Online Scanner Crashes Browsers

ajje

When running the online scanner on either IE8 or Firefox v3.6.10 the browsers crash on Win7-Pro 64bit.

I have Avast Antivirus installed, but have disabled it (stopped its service and made sure none of its processes were resident in memory before starting the browser).

After having experienced the crash several times, I attached WinDBG to your IE-plugin and when it crashed I made a minidump which I then loaded fresh in another WinDBG session. The following information was obtained:

===== WINDBG OUTPUT START =====

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\temp\IE8_bitdefender_online.dmp]

User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: SRV*C:\dev\3rd\symbols*HTTP://MSDL.MICROSOFT.COM/DOWNLOAD/SYMBOLS

Executable search path is:

Windows 7 Version 7600 MP (8 procs) Free x64

Product: WinNt, suite: SingleUserTS

Machine Name:

Debug session time: Sat Oct 9 05:57:51.000 2010 (UTC + 2:00)

System Uptime: not available

Process Uptime: 0 days 0:02:31.000

...............................................WARNING: propsys overlaps uxtheme

...WARNING: rsaenh overlaps cryptsp

...........WARNING: nlaapi overlaps RpcRtRemote

...

..........WARNING: mswsock overlaps dnsapi

WARNING: mswsock overlaps nlaapi

WARNING: mswsock overlaps RpcRtRemote

..WARNING: NapiNSP overlaps winrnr

..WARNING: mdnsNSP overlaps IPHLPAPI

...........WARNING: dsound overlaps winspool

.WARNING: powrprof overlaps oleacc

...............

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(13d0.9bc): Access violation - code c0000005 (first/second chance not available)

*** ERROR: Symbol file could not be found. Defaulted to export symbols for qsax.dll -

qsax!DllUnregisterServer+0xad104:

0a8a0e9a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

0:035:x86> .load wow64exts

0:035:x86> .ecxr

eax=0b044f50 ebx=00000000 ecx=00000000 edx=0b045ffd esi=0ad3943c edi=00000000

eip=0000002b esp=00000000 ebp=00000000 iopl=3 vip ov up di ng nz na po nc

cs=0000 ss=0000 ds=9434 es=0000 fs=54f8 gs=0000 efl=7790f982

0000002b ?? ???

0:035:x86> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

GetPageUrlData failed, server returned HTTP status 404

URL requested: http://watson.microsoft.com/StageOne/iexpl....htm?Retriage=1

FAULTING_IP:

qsax!DllUnregisterServer+ad104

0a8a0e9a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 000000000a8a0e9a (qsax!DllUnregisterServer+0x00000000000ad104)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000000

Parameter[1]: 000000000b046000

Attempt to read from address 000000000b046000

PROCESS_NAME: iexplore.exe

OVERLAPPED_MODULE: Address regions for 'mswsock' and 'nlaapi' overlap

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000b046000

READ_ADDRESS: 000000000b046000

FOLLOWUP_IP:

qsax!DllUnregisterServer+ad104

0a8a0e9a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.

Instruction at 000000000a8a0e9a does not read/write to 000000000b046000

MOD_LIST: <ANALYSIS/>

FAULTING_THREAD: 00000000000009bc

BUGCHECK_STR: APPLICATION_FAULT_CODE_ADDRESS_MISMATCH_INVALID_POINTER_READ_ZEROED_STACK

PRIMARY_PROBLEM_CLASS: CODE_ADDRESS_MISMATCH

DEFAULT_BUCKET_ID: CODE_ADDRESS_MISMATCH

LAST_CONTROL_TRANSFER: from 000000000a83d285 to 000000000a8a0e9a

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

0ad3943c 0a83d285 0ad395f8 0ad3a6a5 ffffffe4 qsax!DllUnregisterServer+0xad104

0ad3e61c 000ad3f8 fb771b00 a27791ff e07d5eca qsax!DllUnregisterServer+0x494ef

0ad3e620 fb771b00 a27791ff e07d5eca e0000000 0xad3f8

0ad3e624 a27791ff e07d5eca e0000000 00771b00 0xfb771b00

0ad3e628 e07d5eca e0000000 00771b00 c4000000 0xa27791ff

0ad3e62c e0000000 00771b00 c4000000 7c0ad3f6 0xe07d5eca

0ad3e630 00771b00 c4000000 7c0ad3f6 dc0ad3f7 0xe0000000

0ad3e634 c4000000 7c0ad3f6 dc0ad3f7 dd0ad3f7 0x771b00

0ad3e638 7c0ad3f6 dc0ad3f7 dd0ad3f7 10779603 0xc4000000

0ad3e63c dc0ad3f7 dd0ad3f7 10779603 38001100 0x7c0ad3f6

0ad3e640 dd0ad3f7 10779603 38001100 00772796 0xdc0ad3f7

0ad3e644 10779603 38001100 00772796 00000000 0xdd0ad3f7

0ad3e648 38001100 00772796 00000000 00771b00 0x10779603

0ad3e64c 00772796 00000000 00771b00 d0771b00 0x38001100

0ad3e650 00000000 00771b00 d0771b00 32007836 0x772796

STACK_COMMAND: kb

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: qsax!DllUnregisterServer+ad104

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: qsax

IMAGE_NAME: qsax.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4cac4103

FAILURE_BUCKET_ID: CODE_ADDRESS_MISMATCH_c0000005_qsax.dll!DllUnregisterServer

BUCKET_ID: X64_APPLICATION_FAULT_CODE_ADDRESS_MISMATCH_INVALID_POINTER_READ_ZEROED_STACK_qs

ax!DllUnregisterServer+ad104

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/iexpl....htm?Retriage=1

Followup: MachineOwner

---------

===== WINDBG OUTPUT END =====

CPU: Core i7 930

RAM: 8GB (Checked for errors, none exist)

MoBo: Asus Rampage II Extreme

HDD: Intel X-25M G2 (160GB)

Gfx: ATI Radeon HD 5870 (Driver: 8.762-100803a-103691C-ATI)

PS.

I used the online scanner for product evaluation before considering a purchase, since I've been bitten far to many times by Antivirus programs that completely screws up the system (makes it unbootable or introduces random crashes) and as such only evaluate anti-virus nowadays using whatever online tools are available from vendors. Obviously I'll not be buying a tools which doesn't work even in the simplest of its configurations (scan-only that is), when executing on my machine ...

rootkit

Hello

Sorry for the delayed reply.

Please use the Quick Scanner available here:

http://quickscan.bitdefender.com/

Thank you.