Access violation error
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
Access violation error - 17.Mar.2006 8:27:00 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
From time ti time, when I run a scan I get this pop-up message and the scan stops:
GFI LANguard N.S.S. 7.0
Access violation at address 08B3CF1A in module 'securityscannerui.dll'. Read of address 00000000.
Any idea?
Zoran
|
|
|
|
|
RE: Access violation error - 17.Mar.2006 8:46:17 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Now I got another one:
Access violation at address 40006BB0 in module 'rtl90.bpl'. Write of address 00000000.
|
|
|
|
|
RE: Access violation error - 20.Mar.2006 4:46:45 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Patrizia,
I forgot to mention that there was the second pop-up message saying "insufficient resources".
I checked CPU and memory and they were ok. Then I checked the disk and found it terribly fragmented.
I did run NSS several times a day lately, scanning different vlans but I did not know it has such impact on a disk. After I formatted the disk it works well again.
Can you provide info about disk usage by NSS?
Thank you for your response.
Zoran
|
|
|
|
|
RE: Access violation error - 21.Mar.2006 3:29:34 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Zoran,
To confirm, was the fragmanted disk the disk onto where LNSS is installed?
Do you have other software installed on the same disk?
Do you have any anti-virus software scanning the LNSS directories?
_____________________________
Patrizia Caruana
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: Access violation error - 21.Mar.2006 6:03:46 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Patrizia,
Yes, the disk is my system partition, 50 GB total, 32 GB free.
Yes I have OpManager-network monitoring (running), Kiwi syslog (running), SAV client (running), Windows XP SP2 firewall (running)-LNSS excluded, Windows Defender Beta 2 (running), HDDlife v 2.5.76 (running) and some other admin programs which I run when needed.
Windows XP SP2, Office 2003 SP2, everything patched up to the date.
I reinstalled NSS, but still the same.
My logs are clean.
I also solved the problem found in the System log:
Event Type: Warning
Event Source: Tcpip
Event ID: 4226
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
I sent a support request to your coleagues with the troubleshooting report, and I will let you know if they manage to help me. Their first suggeston was to exclude the GFI folder from SAV client scan. I did it, but it did not solve the problem.
|
|
|
|
|
RE: Access violation error - 21.Mar.2006 2:19:28 PM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
This time I uninstalled NSS and ReportPack, ran a registry cleaner, installed NSS on the second partition which was empty having 25 GB free space and excluded the GFI folder from SAV client scan. I ran a scan and it went well, but as it finished I got 2 pop-up errors saying:
The instruction at "0x400059d2" referenced memory at "0x1513bad0". The memory could not be "read".
Click on OK to terminate the program.
But I can open every report and also found the same problem as "speedcat" has. It is a vlan with 220 clients, all XP SP2 and patched weekly. The scan takes approximately 2+ hours. After the 150th client I saw some info is missing, like the 'voulnerabilities' part is not complete.
Is it advisable to reduce each scan to 50-100 nodes?
|
|
|
|
|
RE: Access violation error - 22.Mar.2006 4:34:55 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Zoran,
Please enable debug and generate troubleshooter files as explained in: http://forums.gfi.com/Read_this_first/m_900727087/tm.htm. Send the files over to forums@gfi.com for further analysis.
_____________________________
Patrizia Caruana
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: Access violation error - 22.Mar.2006 5:05:16 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Hi Patrizia,
I sent the troubleshooter files to support@gfi.com (Jean-Paul Degaetano) on Monday (20 March 2006).
Do you want me to send it to forums@gfi.com too?
I shut down windows firewal this morning, ran a scan and it went well with no errors. I set it to scan only one range of 255 addresses finding 146 coputers and it took 1 hour and 35 minutes. The info for all listed clients is complete.
I will move NSS to a real server box with Windows 2003 server on it and I hope it will be ok.
I would appreciate if you investigate these problems further and let us know what is going on.
This is a record from my security log generated during the NSS scan when Windows firewall was on:
(port number is different in each record)
Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date: 3/22/2006
Time: 10:33:03 AM
User: NT AUTHORITY\SYSTEM
Computer: REG-ADMINWS02
Description:
The Windows Firewall has detected an application listening for incoming traffic.
Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 1156
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 2113
Allowed: No
User notified: No
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Do I need to switch it off during scanning, or it is ok just to create an exception for lnss.exe?
Thank you.
Zoran
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
