Illegal Operation

[Vietnam Vet]

Hi,

Every once in a while I will get the warning that Port Explorer has performed an illegal operation and will be shut down. I believe this only happens after an extended period of online time(2-3 hrs.), but that is unconfirmed as yet. Once I click the close button on the message, the program goes through it's closing procedures, but when finished, the error message returns and will not go away until a reboot is done. Other than the fact that the message window shows, I seem to be able to do anything I want without any problems. Using TDS, Port Explorer still shows in the process window. If I try to kill it with TDS, it appears to try, but process remains visible in the window. Trying to kill again will result in a warning about closing the kernel32.dll and resulting in needing to reboot, so I finish everything I am doing and reboot normally, using the start button procedure, without any problems.

Win98SE, IE6.0SP1, Port Explorer 1.620, Zone Alarm 3.7.143, NAV 2000(6.10.22). If any other info needed, just ask.

Some background info that may or may not be relevant. No problems running trial version, so I registered just before the weekend(Mar. 6 or 7). Got my e-mail confirmation on Mon. 10th. Downloaded and installed, no problem. Couple of days later, although I could connect to my provider, could not surf, download updates, check mail, or anything. Zone Alarm stopped everything. Use Earthlink account, but do not use their software, on a dialup. I assume the reason I could connect was because other than dialing into their service, nothing is started that ZA can relate to, until I try to access with some application. I uninstalled Zone Alarm and Port Explorer completely, three different times, using three different versions of Zone Alarm(such fun that was). Each time, everything would work for a day or two, then right back to the same problem. All of this was further complicated because that just happened to be the same time a newer version of Port Explorer was released, so the registered version I downloaded was newer than the version that I trialed. Too many variables involved in this situation! After installing the present version of ZA, this behaviour has NOT re-occurred. I only mention it in case it may offer some insight into the illegal operation problem that I may not be aware of.

Thanks in advance for any help or advice offered. By the way, Port Explorer was installed first before ZA, in all reinstalls of the two programs.

The only things missing from the screenshot are the words: Stack Dump:

[Jason_DiamondCS]

Hi Vietnam Vet. Sorry to hear Port Explorer is crashing on you. Could you just confirm what you do just before it crashes? Is it nothing at all, completely random after 2-3 hours as you said? Or is it when you are shutting down Port Explorer (after you've clicked close) . If you could give me a stackdump I will be able to help you out more in regards to the crash.

Thats very weird about your ZoneAlarm/Port Explorer problems. I wonder if Zone Alarm tries to block Port Explorer running, is there any options in that regard? Have you allowed Port Explorer and its accompanying DLL's (dcsws2.dll) full access to the network? Its good that you installed Port Explorer before Zone Alarm (but I don't think you need to do this with Zone Alarm or any of the better firewalls).

The last thing I suggest is to download this program called LSPFIX and post the screenshot of that program running so I can examine what LSP's are installed on your system.
http://www.cexx.org/lspfix.zip

BTW are you using Port Explorer v1.620 ?

-Jason-

[Vietnam Vet]

Hello Jason,

The last crash occurred while downloading Norton virus definitions using DLExpert v0.99, do not remember details from earlier problems. This has happened maybe 4 or 5 times total over a period of approximately 6 or 7 weeks. Closing down Port Explorer normally, never causes a problem. It takes longer to close depending on how long I have been online with the program running. That would appear to be normal based on posts from other users that I have read. I have currently been online almost 4 hours without a problem. Concerning the stackdump, the only thing appearing in the error message window was the words Stack Dump: with no further info given.

As far as the access problems are concerned, that has not reoccurred in approximately 2 months. If that is not relevant to my current problem, forget I even mentioned it, as it appears to no longer be an issue.

Yes, I am using v1.620, but earlier crash problems occurred with earlier versions. I know this is pretty random stuff, so when(if) the problem reoccurs, I will try to provide more information if possible.

[Jason_DiamondCS]

Ok thanks Vietnam Vet, seems all your LSP's are fine too, I unhappily...await your next crash :)
-Jason-

[Vietnam Vet]

{QUOTE-> quoting: Jason / DiamondCS link=board=7;threadid=9547;start=0#msg62523 date=1053667612]
Ok thanks Vietnam Vet, seems all your LSP's are fine too, I unhappily...await your next crash :)
-Jason-

<-QUOTE}

Hey, while this is slightly annoying, it doesn't cause me any real problems. Don't be unhappy on my account, I'm not unhappy. Enjoy the upcoming weekend. :D It will be here before you know it.

[Gavin - DiamondCS]

Hi,

Make sure you scroll down to see the stack dump information ;)

I would suggest a thorough virus scan, with at least a good antivirus. If you have TDS update and run a Full System Scan too, or download and install it.

http://tds.diamondcs.com.au/

Update before scanning of course -

http://tds.diamondcs.com.au/index.php?page=update

[Jooske]

You can rightclick the error details and copy/paste them here, easier then a screenshot i guess.

Yes, for those for whom office hours are over, happy weekend!

[Vietnam Vet]

Hi Gavin,

"Make sure you scroll down to see the stack dump information"

I guess I am not making myself clear about the stackdump thing. In the error message were the words Stack Dump: Nothing else was reported in the window. From everyones reaction, I would think the stack dump info should have been there, not just the word's Stack Dump:, but for whatever the reason, it did not happen. Window's Magic, perhaps? :o

"I would suggest a thorough virus scan, with at least a good antivirus. If you have TDS update and run a Full System Scan too, or download and install it."

Virus scans, TDS scans, Spyware scans, HijackThis scans, all of this is a normal routine for me. Paranoid? Maybe. Ever-vigilant? Definitely! ;D

Jason,

I was online for about 6 hours last night without a hiccup of any kind, so I guess the time thing doesn't apply either.

[DolfTraanberg]

For collecting crash details, they do a pretty good job here:
http://www.bugtoaster.com
Dolf

[Gavin - DiamondCS]

Hi VIETNAM_VET,

I've never seen a crash like that where the information WASN'T included. So if you scroll the window down to the bottom and there isn't any stack dump info.. perhaps theres something wrong with your system ? Is it a very old install that has slowly been degrading ? :o

[Vietnam Vet]

Gavin,

This install was done about the middle of October, 2002. Zeroed the hard drive out before the installation procedure. System normally works very well. As to the crash info, I don't have a clue why the info wasn't included. Can't say if it was there in the other instances of illegal operations that occurred with Port Explorer or not. If it happens again, hopefully I will get a "normal" crash. ::) :-X

By the way, the only reason I have been referring to this as a crash is because that is what Jason called it. Is an illegal operation error such as this always considered a crash? The only complication encountered was the error message refusal to go away.

[Vietnam Vet]

Hello again,

Port Explorer was shut down again. This time I was looking at a couple of different sites where the Adshield application identifies a lot of web bugs.

When the original error message pops up there is stack dump info. After clicking close on the message, Port Explorer again appears to shut down. After this completes, error message returns with no stack dump info and some of the other info is different as well. This was probably the same thing that happened before, but I probably did not click details before clicking on close. Sorry for the confusion on this issue. Hopefully the additional info will help to shed some light on this situation.

Original error:

PORTEXPLORER caused an invalid page fault in
module KERNEL32.DLL at 0187:bff7dae6.
Registers:
EAX=00000000 CS=0187 EIP=bff7dae6 EFLGS=00010202
EBX=bffac578 SS=018f ESP=006fda34 EBP=006fda40
ECX=fe8ce000 DS=018f ESI=fffffffc FS=328f
EDX=a7c62278 ES=018f EDI=3fffffff GS=0000
Bytes at CS:EIP:
89 44 f9 04 e8 8d f3 ff ff ff 35 10 9d fc bf e8
Stack dump:
a7c62278 bffabdea fffffffc 006fda5c bff7db24 81751c70 fffffffc a7c62278 00000000 00000000 006fdb54 bffac3a3 81751c70 a7c62278 00000000 bffabdea


Error message that appears after clicking close on message:

PORTEXPLORER caused an invalid page fault in
module KERNEL32.DLL at 0187:bff88396.
Registers:
EAX=c00309c4 CS=0187 EIP=bff88396 EFLGS=00010212
EBX=01a7ffec SS=018f ESP=0197fe98 EBP=01980010
ECX=00000000 DS=018f ESI=00000000 FS=49cf
EDX=bff76855 ES=018f EDI=bff79060 GS=0000
Bytes at CS:EIP:
53 56 57 8b 75 10 8b 38 33 db 85 f6 75 2d 8d b5
Stack dump:

Other applications running at the time were: NAV2000, Goback2.1d, SpywareGuard 2.1, ZA 3.7.143, TDS 3.2.1, Spyblocker 4.75, ID-Blaster Plus 2.0, IE6.0SP1 with Adshield 3.0 Beta.

Thanks.

[Pilli]

Hi Vietnam_vet,

Only guessing here - Go back may be the culprit, I am not sure where I have seen various possible conflicts with Goback but the following link may help.

http://www.roxio.com/en/support/goback/knowledgebase.jhtml#_Toc12861745

It may pay you to disable Goback and retry PE

[Vietnam Vet]

Hi Pilli,

Thanks for the link. I pray that does not turn out to be the case concerning a conflict of some type between Goback and Port Explorer. I personally consider Goback to be one of the best applications on this computer and it is extremely unlikely that I will ever remove it.

Before I installed the registered version of Port Explorer, I rarely had any problems with this computer, including with the evaluation version of PE. I was even remarking to someone at work that my computer was working probably the best it ever had since purchasing it. Do not get me wrong here. I like Port Explorer and sincerely hope there is a solution to my problem. I am not saying there is anything wrong with Port Explorer. In the event a solution is not found or Goback turns out to be the source, I will continue to use everything just as it is, as long as more severe complications do not arise.

Again, thanks for the info and enjoy the weekend! :)

[Patrice]

Hi VIETNAM_VET,

if you upgrade to Windows ME or Windows XP you won't need Go Back any longer. The system restore is already included in those OS and is very reliable. ::)

Regards,

Patrice

[Vietnam Vet]

Hi Patrice,

Having used a couple of computers with ME on them, I will have to respectfully disagree. Friends who own ME also say that it does not monitor everything. I know on my daughters computer we downloaded a video card driver update that went sour during installation. Used restore to return to a time before the download. While it did return the operation back to it's previous state, the download was still there. Not saying that is necessarily a bad thing, but I prefer Goback's operation. It is more like a mirror image. Everything is returned to it's previous state as if it never happened in the first place. In my opinion that leaves less room for error.

[Patrice]

Hi VIETNAM_VET,

in that case your absolutely right! ;D I really dislike ME and I ran into almost the same problems as you did. But not in Windows XP. If you once have the possibility to check the restore function in it, give it a try. It's a really nice feature!

Best regards,

Patrice

P.S. I don't think that you upgrade your Windows 98SE to Windows ME. Rather XP I guess... ;)

[Vietnam Vet]

Hi Patrice,

I have heard that XP's restore is better than ME's, but no personal experience with it. I'm just kinda attached to this ol' 98 version. Thanks for the tips.

[Jason_DiamondCS]

Hi Vietnam_Vet,
there is no usefull information in that crash report except where abouts in KERNEL32.DLL its crashing. Since there have been no other reports currently and its not crashing in Port Explorer (but a system DLL) all I can say is try and see if another program is causing it. If I find anymore information I will post it.
-Jason-

[Vietnam Vet]

Jason,

I did run into a problem today concerning windows logging. When I clicked on clear the window log, the entire Port Explorer screen went blank. I waited about 5 minutes and there was no apparent activity, so I did the 3-finger salute and it showed Port Explorer not responding. Signed off the 'net, closed all my other running applications, waited a few more minutes with no response from Port Explorer. Ended task, Port Explorer closed, everything back to normal.

Is there any possibility that any of the user controlled settings for Port Explorer could cause the illegal operation error? Should I think about removing and reinstalling Port Explorer?

[Jason_DiamondCS]

When clearing the window log it is calling a standard windows function, and hence it shouldn't present any problems. Doing that though MAY take some time (minutes in some cases) depending on how many items
were in the listview. What limit have you set on the window logging?

