Access Violation c0000005 with LSclient.exe

[wade3661]

We have one machine in our domain that we cannot run lsclient on. At first we thought it might be a network issue but after further investigation it looks more like a problem with the client itself. Everytime we run lsclient.exe it throws an application error. The Dr. Watson log is below:

Application exception occurred:
App: D:\rptemp\LSclient.exe (pid=3628)
When: 9/15/2005 @ 14:18:49.758
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: CHEETAH
User Name: administrator
Terminal Session Id: 2
Number of Processors: 4
Processor Type: x86 Family 15 Model 4 Stepping 1
Windows Version: 5.2
Current Build: 3790
Service Pack: 1
Current Type: Multiprocessor Free
Registered Organization: CCLA
Registered Owner: Director

*----> Task List <----*
0 System Process
4 System
896 smss.exe
992 csrss.exe
1048 winlogon.exe
1092 services.exe
1104 lsass.exe
1352 svchost.exe
1404 svchost.exe
1496 svchost.exe
1644 svchost.exe
1660 svchost.exe
344 spoolsv.exe
376 msdtc.exe
568 svchost.exe
628 sqlservr.exe
764 portmap.exe
792 qlremote.exe
976 svchost.exe
1472 beremote.exe
1604 benetns.exe
1624 pvlsvr.exe
1852 beserver.exe
960 bengine.exe
1636 svchost.exe
2520 rsmsink.exe
3248 wmiprvse.exe
3032 csrss.exe
2328 winlogon.exe
2988 rdpclip.exe
3092 Explorer.EXE
2604 PRONoMgr.exe
3048 VxTaskbarMgr.exe
2444 sqlmangr.exe
3752 BkupExec.exe
216 csrss.exe
396 winlogon.exe
3500 rdpclip.exe
1680 Explorer.EXE
2076 PRONoMgr.exe
4072 sqlmangr.exe
2248 cmd.exe
2296 ntvdm.exe
3076 drwtsn32.exe
3628 LSclient.exe
884 drwtsn32.exe

*----> Module List <----*
0000000000400000 - 000000000041e000: D:\rptemp\LSclient.exe
0000000071bf0000 - 0000000071bf8000: C:\WINDOWS\system32\WS2HELP.dll
0000000071c00000 - 0000000071c17000: C:\WINDOWS\system32\WS2_32.dll
0000000077380000 - 0000000077412000: C:\WINDOWS\system32\USER32.dll
0000000077670000 - 00000000777a4000: C:\WINDOWS\system32\ole32.dll
0000000077ba0000 - 0000000077bfa000: C:\WINDOWS\system32\msvcrt.dll
0000000077c00000 - 0000000077c48000: C:\WINDOWS\system32\GDI32.dll
0000000077c50000 - 0000000077cef000: C:\WINDOWS\system32\RPCRT4.dll
0000000077d00000 - 0000000077d8c000: C:\WINDOWS\system32\OLEAUT32.dll
0000000077e40000 - 0000000077f42000: C:\WINDOWS\system32\kernel32.dll
0000000077f50000 - 0000000077fec000: C:\WINDOWS\system32\ADVAPI32.dll
000000007c800000 - 000000007c8c0000: C:\WINDOWS\system32\ntdll.dll

*----> State Dump for Thread Id 0x4c0 <----*

eax=000110cf ebx=0041a17b ecx=00000000 edx=7c82ed54 esi=0041a1cf edi=0041b27a
eip=0041d1e0 esp=0012ff8c ebp=000110cf iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212

*** ERROR: Module load completed but symbols could not be loaded for D:\rptemp\LSclient.exe
function: LSclient
0041d1cc 7a0b jpe LSclient+0x1d1d9 (0041d1d9)
0041d1ce 0000 add [eax],al
0041d1d0 0000 add [eax],al
0041d1d2 0000 add [eax],al
0041d1d4 ffff ???
0041d1d6 ffff ???
0041d1d8 0000 add [eax],al
0041d1da 0000 add [eax],al
0041d1dc 0000 add [eax],al
0041d1de 0000 add [eax],al
FAULT ->0041d1e0 55 push ebp
0041d1e1 8bec mov ebp,esp
0041d1e3 83c4f4 add esp,0xfffffff4
0041d1e6 fc cld
0041d1e7 53 push ebx
0041d1e8 57 push edi
0041d1e9 56 push esi
0041d1ea 8b7508 mov esi,[ebp+0x8]
0041d1ed 8b7d0c mov edi,[ebp+0xc]
0041d1f0 66813e4a43 cmp word ptr [esi],0x434a
0041d1f5 0f8523010000 jne LSclient+0x1d31e (0041d31e)

*----> Stack Back Trace <----*
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012ff88 0041a195 0041a1cf 0041b27a 0041b27a LSclient+0x1d1e0
00000000 00000000 00000000 00000000 00000000 LSclient+0x1a195

*----> Raw Stack Dump <----*
000000000012ff8c 95 a1 41 00 cf a1 41 00 - 7a b2 41 00 7a b2 41 00 ..A...A.z.A.z.A.
000000000012ff9c cf a1 41 00 00 00 00 00 - 00 00 00 00 f0 ff 12 00 ..A.............
000000000012ffac c0 ff 12 00 00 50 fd 7f - 54 ed 82 7c b0 ff 12 00 .....P..T..|....
000000000012ffbc 00 00 00 00 46 02 00 00 - cd 23 e5 77 00 00 00 00 ....F....#.w....
000000000012ffcc 00 00 00 00 00 50 fd 7f - 05 00 00 c0 c8 ff 12 00 .....P..........
000000000012ffdc b8 fb 12 00 ff ff ff ff - 98 b7 e6 77 d8 23 e5 77 ...........w.#.w
000000000012ffec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 90 41 00 ..............A.
000000000012fffc 00 00 00 00 41 63 74 78 - 20 00 00 00 01 00 00 00 ....Actx .......
000000000013000c 38 4f 00 00 24 01 00 00 - 00 00 00 00 20 00 00 00 8O..$....... ...
000000000013001c 00 00 00 00 14 00 00 00 - 01 00 00 00 0a 00 00 00 ................
000000000013002c 34 00 00 00 b4 01 00 00 - 01 00 00 00 00 00 00 00 4...............
000000000013003c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000013004c 02 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000013005c 14 03 00 00 9c 01 00 00 - 00 00 00 00 5b 49 59 2d ............[IY-
000000000013006c b0 04 00 00 32 00 00 00 - e4 04 00 00 d2 02 00 00 ....2...........
000000000013007c 00 00 00 00 ba 71 32 f3 - b8 07 00 00 4a 00 00 00 .....q2.....J...
000000000013008c 04 08 00 00 f6 02 00 00 - 00 00 00 00 cd ea ce 32 ...............2
000000000013009c fc 0a 00 00 42 00 00 00 - 40 0b 00 00 08 03 00 00 ....B...@.......
00000000001300ac 00 00 00 00 79 e8 3c e2 - 48 0e 00 00 32 00 00 00 ....y.<.H...2...
00000000001300bc 7c 0e 00 00 d2 02 00 00 - 00 00 00 00 e4 02 02 83 |...............


Do you have any clue as to why this might be occuring? This is a Windows Server 2003 machine with SP1 and is also our backup server and runs Veritas Backup Exec. Any help would be great, thank you.

[Hemoco]

Control panel/system/advanced/data execution prevention

[wade3661]

I'm not sure what you are referring to. Where would I add an exception for lsclient?

[Hemoco]

The problem can be memory runtime execution prevention (or what's it called)
Can you add lsclient to the exceptions and try again.