Summary of issues involving McAfee VirusScan

[Su-Laine Yeo]

Overview
A small number of users have reported crashes when using XMetaL 6.0 on a system that is running McAfee VirusScan Enterprise 8.x. We have found that the  “ScriptScan” feature in McAfee VirusScan causes consistently-reproducible crashes in XMetaL 6.0. When ScriptScan is enabled,
XMetaL Author Enterprise 6.0 may crash for no apparent reason during or shortly after interacting with a dialog (XFT form). The issue can be resolved by applying a patch as described in this article.

Background:
McAfee's ScriptScan software alters Windows's core functionality so that Windows Script Host (WSH) no longer runs scripts directly. ScriptScan acts as a proxy, intercepting all requests to WSH to run scripts (from all applications, such as Internet Explorer and XMetaL). It checks scripts for malicious content and selectively allows them to run, in which case it passes them on to WSH. Apparently this behavior does not mimic the standard Windows behavior closely enough and in some cases can trigger unexpected behavior in XMetaL.

McAfee has released various patches to help their clients who are running software from other vendors (including specific applications from Microsoft that were also crashing) but they have no patches available to address the issue with XMetaL. Our new DLL attempts to work around this issue and as far as we can tell (8 clients are currently using this solution as of December 2010) the issue is resolved.

Instructions:
Note: Use this patch with XMetaL Author Enterprise 6.0.x only. It is not needed, nor is it supported, with other versions of XMetaL.

1. Rename the following file:
Existing name: C:Program FilesCommon FilesXMetaL SharedXFRunner.dll
New name:      C:Program FilesCommon FilesXMetaL SharedXFRunner.dll.original

2. Download and unzip the attached XFRunner.dll file, and place it in the in C:Program FilesCommon FilesXMetaL Shared folder.
3. Run the following two commands at a command prompt:
   cd C:Program FilesCommon FilesXMetaL Shared
   regsvr32.exe XFRunner.dll
If step 3 succeeds you should get a positive message indicating the DLL has been registered.

Uninstallation Instructions
In the unlikely event that you need to restore the default XFrunner.dll file, use the following instructions:

1. Delete the following file:
     C:Program FilesCommon FilesXMetaL SharedXFRunner.dll

2. Rename this file
     Existing name: C:Program FilesCommon FilesXMetaL SharedXFRunner.dll.original
     New name:      C:Program FilesCommon FilesXMetaL SharedXFRunner.dll

3. Run the following two commands at a command prompt:
   cd C:Program FilesCommon FilesXMetaL Shared
   regsvr32.exe XFRunner.dll
If step 3 succeeds you should get a positive message indicating the DLL has been registered.

Alternatives
Another approach to resolving the problem is to turn the ScriptScan feature off, as described in this article: https://kc.mcafee.com/corporate/index?page=content&id=KB55961 . Doing this will prevent the crashes, however keep in mind that you will also lose the security-related benefits of the ScriptScan feature.

One user reported that uninstalling and reinstalling McAfee VirusScan resolved the issue without the need to turn off the ScriptScan feature, however we have not found that this procedure solves the problem on our test machine.

Reply

[gcrews]

I just tested the new dll with a completely fresh installation of Xmetal 6.0.1.030. Still crashes for me.

1. Uninstalled current Xmetal version
2. Deleted folder %ProgramFiles%Common FilesXMetaL Shared
3. Deleted folder %APPDATA%SoftQuad
4. Deleted folder %ProgramFiles%CorelSharedXMetaLWriting Tools10.0
5. Deleted folder  %ProgramFiles%XMetaL 6.0
6. Installed Xmetal 6.0.1.030
7. Started Xmetal
8. Closed Xmetal
9. Replaced XFRunner.dll
10. Opened Xmetal
11. Worked for a little bit, Xmetal crashed.

Reply

[Su-Laine Yeo]

Hi Geoff,

You deserve a prize for patiently troubleshooting with us.

Our developers asked me to ask you to double-check whether the new XFRunner.dll was properly registered. Could you please try registering it again?

What version of Windows are you using?

Also, this post suggests that random crashes could be related to DITA content: http://forums.xmetal.com/index.php/topic,1151.0.html . Does your content have anything special in the “type” attribute?

Thanks again for your patience,
Su-Laine

Reply

[gcrews]

I did not see the regsvr32.exe item before. I tried again though after registering the dll and Xmetal still crashe. I also tested in a fresh vm and it still crashes. I’m not using any special files; I just have the evaluation map and topic xmetal first loads open. In the vm test I used VirusScan Enterprise 8.7i, Patch 4, I think previously we have been using patch 3 but I didn’t see any changes relating to the script scan in the changes posted.
https://kc.mcafee.com/corporate/index?page=content&id=KB65944
1. Created standard windows xp VM machine
2. Installed windows xp sp3
3. Installed vm tools
4. Installed .net 3.5 sp1 (CRC32: 1D9139BD)
5. Installed xp sp3 symbols (for debugging stack trace below)
6. Installed XMAU-ENTERPRISE-6.0.1.39.exe (CRC32: 5A7BF2E9)
7. Started Xmetal
8. Ran one compile to deploy toolkit
9. Closed Xmetal
10. Installed VirusScan Enterprise 8.7i, Patch 4 (VSE870EMLRP4.Zip, CRC32: 5B37CF4B)
11. Started Xmetal
12. Crashed after a few min
13. Renamed XFRunner.dll to XFRunner.bak
14. Placed new XFRunner.dll into folder
15. Registered
16. Started Xmetal
17. Crashed on first topicref insert.
18. Reopened Xmetal
19. Opened one dialog (to load XFRunner.dll).
20. Opened procexp.exe
21. Took screenshot below of loaded dlls
I also attached a few crash logs that might help. I find it crashes pretty consistently if you insert a topicref or load some dialog, either right before or after pressing ok or browsing for a file, switch to a different program or window such as a open folder, wait about 20 seconds,  switch back to xmetal,  then xmetal crashes  at least 20% of the time for me.

Reply

[Su-Laine Yeo]

Thanks Geoff. I've replaced the XFRunner.dll attachment in the original post above with a newer version, called XFRunner 60139.zip. Could you please try that one and see if it works?

We really appreciate the log files and screenshots, and are looking at them now.

Su-Laine

Reply

[gcrews]

Looking very good so far with the new dll you posted. Before, even with the first dll, I could crash Xmetal in about 3 min after a few topicref inserts. With the one you just posted though, it has not crashed after 15 min of testing and about 50 topicref inserts and a few other dialog tests. Appears to have have solved the issue.

• XFRunner.dll (6.0.1.030 , CRC32: E61CE098) – Crashes
• XFRunner.dll (6.0.2.021 – CRC32: BB9045D0) – Crashes
• XFRunner.dll (6.0.1.039 – CRC32: AD330AF1) – Appears stable

Reply

[Author]

Posts