You could try reinstalling Port Explorer, uninstall it first, then install it.
-Jason-

[Jooske]

Hi V_V
for the keeping blanco in the window log after cleansing i have it too, while it comes back after several instances of data activity, some GUI refresh, etc. Not with you?
I look at another program and back to PE and there it is again.
If it doesn't come back, does toggling off and on the windows logging and log file help to get it back?
In the worst case stopping and restarting PE ?
Really need a reboot?

[Sticky_Cheeseman]

Hello,

why not upgrade (possibly for free) your version of Goback to the latest namely 3.21.106. and see of that solves your problem.

I'm using Goback on a multi-boot system using Win 98 Sec Edition & Win XP Prof. without any problem with system restore disabled and running Port Explorer, TDS & Wormguard under both OS.

Goback has far more functionality compared to system restore and saved me more than once with success every time.

Kind regards,

PeterV

[Vietnam Vet]

Jason and Jooske,

Been experimenting with the log clearing feature. When I had the problem, it was set on no limit. Normally keep it on Limit to 1000 items. As near as I can tell it works without a problem that way.

Just changed it back to no limit, worked properly that time. Relatively low amount of logged items in this case though. Seems to relate directly to how much has been logged.

On the problem clearing, everything went blank on the window, not just the logging area. No buttons, no title, nothing. Stayed that way for about 15 minutes total. No way to toggle the log, because there is nothing left but the outline of the window. Minimize, maximize, and close buttons were visible, but did not function. Reboot was not necessary for this. Killed PE with ctrl-alt-delete, restarted PE, worked fine. Haven't had any kind of problem with it since that point and I have spent practically the entire weekend online.

I probably would not have even posted about this since I normally don't clear the log anyway, but only on the chance that there might be some relevance to the illegal operation error, I am experimenting and posting if there is some kind of hiccup.

Thanks for all advice. It is always welcome.

[Vietnam Vet]

Hello Sticky_Cheeseman,

This Gateway computer came with the Goback utility on it when I purchased it. It was called Gateway Goback by Wildfile before Roxio got in the act. I had never even heard of it before that. It works so well, that I am reluctant to change anything about it. Never a minutes problem. I like to install software. If I decide I don't like the application, I use Goback. No worries about sloppy uninstallers leaving garbage everywhere. No digging through the registry for bits and pieces. Bad install of something? Who cares? Goback should have come with a Superman cape.

If in the end, Goback is proven to be the source of my Port Explorer problem, I will pursue the option you mention. I might point out that there is no such proof as yet. Pilli mentioned it as a possibility and rightly so. I am just not anxious to try my luck with an upgrade to something that works very well. Sometimes computers seem to have unique personalities of their own. What works on one doesn't necessarily behave on another.

Didn't mean to turn this in to an advertisement. Me, a spammer!! :o I will go lie down now, so I don't get run off. :D

[Jooske]

And you thanks for posting V_V hope it gives Jason any clues.
In my case it was only the window log, not the whole thing, and it might have taken one or two minutes and/or toggling to another window or program to see it all back once looking at PE again. Are you sure all your system files are still ok?
I uninstalled a kind of BHO i had for years and since PE runs better and surfing is a much happier experience. Had forgotten how nice it can be, this board was already more speedy with the new software, but with uninstalling that little program it seems even double speed now! PE logging is much better now. As i have a slow old system i keep all logging on the lowest values and empty the socket spy frequently.

[Jooske]

Posting at the same time, no you're no spammer, this is information for others too looking for the tool.
No need to lay down unless you want to sleep anyway! Sleep well! :)

[Vietnam Vet]

Hi Jooske,

As to the system files being ok, I can only venture a guess. I think so. If someone wanted to post relevant file versions, I would check to see if they are the proper versions at least.

Only three BHO's on this system(DLExpert, Adshield, SpywareGuard).

My system is three years old(700MHz, 128mb). By today's standards, much room for improvement. Have to keep an eye on resources with the 98SE system.

[Jooske]

Each system can use improvement, and some really need, i run in trouble with the 128MB RAM at times but teaches me not to use toooo much at a time.
For required files i look in the TDS pages, Jan copied it here:
http://www.wilderssecurity.com/showthread.php?t=2906
Maybe ZA/Pro causing problems or an enhancer with logging function, never know.

