as I did not experience them, I cannot confirm that they are reproduced by the same method, though the comments on the reports seem to indicate so.

Comment 1

[timeless]

Signature	OfficeAV.dll@0x55e1
UUID	08d9a414-9350-11dd-9a2f-0013211cbf8a
Time	2008-10-05 19:36:23-07
Uptime	326
Product	Firefox
Version	3.0.3
Build ID	2008092417
OS	Windows NT
OS Version	6.0.6001 Service Pack 1
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
Comments	Crashes occur even in safe mode, and with all plugins disabled. To reproduce, download a (small?) file, selecting to have it opened instead of saved, and then download it again immediately, selecting to open it again. Crash occurs after the file is opened. I experienced these crashes on the Windows Sidebar Gallery, when trying to install multiple gadgets.
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	OfficeAV.dll 	OfficeAV.dll@0x55e1 	
1 	ccL70U.dll 	ccL70U.dll@0x3d6f0 	
2 	ccL70U.dll 	ccL70U.dll@0x3d716 	
3 	msvcr80.dll 	msvcr80.dll@0x2a46 	
4 	ntdll.dll 	ntdll.dll@0x3e4b5 	
5 	ntdll.dll 	ntdll.dll@0x3e488 	

Filename 	Version 	Debug Identifier 	Debug Filename
swg.dll 	4.1.805.1852 	612B347D6D224C6CAE86BF2D07155B631 	swg_unscrubbed_unsigned_dll.pdb
ccVrTrst.dll 	107.0.4.3 	30F66C393F17423DA323311A11C27CB81 	ccVrTrst.pdb
ci.dll 	2.3.1334.1308 	48638AF968AB4E9A868745D45B3F96EA1 	ci_dll.pdb
IconOvrly.dll 	5.0.0.0 	9C9AF6525388470BBB987F49E078AA988 	IconOvrly.pdb
AVPSVC32.dll 	15.5.0.23 	57641149FB29476DACB2E922B778CC441 	AVPSVC32.pdb
avScanUI.dll 	15.5.0.23 	87AD2C81D3DF48E8A85169CE4E2185303 	avScanUI.pdb
NAVEvent.dll 	15.5.0.23 	0E4B11F49D1444D89E943E4A97968C2A1 	navevent.pdb
NAVLogV.dll 	15.5.0.23 	0254E59CABDC4654BB1D7B7AD6F1967B1 	NAVLogV.pdb
OfficeAV.dll 	15.5.0.23 	646ED6DA6AD4440BB675BC803D161E221 	OfficeAV.pdb
ccEvtCli.dll 	107.0.4.3 	8C4CA7D5D43B49EA8E2262B93B3111961 	ccEvtCli.pdb
ccIPC.dll 	107.0.4.3 	19544C7D818B41B195D29D90436129DB1 	ccIPC.pdb
ccL70U.dll 	107.0.4.3 	802A789823C6469388B49217DC4EEF1A1 	ccL70U.pdb
ccSvc.dll 	107.0.4.3 	4225D5A4664141DA8A54C676012E75FE1 	ccSvc.pdb
Wpc.dll 	1.0.0.1 	64394E6FDF0D4DB09A25EA808E7184CD2 	Wpc.pdb
actxprxy.dll 	6.0.6001.18000 	83EB3E71E13743339D8CBAB04FB4E1A92 	ActXPrxy.pdb
browseui.dll 	6.0.6001.18000 	27E10176EEA54532AF44C9B98C3998202 	browseui.pdb
shdocvw.dll 	6.0.6001.18000 	86EDD4C565D04F56B4BD7FC828D996772 	shdocvw.pdb
AppMgr32.dll 	1.3.0.71 	712614B7E70143C89FC95813AC9156B01 	AppMgr32.pdb
brwsrcmp.dll 	1.9.0.3188 	C3C9B986E9F74410A4AF4575539931433 	brwsrcmp.pdb
cscui.dll 	6.0.6001.18000 	82ED3856B66C42B18649F0360E435EB22 	cscui.pdb
SPTIP.DLL 	6.0.6001.18000 	A2897FE4A43548A685AC28B8918062B51 	SpTip.pdb
AVifc.dll 	3.5.0.14 	914D433370BA44DEB09DF9F55E534E4E3 	AVifc.pdb
cscapi.dll 	6.0.6001.18000 	6A4570FE147F44EAAA2246ED139B98161 	cscapi.pdb
cscdll.dll 	6.0.6001.18000 	5D5F41EAE512466A996745314943B59D2 	cscdll.pdb
pnrpnsp.dll 	6.0.6001.18000 	9978701F009842E888F7CFACE2D87B2F2 	pnrpnsp.pdb
winrnr.dll 	6.0.6000.16386 	503C6EAA0365471EA08AFCF3D7FB82F82 	winrnr.pdb
NapiNSP.dll 	6.0.6001.18000 	40732FC58838438FADEA98874C7BE0482 	NapiNSP.pdb
rasadhlp.dll 	6.0.6000.16386 	EF7CE7F6CA80474C8B3C401BCEDE63232 	rasadhlp.pdb
MpOAV.dll 	1.1.1600.0 	196E5F400F4949F795EE6BD4CBE9AEC71 	MpOAV.pdb
wdscore.dll 	6.0.6001.18000 	1C76E5F6DBA840B2AA1BB862D9148ECF1 	wdscore.pdb
FWPUCLNT.DLL 	6.0.6001.18000 	3AE45CE58549477DA7D27E4B77B99C622 	fwpuclnt.pdb
msi.dll 	4.0.6001.18000 	9F7AF6D83F684D65BC3E62B45B0C55BA2 	msi.pdb
dbghelp.dll 	6.0.6001.18000 	5AFA6218AC6244CDA864757C23655C322 	dbghelp.pdb
msvcp80.dll 	8.0.50727.1434 	856EED61A6B64F59BEFFC118EFD502B31 	msvcp80.i386.pdb
wsock32.dll 	6.0.6001.18000 	7DC375A71CD746B2AA6DA348F3CC4A332 	wsock32.pdb
WindowsCodecs.dll 	6.0.6001.18000 	7A9C55F2A75540D0AF7B9C732121276D2 	WindowsCodecs.pdb
winmm.dll 	6.0.6001.18000 	0F510C3C6FA5429CB90B3CAC010DAE2A2 	winmm.pdb
tapi32.dll 	6.0.6000.16386 	1ACF3BB7C8F44C34AF718B895485F4D52 	tapi32.pdb
rtutils.dll 	6.0.6000.16386 	119502E119254BC584A2134514FFB1972 	rtutils.pdb
rasman.dll 	6.0.6001.18000 	D5E0319FC21B4B5E8E248908A573F9842 	rasman.pdb
rasapi32.dll 	6.0.6001.18000 	B9888ABBFF8B45F3B7BC6A6CC9C746C92 	rasapi32.pdb
winshfhc.dll 	1.1.1505.0 	4B385EA6BD794E229023C3B25841AFD31 	winshfhc.pdb
oleacc.dll 	4.2.5406.0 	870DE296FC97430A81F4D5AC2B65C0222 	oleacc.pdb
winspool.drv 	6.0.6001.18000 	C2BBAA4F14454DFB9133D376CBA83A3F1 	winspool.pdb
propsys.dll 	7.0.6001.16503 	9DD90425A84F47928F69D6D60AF4793B2 	propsys.pdb
sbdrop.dll 	6.0.6000.16386 	51416DAB93CA4D1B86600CF30D7D90031 	sbdrop.pdb
GdiPlus.dll 	5.2.6001.18065 	009DD49D0BDD4611BDB3EC7632C11CD22 	gdiplus.pdb
SpeechUXPS.DLL 	6.0.6000.16386 	44794E9BE7524E8AA725B46F5F1D639C1 	SpeechUXPS.pdb
atl.dll 	3.5.2284.0 	4E23B67DB5774E39B8C03AE172C910372 	atl.pdb
wintrust.dll 	6.0.6001.18000 	890F7D05DE644A529246BB8E4D67F58C2 	wintrust.pdb
uxtheme.dll 	6.0.6001.18000 	D6B5A4E899AF4946BA6E4611D58409C02 	UxTheme.pdb
nlaapi.dll 	6.0.6001.18000 	DB93000733CD4945A45FD893D5FD73DB1 	nlaapi.pdb
duser.dll 	6.0.6001.18000 	8753BF70B9E043B78BE5E8616AF70B732 	DUser.pdb
WSHTCPIP.DLL 	6.0.6001.18000 	04F115ECECD44A42BCB33B070E9BB3DC2 	wshtcpip.pdb
msimg32.dll 	6.0.6000.16386 	F3CCF1CDEF724758A292CC67212D6C0C2 	msimg32.pdb
comctl32.dll 	6.10.6001.18000 	B07CB25578964646BF1423C7A4B5CB9D2 	comctl32.pdb
msvcr80.dll 	8.0.50727.1434 	D75231CB115C4344ABC3A8973666406B1 	msvcr80.i386.pdb
version.dll 	6.0.6001.18000 	6A1ECA8395EE447D87E8A0F4770EC4FE2 	version.pdb
powrprof.dll 	6.0.6001.18000 	78C14E5546ED469F9CC95B94D32E80C72 	powrprof.pdb
rsaenh.dll 	6.0.6001.18000 	106F4E31927B44DDA787F038C49325FE2 	rsaenh.pdb
mswsock.dll 	6.0.6001.18000 	4AC8DC12E86B4AC79A9C735D8D7091122 	mswsock.pdb
wship6.dll 	6.0.6001.18000 	476F85998BBC4CAAB520F8F70F7960051 	wship6.pdb
wtsapi32.dll 	6.0.6001.18000 	7A62C62B69A34A9DA862BB30027DDDC51 	wtsapi32.pdb
dhcpcsvc6.DLL 	6.0.6001.18000 	FCE55FAB1F3F47F19D1C04D0BCB17BD22 	dhcpcsvc6.pdb
winnsi.dll 	6.0.6001.18000 	F491ADBDA8EC4CE992EE9D915003BF041 	winnsi.pdb
dhcpcsvc.dll 	6.0.6001.18000 	7BFDD3C973A34A78962A34C2A9E4D05E2 	dhcpcsvc.pdb
IPHLPAPI.DLL 	6.0.6001.18000 	FD920ED8F03842FA86EA2C9B507AFB0C2 	iphlpapi.pdb
wevtapi.dll 	6.0.6001.18000 	614CE8860A7D46ABA0B00EEFECE701CE2 	wevtapi.pdb
crypt32.dll 	6.0.6001.18000 	F344E585CAB44AEBA410913BA3529F8A2 	crypt32.pdb
msasn1.dll 	6.0.6000.16386 	5668F94D10674FA4AB64507352FFA6422 	msasn1.pdb
samlib.dll 	6.0.6001.18000 	360526C11E884C49BBFB551FE5A447C12 	samlib.pdb
dnsapi.dll 	6.0.6001.18000 	38F2989DD4E94700BC57EA2003B4114F2 	dnsapi.pdb
netapi32.dll 	6.0.6001.18000 	E09E70BE7BE948F2BC5E9A4DD2BB650C2 	netapi32.pdb
sxs.dll 	6.0.6001.18000 	603B3E26EB0B41CA94C85D194B516D8B2 	sxs.pdb
apphelp.dll 	6.0.6001.18000 	8E2B89AC298E478D95400CAC39E984962 	apphelp.pdb
winsta.dll 	6.0.6001.18000 	D827EC6A7AAB4DF4A818CF7D56712A542 	winsta.pdb
secur32.dll 	6.0.6001.18000 	C3A892D4DD844F33AB4931F05BB186D72 	secur32.pdb
userenv.dll 	6.0.6001.18000 	B3DFD39AFCFD45718B10CA2EE3E023EC2 	userenv.pdb
psapi.dll 	6.0.6000.16386 	FA398191D257469CBA795A86B704D9B92 	psapi.pdb
kernel32.dll 	6.0.6001.18000 	093FA0AF6A7B4CE9B12506584036EC882 	kernel32.pdb
ws2_32.dll 	6.0.6001.18000 	A004B77B4689467D8888B44DC5DD5DD72 	ws2_32.pdb
wininet.dll 	7.0.6001.18099 	C5E6163429FC4FF79598CBA23277FDB42 	wininet.pdb
iertutil.dll 	7.0.6001.18000 	3B903727E8B7400BBACE193C066703372 	iertutil.pdb
msvcrt.dll 	7.0.6001.18000 	907C0110ED8A4B5FBDE7C53CA473E1BF2 	msvcrt.pdb
setupapi.dll 	6.0.6001.18000 	28CE2899B84241FA9EDD099FA6C87D932 	setupapi.pdb
advapi32.dll 	6.0.6001.18000 	F47D32216FEC4B49AC9C8E6E687A36C52 	advapi32.pdb
imm32.dll 	6.0.6001.18000 	FD735742B429460AA1EB84EA7DE5F4952 	imm32.pdb
shlwapi.dll 	6.0.6001.18000 	B8D18F33FFCC4B37A2800C2CF4B8E0132 	shlwapi.pdb
nsi.dll 	6.0.6001.18000 	37D074DFCA5D4B5FB51EB78B39F22BF12 	nsi.pdb
rpcrt4.dll 	6.0.6001.18051 	CEA7D51A9B994184B8BB0A2F49D32B8F2 	rpcrt4.pdb
usp10.dll 	1.626.6001.18000 	DDA3D1A222EC474392B05039FFB9FB2F2 	usp10.pdb
msctf.dll 	6.0.6001.18000 	D580123A0B2D4A4A9101EE42B89C49A22 	msctf.pdb
urlmon.dll 	7.0.6001.18099 	5398E412844A4A77AA8357DC343E35F92 	urlmon.pdb
shell32.dll 	6.0.6001.18062 	5BBE0E336547438C9298876364CC2F342 	shell32.pdb
comdlg32.dll 	6.0.6001.18000 	B29564B650C545959CA6A542207B65EE2 	comdlg32.pdb
oleaut32.dll 	6.0.6001.18000 	DDDA4738DBC94A3CB5523186E8E021502 	oleaut32.pdb
gdi32.dll 	6.0.6001.18023 	EBDD6CE9990A494E8289A70A5898C8EA2 	gdi32.pdb
user32.dll 	6.0.6001.18000 	750E7375884C4EA592C8B0C8ADB018542 	user32.pdb
ole32.dll 	6.0.6001.18000 	D5E1AE7EFBFE4EBF861CF115E487706B2 	ole32.pdb
ntdll.dll 	6.0.6001.18000 	B958B2F91A5A46B889DAFAB4D140CF252 	ntdll.pdb
lpk.dll 	6.0.6001.18000 	EE7B434B5C904EF2AACEA045AD88806A2 	lpk.pdb
imagehlp.dll 	6.0.6001.18000 	83857AB54AF242F49144544444A773502 	imagehlp.pdb
normaliz.dll 	6.0.6000.16386 	D89936175B9A40C0BEC6EE980ACF2A491 	normaliz.pdb
clbcatq.dll 	2001.12.6931.18000 	9E0BF37E9B7B468BA033F0003A14A3A32 	CLBCatQ.pdb
Wldap32.dll 	6.0.6001.18000 	1080C7828BD04DCEAB7684107217202D2 	wldap32.pdb

