Pages: 1
Print
Author Topic: Summary of issues involving McAfee VirusScan  (Read 12060 times)
Su-Laine Yeo
Solutions Consultant
Member

Posts: 260


« on: July 20, 2010, 04:57:42 PM »

Overview
A small number of users have reported crashes when using XMetaL 6.0 on a system that is running McAfee VirusScan Enterprise 8.x. We have found that the  “ScriptScan” feature in McAfee VirusScan causes consistently-reproducible crashes in XMetaL 6.0. When ScriptScan is enabled,
XMetaL Author Enterprise 6.0 may crash for no apparent reason during or shortly after interacting with a dialog (XFT form). The issue can be resolved by applying a patch as described in this article.


Background:

McAfee's ScriptScan software alters Windows's core functionality so that Windows Script Host (WSH) no longer runs scripts directly. ScriptScan acts as a proxy, intercepting all requests to WSH to run scripts (from all applications, such as Internet Explorer and XMetaL). It checks scripts for malicious content and selectively allows them to run, in which case it passes them on to WSH. Apparently this behavior does not mimic the standard Windows behavior closely enough and in some cases can trigger unexpected behavior in XMetaL.

McAfee has released various patches to help their clients who are running software from other vendors (including specific applications from Microsoft that were also crashing) but they have no patches available to address the issue with XMetaL. Our new DLL attempts to work around this issue and as far as we can tell (8 clients are currently using this solution as of December 2010) the issue is resolved.

Instructions:

Note: Use this patch with XMetaL Author Enterprise 6.0.x only. It is not needed, nor is it supported, with other versions of XMetaL.

1. Rename the following file:
Existing name: C:\Program Files\Common Files\XMetaL Shared\XFRunner.dll
New name:      C:\Program Files\Common Files\XMetaL Shared\XFRunner.dll.original

2. Download and unzip the attached XFRunner.dll file, and place it in the in C:\Program Files\Common Files\XMetaL Shared\ folder.
3. Run the following two commands at a command prompt:
    cd C:\Program Files\Common Files\XMetaL Shared\
    regsvr32.exe XFRunner.dll
If step 3 succeeds you should get a positive message indicating the DLL has been registered.

Uninstallation Instructions
In the unlikely event that you need to restore the default XFrunner.dll file, use the following instructions:

1. Delete the following file:
      C:\Program Files\Common Files\XMetaL Shared\XFRunner.dll

2. Rename this file
      Existing name: C:\Program Files\Common Files\XMetaL Shared\XFRunner.dll.original
      New name:      C:\Program Files\Common Files\XMetaL Shared\XFRunner.dll

3. Run the following two commands at a command prompt:
    cd C:\Program Files\Common Files\XMetaL Shared\
    regsvr32.exe XFRunner.dll

If step 3 succeeds you should get a positive message indicating the DLL has been registered.

Alternatives
Another approach to resolving the problem is to turn the ScriptScan feature off, as described in this article: https://kc.mcafee.com/corporate/index?page=content&id=KB55961 . Doing this will prevent the crashes, however keep in mind that you will also lose the security-related benefits of the ScriptScan feature.

One user reported that uninstalling and reinstalling McAfee VirusScan resolved the issue without the need to turn off the ScriptScan feature, however we have not found that this procedure solves the problem on our test machine.

* XFRunner 60139.zip (1471.4 KB - downloaded 790 times.)
« Last Edit: January 04, 2011, 02:06:52 PM by Su-Laine Yeo » Logged

Su-Laine Yeo
Solutions Consultant
JustSystems Canada, Inc.
gcrews
Member

Posts: 265


« Reply #1 on: December 30, 2010, 03:58:50 PM »

I just tested the new dll with a completely fresh installation of Xmetal 6.0.1.030. Still crashes for me.

1.   Uninstalled current Xmetal version
2.   Deleted folder %ProgramFiles%\Common Files\XMetaL Shared\
3.   Deleted folder %APPDATA%\SoftQuad\
4.   Deleted folder %ProgramFiles%\Corel\Shared\XMetaL\Writing Tools\10.0\
5.   Deleted folder  %ProgramFiles%\XMetaL 6.0\
6.   Installed Xmetal 6.0.1.030
7.   Started Xmetal
8.   Closed Xmetal
9.   Replaced XFRunner.dll
10.   Opened Xmetal
11.   Worked for a little bit, Xmetal crashed.
Logged
Su-Laine Yeo
Solutions Consultant
Member

Posts: 260


« Reply #2 on: January 03, 2011, 07:43:15 PM »

Hi Geoff,

You deserve a prize for patiently troubleshooting with us.