[Vietnam Vet]

OK, on the system files I downloaded that zip file some time ago. One file was older and I changed it at that time.
When I get the chance, I will make sure something didn't slip an older version back in. Thanks.

[Jason_DiamondCS]

I'd always suggest putting a limit on the WINDOW log, file log doesn't matter as much. In my programming environment when debugging some things I have made a listview have around 32000 items in it, and it basically froze the whole app when it tried to clear it, now maybe if I had of waited an hour or so it might of came back but it did take a very very long time so I just closed the app and restarted.. it seems its more a problem with your CPU and MEMORY when clearing a listview, they could of designed it a lot better. The system I was on at the time was an AMD AthlonXP 1600+ so it wasn't exactly a slow system either.

Thats why you should limit the window log to a few thousand items max I think unless you have a really fast machine.

-Jason-

[Vietnam Vet]

Hi Jason,

As noted before, am trying a few experiments. Right now the window logging is disabled. Will run it for a few days that way and see what develops.

Last night, got the Illegal operation error again, but just moved the window out of the way and ignored it because I was in the middle of something. Apparently waited longer than Windows appreciated. Message window went away by itself and everything locked up. Waited for a while, no change, had to use reset button. Won't wait like that again!

[Jason_DiamondCS]

Hi V_V :) ,
is it crashing for you WHILST running the program or only on shutdown? If it isn't crashing on shutdown what things are you doing immediately before the crash, can you reproduce it?
-Jason-

[Vietnam Vet]

Hello Jason,

Never crashes when shutting Port Explorer down. As near as I can tell, there is no common theme as to what I am doing; it seems random so far. I definitely cannot reproduce the crash at will. There is nothing to give me a clue it is coming. I know I am not giving you much to go on, but I am afraid at this juncture I just don't have any additional info. I'll just keep plugging along and if I am able to spot anything that may help, you'll be the first to know. I appreciate your help, thanks again.

[Jason_DiamondCS]

V_V, a new release of Port Explorer is coming out in a few days so I'd like you to give that one a whirl :)
-Jason-

[Vietnam Vet]

OK Jason,

Will download and install new version as soon as available. Thanks.

[Vietnam Vet]

Update on this issue: Window logging has been turned off since 5/27. No problems of any kind with Port Explorer. Installed new version after uninstalling completely the 1.620 version. Turned window logging back on, leaving setting at default value.(500 items) Port Explorer crashed about 3 hours later.

This may not "prove" anything, but I strongly believe that the windows logging feature in Port Explorer has everything to do with my crashes. I will leave the logging disabled until receiving any advice on how to proceed.

[Jooske]

Hi Vietnam_Vet,
You run ZA too, like me, and do you also use VisualZone,
( www.visualizesoftware.com )
the ZA log file interpretation and if so, does it make any difference for you if you have that up or not?
Did you only use the windows log or also the file log in PE?
Does it make any difference if you clear the log file in between manually?
I run win98Se too, ZAPro, IE6.0 and i saw more the other time we have in common.
My windows log on 500 items and file log on 1 mb max.

[Vietnam Vet]

Hi Jooske,

I'm running the free version of ZA and, yes, I do run Visualzone. It was not running at any time during the session when Port Explorer crashed this last time. Can't say for sure during earlier crashes, but would guess it was running when some of them occurred.

Have only used the file logging a couple of times, briefly.

Clearing the log is something I only did when experimenting, trying to gain some insight into this situation. This may bear some more experimenting to see if it has any effect on the crash problem. The only thing I noticed with the clearing was with it on the unlimited setting, as mentioned earlier in the thread.

I don't really believe this is a Port Explorer problem, as no one else has mentioned anything about it. More likely, it is some reaction with something else I have installed, or, a problem with my windows installation, maybe. Unfortunately, the only time it manifests itself, the message only refers to Port Explorer causing a fault in the kernell32.dll module. Maybe Jason will have some ideas about the logging angle to this issue.

[Jason_DiamondCS]

Thanks Vietnam_Vet for trying to locate the problem. I will take a look into the window logging to see what it could be doing that might cause a crash... does it NOT crash with say file logging on and window logging off? Or have you not tried that combination.
-Jason-

[Jooske]

As win98se systems have their ways handling threads and all that there are a few interesting tests:
--have window log and file log on, on lowest values
see if you can work on normally all time.
--what happens if you leave the computer on and are not around several hours, what you notice at your return
--now do all the same with VisualZone fired up in the same situations.
Then you can do the same tests with either windows log on plus or without VZ, and another time with only the file log on with and without VZ.
A few tests you did already.

[Gavin - DiamondCS]

Download again, uninstall/reinstall the new version and it should be fixed ! ;D ;D

[Vietnam Vet]

Hello Jason, Jooske, and Gavin,

Jason,

Never tried it with file logging on and window logging off.

Jooske,

Will get back to your post in the event the newest version does not fix the problem. Will say that Port Explorer and several other apps such as TDS or Spyblocker are normally only running when connected to the net. On dialup with Never Dial a Connection set in internet options. Password is not stored for my connection to Earthlink. Do not think it is necessary for these apps to run during offline time under these circumstances so haven't done any testing this way.

Gavin,

Had already installed latest version(over the top) before coming here and reading these posts. Saw the posting about it while at DiamondCS Forum. Went back and uninstalled cleanly and reinstalled anyway, just to be on the safe side.

Everyone,

Have now reenabled windows logging and we'll see what happens. By the way, if it is ok to ask, was something found in regard to this problem, since Gavin did say it should now be fixed? Thanks again for all help and advice offered

[Jason_DiamondCS]

Hi Vietnam Vet, yes I found a problem of sorts thanks to you. When I was checking the Windows Logging code I realized it was only going to kernel32.dll to do one thing, and that was to get the filename of the process ID, so I checked that and there was a small handle leak. It only affected 9x machines because the codepath was only for 9x machines, it seems after a few hours it would run out of handles then crash. It has been fixed now. :)
-Jason-

[Vietnam Vet]

OK thanks Jason for the additional info. Really appreciate the hard work and perserverance working out all the details. Can't be too easy when the vast majority seems to have no problems, and only a few computers(or maybe just one in this case) refuses to behave. Hats off to you and everyone involved. :D

[Vietnam Vet]

Just one last follow-up to anyone interested. Although it has been only a short time with the new version, Port Explorer is working fine, with the added bonus of a speed increase when clearing the logs or shutting down the app. Before when shutting Port Explorer down with a large amount of items logged, it took a noticeable amount of time, during which it wasn't possible to access anything else. Now the shutdown is just a few seconds. Great job, Team DCS. :)

[Jason_DiamondCS]

Thanks glad it is working fine for you now. I think it is running better on Jooske's 98 machine also now. :)

-Jason-

[Jooske]

Yes i was several times long time not around the computer, with VisualZone out or running, window log always up and file logging always on the lowest value, collecting lots of emails at a time and even deleting spam mails (the kind with the many call home signals) with the preview open, and i don't get clogged up after a few hours.
Normally after such long times not being around and activating all at a time all of a sudden seem to have been the circumstances causing the most problems on my system.
I still think to see many lines in the log per connection, which i don't remember to have been that many per connection before this 1.680 series.
Try a page refresh in one of the forums, the main site and see the many lines added at a time.
Of course our poor win98se systems have a hard time to keep up with actually doing it and logging it all at the time ! :)
It's nice to see how data is crawling with send / receive packets via FW / PE / IE or OE or VZ / on and back via those, with the country resolving the VZ / PE travel a few times extra.
Tracing them (colored) to see which is which a few moments could be nice, but we do with the socketspy already a lot!
I do remember to clean that capture.bin a lot as it really can grow fast!
I now don't have to reboot every few hours anymore.
I see a system uptime of almost 20 hours this moment, which was 7 at most in the former situation.
In fact my experience since the earlier versions of PE was win98se works faster in releasing dead sockets and recalling space with PE installed and up then without PE installed at all.
I thought i work with it several days to see the results and i have a normal working system back it seems.
Thanks Jason!

[Jason_DiamondCS]

Glad to hear it Jooske! 8)
Now go try the new beta :)

-Jason-

[Jooske]

Yep, and the new color scheme pack, ahh eye candy 8)