Comment 3

[Samuel Sidler (old account; do not CC)]

Confirming based on topcrash reports.

Comment 6

[Samuel Sidler (old account; do not CC)]

I need some clear steps to reproduce. I have Norton at my desk and will investigate this more later.

Comment 7

[Robert Strong (they/them - no direct email)]

Not a shell integration bug but possibly due to the virus scanning capability provided by the download manager so moving over there so this can get attention.

Comment 11

[Matthias Versen [:Matti]]

Samuel Sidler: An important note from the last dupe that might help to reproduce this :

>I installed Microsoft's Windows Defender and Firefox began to crash after every
>second download.  I uninstalled Defender and all is OK now.

Comment 12

[Honza Bambas (:mayhemer)]

Tried to reproduce (unsuccessfully) using these steps on windows xp sp3 (not having vista machine)

1. - install norton 360, try to download a .doc from ms site with 3.1 prebeta2
   - install Windows Defender over the norton, try again to download
2. - install norton internet security 2009 EN
   - install Windows Defender
3. - install norton internet security 2007 CZ (I didn't find 2007 EN trusted source)
   - install Windows Defender

All nortons were just 15 day trials. With none of these installations I could reproduce the crash in the debugger. I also tried to have two scans at one time. Are there any other more specific conditions I should follow?

What is curious, the file is downloaded, open by the target application and then it is scanned. Is this behavior correct?

Comment 13

[m_moss]

I am using WinXP service Pack 3 with Norton Anti-Virus and Windows Defender. I can reproduce the crash on the 2nd download 100% of the time and have done so on two of my computers.

Comment 14

[Honza Bambas (:mayhemer)]

Thanks. I would like to ask some more detailed questions:
- Which version and which norton exactly are you using? (Norton Internet Security, Norton Antivirus, Norton 360)
- Is it up to date? (Please do not update if not! :))
- Which processor have those two machines?
- What kind of files are you downloading and, potentially, where from?
- In which order did you install? Norton then Defender or reverse?
- Did you setup any special options or plug-ins in Norton and Defender?
- Is your Norton a trial or full version?

Thanks a lot in advance.

Comment 15

[m_moss]

I am using Norton Anti-Virus 2008 full version, installed first, and it is up to date.
My desktop is an Intel Pentium 4 and my laptop is an Intel Centrino Duo.
No special options were set up.
I was downloading some small PDF files, but it has happened with others as well.
Perhaps the only anomaly was that Norton tried to update me to 2009, but it crashed and I removed it. However, I have no problems if Defender is removed.

Comment 16

[Jim Mathies [:jimm]]

Has anyone tried contacting Norton? Searching around I see a lot of reports of this module crashing on use in a wide range of apps including ie, fx and some mail programs.

Also, as a work around that doesn't require you to disable virus scanning in Fx, here's an ms support article detailing how you can disable this plugin - 

http://support.microsoft.com/kb/329820

Comment 17

[David Dillard]

Symantec is aware of this problem.  I can't give an expected fix date, but we are looking at the issue.

Comment 18

[Jim Mathies [:jimm]]

(In reply to comment #17)
> Symantec is aware of this problem.  I can't give an expected fix date, but we
> are looking at the issue.

Thanks for the feedback David, we appreciate it. Good to know it's known and someone is working on it.

Comment 19

[David Dillard]

We believe the problem has been identified.  However, there is no date yet for when the fix will be available via LiveUpdate.

Comment 22

[[:Cww]]

Changing to user-doc-complete because we now have: http://support.mozilla.com/en-US/kb/Firefox+crashes+when+trying+to+download+a+file#Norton_Antivirus_Office_document_scanning

When Norton releases a patch, we can change the instructions to a simpler: update Norton Antivirus.  Please change the keyword back to user-doc-needed when that happens.

Comment 24

[David Dillard]

The fix for this problem is now available via LiveUpdate.  If someone who's experienced the problem could verify the fix and then close this bug I'd appreciate it.