Our developers asked me to ask you to double-check whether the new XFRunner.dll was properly registered. Could you please try registering it again?

What version of Windows are you using?

Also, this post suggests that random crashes could be related to DITA content: http://forums.xmetal.com/index.php/topic,1151.0.html . Does your content have anything special in the <xref> "type" attribute?

Thanks again for your patience,
Su-Laine
Logged

Su-Laine Yeo
Solutions Consultant
JustSystems Canada, Inc.
gcrews
Member

Posts: 265


« Reply #3 on: January 04, 2011, 01:32:54 AM »

I did not see the regsvr32.exe item before. I tried again though after registering the dll and Xmetal still crashe. I also tested in a fresh vm and it still crashes. I’m not using any special files; I just have the evaluation map and topic xmetal first loads open. In the vm test I used VirusScan Enterprise 8.7i, Patch 4, I think previously we have been using patch 3 but I didn’t see any changes relating to the script scan in the changes posted.
https://kc.mcafee.com/corporate/index?page=content&id=KB65944
1.   Created standard windows xp VM machine
2.   Installed windows xp sp3
3.   Installed vm tools
4.   Installed .net 3.5 sp1 (CRC32: 1D9139BD)
5.   Installed xp sp3 symbols (for debugging stack trace below)
6.   Installed XMAU-ENTERPRISE-6.0.1.39.exe (CRC32: 5A7BF2E9)
7.   Started Xmetal
8.   Ran one compile to deploy toolkit
9.   Closed Xmetal
10.   Installed VirusScan Enterprise 8.7i, Patch 4 (VSE870EMLRP4.Zip, CRC32: 5B37CF4B)
11.   Started Xmetal
12.   Crashed after a few min
13.   Renamed XFRunner.dll to XFRunner.bak
14.   Placed new XFRunner.dll into folder
15.   Registered
16.   Started Xmetal
17.   Crashed on first topicref insert.
18.   Reopened Xmetal
19.   Opened one dialog (to load XFRunner.dll).
20.   Opened procexp.exe
21.   Took screenshot below of loaded dlls
I also attached a few crash logs that might help. I find it crashes pretty consistently if you insert a topicref or load some dialog, either right before or after pressing ok or browsing for a file, switch to a different program or window such as a open folder, wait about 20 seconds,  switch back to xmetal,  then xmetal crashes  at least 20% of the time for me.


* dlls.PNG (12.15 KB, 888x140 - viewed 768 times.)
* crash logs.zip (5.13 KB - downloaded 377 times.)
Logged
Su-Laine Yeo
Solutions Consultant
Member

Posts: 260


« Reply #4 on: January 04, 2011, 02:09:19 PM »

Thanks Geoff. I've replaced the XFRunner.dll attachment in the original post above with a newer version, called XFRunner 60139.zip. Could you please try that one and see if it works?

We really appreciate the log files and screenshots, and are looking at them now.

Su-Laine
Logged

Su-Laine Yeo
Solutions Consultant
JustSystems Canada, Inc.
gcrews
Member

Posts: 265


« Reply #5 on: January 04, 2011, 08:58:19 PM »

Looking very good so far with the new dll you posted. Before, even with the first dll, I could crash Xmetal in about 3 min after a few topicref inserts. With the one you just posted though, it has not crashed after 15 min of testing and about 50 topicref inserts and a few other dialog tests. Appears to have have solved the issue.

•   XFRunner.dll (6.0.1.030 , CRC32: E61CE098) - Crashes
•   XFRunner.dll (6.0.2.021 - CRC32: BB9045D0) - Crashes
•   XFRunner.dll (6.0.1.039 - CRC32: AD330AF1) – Appears stable
« Last Edit: January 04, 2011, 09:12:41 PM by gcrews » Logged
Pages: 1
Print
Jump to: