Page 1 of 1

Consistent error dialogs after new anti-virus

Posted: Tue Sep 01, 2009 8:45 pm
by JMerrill
I'm reasonably certain that the problem I'm reporting is not fully AB's fault. I've been using AB happily for quite some time; only after this problem started did I upgrade from 11.5.19 or 11.6.13 (not sure which I was using) to the current 11.7.36, and the problem persists.

My employer recently replaced Symantec's "Corporate AntiVirus" with the McAfee equivalent, and the problems have only appeared since then. Now, when I click on a link in Lotus Notes email, I get an error dialog similar to the one below. If AB is not open when I click a link, it opens, and I usually reach the destination page. However, if AB was already open, I usually only get the error dialog and AB does not open a new tab. Being one of the people who regularly has kept 30-60 tabs open, having to close AB regularly drastically changes the way I work. Lotus Notes does not provide a way for me to copy the URL of a link to the clipboard (boo hiss) so that I can't just paste it into a new AB tab myself (rather than clicking).

I had been very pleased with AB stability with IE6 before McAfee came along, but if nothing else works I'll have to try a later IE. Would anyone suggest using 7 rather than 8 (on XP SP3) with AB? At any rate, I'm willing to help in any way I can to figure out what's causing this; I could run AB under the Visual Studio debugger if that would be of any value. Should I be collecting more of the error dialog outputs and sending them all in? Thanks for any info. (BTW my CPU is a 3.4 ghz Pentium D despite what the dialog says.)

Code: Select all

OS: Windows XP Professional, SP3
CPU: GenuineIntel, Intel Pentium 4, MMX @ 0 MHz

Module name: C:\avant\avant.exe

Application data:
VmVyc2lvbjogV2tCMFkyMTNKRVozYW5GMVluVlZKQ2xTT3pzbFBDSTh
JejQ0VXlNdkhScEtJRHduTTNGaGZYbHhOaVlqT1NncE9VdC9kbjU2Yj
NsTVQ1RlIzWk9Sd0ZsVjM4Tg0KSW1hZ2VCYXNlOiAwMDQwMDAwMA0KR
WlwOiA4MkY1MjINCkVheDogQTBBQw0KRWN4OiBGRkZGRkZGMg0KRWR4
OiBFNTg2ODkNCkVieDogRTU4NTAwDQpFc2k6IERFMDQxOA0KRWRpOiB
FNjI3MzUNCkVicDogRTU4NThCDQpFc3A6IDEyRkYyMA0KRXJyb3JDb2
RlOiANCjhBLDFGLDQ3LDNBLDVFLDM0LDc1LDhBLDhCLERGLDhCLDMsO
DUsQzAsRiw4NSwyMCxGRixGRixGRiw4QSw0LDI0LDgzLEM0LEMsNUQs
NUYsNUUsNUIsQzMsOEQsNDAsMCxDMyw4RCw0MCwwLDU1LDhCLEVDLDM
zLEMwLDU1LDY4LDZELEY1LDgyLDAsNjQsRkYsMC4uLg0KQ29kZSA9IF
syMTBdDQotIDEwMA0KLSAxNTYNCi0gMjI3DQotIDANCi0gW10NCj4gQ
zpcYXZhbnRcYXZhbnQuZXhlDQoNCkF2YW50IEZvcmNlDQpBdmFudCBC
cm93c2VyDQoxMS43LjAuMzYNCmF2YW50LmV4ZQ0KQ29weXJpZ2h0IDE
5OTktMjAwOSBBdmFudCBGb3JjZS4NCmF2YW50LmV4ZQ0KMTEuNy4wLj
M2DQoNCj4gQzpcV0lORE9XU1xzeXN0ZW0zMlxudGRsbC5kbGwNCj4gQ
zpcV0lORE9XU1xzeXN0ZW0zMlxrZXJuZWwzMi5kbGwNCj4gQzpcV0lO
RE9XU1xzeXN0ZW0zMlxvbGVhdXQzMi5kbGwNCj4gQzpcV0lORE9XU1x
zeXN0ZW0zMlxBRFZBUEkzMi5kbGwNCj4gQzpcV0lORE9XU1xzeXN0ZW
0zMlxSUENSVDQuZGxsDQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcU2Vjd
XIzMi5kbGwNCj4gQzpcV0lORE9XU1xzeXN0ZW0zMlxHREkzMi5kbGwN
Cj4gQzpcV0lORE9XU1xzeXN0ZW0zMlxVU0VSMzIuZGxsDQo IEM6XFd
JTkRPV1Ncc3lzdGVtMzJcbXN2Y3J0LmRsbA0KPiBDOlxXSU5ET1dTXH
N5c3RlbTMyXG9sZTMyLmRsbA0KPiBDOlxXSU5ET1dTXHN5c3RlbTMyX
G1zaW1nMzIuZGxsDQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcdmVyc2lv
bi5kbGwNCj4gQzpcV0lORE9XU1xXaW5TeFNceDg2X01pY3Jvc29mdC5
XaW5kb3dzLkNvbW1vbi1Db250cm9sc182NTk1YjY0MTQ0Y2NmMWRmXz
YuMC4yNjAwLjU1MTJfeC13d18zNWQ0Y2U4M1xjb21jdGwzMi5kbGwNC
j4gQzpcV0lORE9XU1xzeXN0ZW0zMlxTSExXQVBJLmRsbA0KPiBDOlxX
SU5ET1dTXHN5c3RlbTMyXGltbTMyLmRsbA0KPiBDOlxXSU5ET1dTXHN
5c3RlbTMyXHNoZWxsMzIuZGxsDQo IEM6XFdJTkRPV1Ncc3lzdGVtMz
Jcd2luaW5ldC5kbGwNCj4gQzpcV0lORE9XU1xzeXN0ZW0zMlxDUllQV
DMyLmRsbA0KPiBDOlxXSU5ET1dTXHN5c3RlbTMyXE1TQVNOMS5kbGwN
Cj4gQzpcV0lORE9XU1xzeXN0ZW0zMlx1cmxtb24uZGxsDQo IEM6XFd
JTkRPV1Ncc3lzdGVtMzJcY29tZGxnMzIuZGxsDQo IEM6XFdJTkRPV1
Ncc3lzdGVtMzJcd3NvY2szMi5kbGwNCj4gQzpcV0lORE9XU1xzeXN0Z
W0zMlxXUzJfMzIuZGxsDQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcV1My
SEVMUC5kbGwNCj4gQzpcV0lORE9XU1xzeXN0ZW0zMlx3aW5tbS5kbGw
NCj4gQzpcUHJvZ3JhbSBGaWxlc1xNY0FmZWVcSG9zdCBJbnRydXNpb2
4gUHJldmVudGlvblxISVBTQ29yZVxoaXBpLmRsbA0KDQpNY0FmZWUsI
EluYy4NCkhJUFNDb3JlIEluamVjdGVkIExpYnJhcnkNCkhJUFNDT1JF
LjE0LjEuMC40MjYueDg2DQpDb3B5cmlnaHSpIDE5OTUtMjAwOSBNY0F
mZWUsIEluYy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC4NCjAuMC4wLjANCk
hJUFNDT1JFLjE0LjEuMC40MjYueDg2DQpISVBTQ09SRS4xNC4xLjAuN
DI2Lng4Ng0KDQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcUFNBUEkuRExM
DQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcSElQSVMwZTAxMWFhLmRsbA0
KDQpNY0FmZWUsIEluYy4NCkhJUFNDb3JlIEluamVjdGVkIFN0dWINCk
hJUFNDT1JFLjE0LjEuMC40MjYueDg2DQpDb3B5cmlnaHSpIDE5OTUtM
jAwOSBNY0FmZWUsIEluYy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC4NCjAu
MC4wLjANCkhJUFNDT1JFLjE0LjEuMC40MjYueDg2DQpISVBTQ09SRS4
xNC4xLjAuNDI2Lng4Ng0KDQo IEM6XFByb2dyYW0gRmlsZXNcTWNBZm
VlXEhvc3QgSW50cnVzaW9uIFByZXZlbnRpb25cSElQU0NvcmVcSElQU
UEuZGxsDQoNCk1jQWZlZSwgSW5jLg0KSGlwc0NvcmUgUXVlcnkgaW50
ZXJmYWNlDQpISVBTQ09SRS4xNC4xLjAuNDI2Lng4Ng0KQ29weXJpZ2h
0qSAxOTk1LTIwMDkgTWNBZmVlLCBJbmMuIEFsbCBSaWdodHMgUmVzZX
J2ZWQuDQowLjAuMC4wDQpISVBTQ09SRS4xNC4xLjAuNDI2Lng4Ng0KS
ElQU0NPUkUuMTQuMS4wLjQyNi54ODYgDQoNCj4gQzpcV0lORE9XU1xz
eXN0ZW0zMlxIY0FwaS5kbGwNCg0KTWNBZmVlLCBJbmMuDQpNY0FmZWU
gSElQIEVuZ2luZQ0KNy4wLjAuMTAyMQ0KSGNBcGkNCkNvcHlyaWdodK
kgMjAwMC0yMDA5IE1jQWZlZSwgSW5jLiBBbGwgUmlnaHRzIFJlc2Vyd
mVkLg0KSGNBcGkuZGxsDQo3LjAuMC4xMDIxDQpNY0FmZWUgSG9zdCBJ
bnRydXNpb24gUHJldmVudGlvbg0KDQo IEM6XFdJTkRPV1Ncc3lzdGV
tMzJcTVNDVEYuZGxsDQo IEM6XFdJTkRPV1Ncc3lzdGVtMzJcVXhUaG
VtZS5kbGw=

Re: Consistent error dialogs after new anti-virus

Posted: Tue Sep 01, 2009 9:06 pm
by kudos
Here is your decoded error message:

Code: Select all

Version: WkB0Y213JEZ3anF1YnVVJClSOzslPCI8Iz44UyMvHRpKIDwnM3FhfXlxNiYjOSgpOUt/dn56b3lMT5FR3ZORwFlV38N
ImageBase: 00400000
Eip: 82F522
Eax: A0AC
Ecx: FFFFFFF2
Edx: E58689
Ebx: E58500
Esi: DE0418
Edi: E62735
Ebp: E5858B
Esp: 12FF20
ErrorCode: 
8A,1F,47,3A,5E,34,75,8A,8B,DF,8B,3,85,C0,F,85,20,FF,FF,FF,8A,4,24,83,C4,C,5D,5F,5E,5B,C3,8D,40,0,C3,8D,40,0,55,8B,EC,33,C0,55,68,6D,F5,82,0,64,FF,0...
Code = [210]
- 100
- 156
- 227
- 0
- []
> C:\avant\avant.exe

Avant Force
Avant Browser
11.7.0.36
avant.exe
Copyright 1999-2009 Avant Force.
avant.exe
11.7.0.36

> C:\WINDOWS\system32\ntdll.dll
> C:\WINDOWS\system32\kernel32.dll
> C:\WINDOWS\system32\oleaut32.dll
> C:\WINDOWS\system32\ADVAPI32.dll
> C:\WINDOWS\system32\RPCRT4.dll
> C:\WINDOWS\system32\Secur32.dll
> C:\WINDOWS\system32\GDI32.dll
> C:\WINDOWS\system32\USER32.dll
> C:\WINDOWS\system32\msvcrt.dll
> C:\WINDOWS\system32\ole32.dll
> C:\WINDOWS\system32\msimg32.dll
> C:\WINDOWS\system32\version.dll
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
> C:\WINDOWS\system32\SHLWAPI.dll
> C:\WINDOWS\system32\imm32.dll
> C:\WINDOWS\system32\shell32.dll
> C:\WINDOWS\system32\wininet.dll
> C:\WINDOWS\system32\CRYPT32.dll
> C:\WINDOWS\system32\MSASN1.dll
> C:\WINDOWS\system32\urlmon.dll
> C:\WINDOWS\system32\comdlg32.dll
> C:\WINDOWS\system32\wsock32.dll
> C:\WINDOWS\system32\WS2_32.dll
> C:\WINDOWS\system32\WS2HELP.dll
> C:\WINDOWS\system32\winmm.dll
> C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\hipi.dll

McAfee, Inc.
HIPSCore Injected Library
HIPSCORE.14.1.0.426.x86
Copyright© 1995-2009 McAfee, Inc. All Rights Reserved.
0.0.0.0
HIPSCORE.14.1.0.426.x86
HIPSCORE.14.1.0.426.x86

> C:\WINDOWS\system32\PSAPI.DLL
> C:\WINDOWS\system32\HIPIS0e011aa.dll

McAfee, Inc.
HIPSCore Injected Stub
HIPSCORE.14.1.0.426.x86
Copyright© 1995-2009 McAfee, Inc. All Rights Reserved.
0.0.0.0
HIPSCORE.14.1.0.426.x86
HIPSCORE.14.1.0.426.x86

> C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPQA.dll

McAfee, Inc.
HipsCore Query interface
HIPSCORE.14.1.0.426.x86
Copyright© 1995-2009 McAfee, Inc. All Rights Reserved.
0.0.0.0
HIPSCORE.14.1.0.426.x86
HIPSCORE.14.1.0.426.x86 

> C:\WINDOWS\system32\HcApi.dll

McAfee, Inc.
McAfee HIP Engine
7.0.0.1021
HcApi
Copyright© 2000-2009 McAfee, Inc. All Rights Reserved.
HcApi.dll
7.0.0.1021
McAfee Host Intrusion Prevention

> C:\WINDOWS\system32\MSCTF.dll
> C:\WINDOWS\system32\UxTheme.dll
I use Avant with XP SP3 and IE8 and have no problems at all.
Do you have any errors with McAfee completely disabled?

Re: Consistent error dialogs after new anti-virus

Posted: Wed Sep 02, 2009 7:13 pm
by JMerrill
It is supposedly a violation of corporate policy to disable the anti-virus. I have not attempted to do it, though I might. I certainly have these errors consistently, and don't recall more than one or two cases where I ever saw that error dialog in the pre-McAfee world.

It seems from the decoded reply that the error handling routine might have seen what was on the stack when the problem occurred, as it provides details of McAfee modules loaded into the process. Or is it just providing info about any modules loaded into the process that don't belong to MS or to Avant?

Was the [210] error code a Windows API error, meaning "The signal handler cannot be set"? Or does it mean something else? Do you know what the actual "fault" was that caused the dialog to be presented? It seems from the value of EIP that the error took place in Avant's code, not in the code of any of the DLLs loaded into the process.

I've collected a rather large number of logs -- e.g. the one appears when I click a link to start Avant and get to a page, those that appear when I close, those that appear when I don't get to a page "because" Avant is already loaded, and so on. Would it be of value to you to attach the text file that has them all pasted in?

Thanks for your assistance, but I'm really trying to find out if there's a chance that I'll be able to "solve this" without upgrading my browser -- when I don't even know if that would help. If I knew a bit more about the exception that was trapped, I might be able to find out if McAfee knows about the problem. (I would guess that most apps are less able than Avant to keep going after one of those faults.) Is there more info available to me that would let me figure out where to go to solve this?