Heap error exiting xplorer2_lite

litefoot · Post by **litefoot** » 2006 Apr 30, 19:06

Hi nikos.

On Jan 12, 2006 I posted "Strange behavior on xplorer2 exit.". At the time I had very little to give you that might help. But since then I have finally found out how to reproduce the problem almost at will. At least on my computers.

I use Windows XP SP2 on two computers with PGP V 8 on one and PGP V 8.1 (just updated) on the other.

1. Select two or more PGP encrypted files then click "Decrypt & Verify" in the context menu.
2. After the files are decrypted exit xplorer2_lite.

The following log window examples were obtained while profiling xplorer2_lite using Dependency Walker.

Immediately after exiting xplorer2_lite:

Example 1.
Heap corruption detected at 001C0EA0
HEAP[XPLORER2.EXE]: HEAP: Free Heap block 1c0e98 modified at 1c0eac after it was freed
Entry point reached. All implicit modules have been loaded.

Example 2.
HEAP[XPLORER2.EXE]: HEAP: Free Heap block 12a0258 modified at 12a03f8 after it was freed
Entry point reached. All implicit modules have been loaded.
HEAP[XPLORER2.EXE]: HEAP: Free Heap block 12a01e8 modified at 12a03f8 after it was freed

Example 3. From another XP computer.

HEAP[XPLORER2.EXE]: Invalid Address specified to RtlSizeHeap( 00150000, 0032004E )
Entrypoint reached. All implicit modules have been loaded.
HEAP[XPLORER2.EXE]: Invalid Address specified to RtlFreeHeap( 00150000, 0032004E )
HEAP[XPLORER2.EXE]: Invalid Address specified to RtlSizeHeap( 00150000, 0045002A )
HEAP[XPLORER2.EXE]: Invalid Address specified to RtlFreeHeap( 00150000, 0045002A )
HEAP[XPLORER2.EXE]: Invalid Address specified to RtlSizeHeap( 00150000, 00450054 )
HEAP[XPLORER2.EXE]: Invalid Address specified to RtlFreeHeap( 00150000, 00450054 )

DrWatson points to ntdll.dll with the following excerpt.
FAULT ->ntdll!KiFastSystemCallRet

After researching ntdll.dll I could find nothing. No other program (including other file management tools) causes this error. It happens on both computers. I have scanned both computers with AVG updated with the latest signature files. I have scanned both computers with two spyware detection programs also updated.

The only time this error shows up is when I exit xplorer2 under certain conditions.

It may be me or something I haven't thought of yet but it now looks like xplorer2 could have a problem freeing and then still trying to use heap during cleanup for exiting.

xplorer2 is still my favorite file management program error or no error.

I would be very happy to run any other tests that you think might help.

Thanks again.

Bob

Post by **nikos** » 2006 Apr 30, 20:55

so you mean by doing the exact same operations in x2 and another file manager, only x2 crashes on exit?

litefoot · Post by **litefoot** » 2006 May 01, 00:06

Hi again.

I have used several other file managers in addition to windows explorer. I still use 2xExplorer sometimes. xplorer2 is the only one which does what I described. It works great, sometimes for long periods doing lots of good things. Most of the time when I exit the program it exits normally. But sometimes it produces the same symptoms and error message.

What I tried to describe is the one and only set of circumstances that can dependably reproduce the error message. It doesn't happen every single time but more than half of the time I try it.

BTW. I did look into SubSeven:Backdoor since my research pointed to its possibity but I could find no trace of it either with the appropriate scanners or manually searching for it in the file system and registry. None of the usual files or reg entries were there. It still puzzles me as to why this doesn't show up anywhere else.

I don't know if any of this helps but I would be happy to provide other info or run any particular test that you think needed.

Once again. Thanks for a very good program and responding to these posts.

Bob

litefoot · Post by **litefoot** » 2006 May 13, 23:47

I think I finally found the problem and am posting this for the benefit of other xplorer2_lite users who might run into it.

The problem only occurs when another program, HashOnClick, is integrated into the shell context menu. After I uninstalling HashOnClick on both computers I have been unable to reproduce the error.

Haven't tried this with another program, DeleteOnClick, from the same auther so I don't know if the combo would result in the same error or not.

Just for a check I installed xplorer2_PRO trial version before I uninstalled HashOnClick and was unable to reproduce the error at all. It seems that it only occurs with xplorer2_lite. At least on my two XP computers.

Hope this info is helpful to other users.

Good luck.

Bob