Lansweeper 4.0.0.11 Service crashed

[sebouh]

After running the LS 4.0.0.11 service for a little over 2 weeks straight the service crashed a little while ago. The errorlog.txt file has the following message:

3/29/2010 3:00:13 PM: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

The Windows Application event log shows the following:

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000
Date: 3/29/2010
Time: 3:00:39 PM
User: N/A
Computer: DEV-ETN-WEB-03
Description:
Faulting application lansweeperservice.exe, version 4.0.0.11, stamp 4b99f67b, faulting module msvcr80.dll, version 8.0.50727.3053, stamp 4889d619, debug? 0, fault address 0x000150d8.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 6c 00 61 00 6e 00 .l.a.n.
0030: 73 00 77 00 65 00 65 00 s.w.e.e.
0038: 70 00 65 00 72 00 73 00 p.e.r.s.
0040: 65 00 72 00 76 00 69 00 e.r.v.i.
0048: 63 00 65 00 2e 00 65 00 c.e...e.
0050: 78 00 65 00 20 00 34 00 x.e. .4.
0058: 2e 00 30 00 2e 00 30 00 ..0...0.
0060: 2e 00 31 00 31 00 20 00 ..1.1. .
0068: 34 00 62 00 39 00 39 00 4.b.9.9.
0070: 66 00 36 00 37 00 62 00 f.6.7.b.
0078: 20 00 69 00 6e 00 20 00 .i.n. .
0080: 6d 00 73 00 76 00 63 00 m.s.v.c.
0088: 72 00 38 00 30 00 2e 00 r.8.0...
0090: 64 00 6c 00 6c 00 20 00 d.l.l. .
0098: 38 00 2e 00 30 00 2e 00 8...0...
00a0: 35 00 30 00 37 00 32 00 5.0.7.2.
00a8: 37 00 2e 00 33 00 30 00 7...3.0.
00b0: 35 00 33 00 20 00 34 00 5.3. .4.
00b8: 38 00 38 00 39 00 64 00 8.8.9.d.
00c0: 36 00 31 00 39 00 20 00 6.1.9. .
00c8: 66 00 44 00 65 00 62 00 f.D.e.b.
00d0: 75 00 67 00 20 00 30 00 u.g. .0.
00d8: 20 00 61 00 74 00 20 00 .a.t. .
00e0: 6f 00 66 00 66 00 73 00 o.f.f.s.
00e8: 65 00 74 00 20 00 30 00 e.t. .0.
00f0: 30 00 30 00 31 00 35 00 0.0.1.5.
00f8: 30 00 64 00 38 00 0d 00 0.d.8...
0100: 0a 00 ..

Full error log attached.

[Hemoco]

Fixed in latest beta (12 April), please test.

[Hemoco]

@justin: which OS/SP/32-64 are you running?

[Justin1]

I had the same thing happen. Like you suggested above, it looked like it happend during an IP scan.

I also have my Lansweeper running in a VM using ESXi v4.


Lansweeper Log

3/30/2010 12:11:44 AM: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

System Information

Host Name: XXX
OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition
OS Version: 5.2.3790 Service Pack 2 Build 3790
OS Manufacturer: Microsoft Corporation
OS Configuration: Member Server
OS Build Type: Uniprocessor Free
Registered Owner: xxx
Registered Organization: xxx
Product ID: xxx
Original Install Date: 1/9/2009, 4:10:01 PM
System Up Time: 17 Days, 18 Hours, 23 Minutes, 27 Seconds
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~2667 Mhz
BIOS Version: INTEL - 6040000
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (GMT-05:00) Eastern Time (US & Canada)
Total Physical Memory: 1,023 MB
Available Physical Memory: 426 MB
Page File: Max Size: 1,318 MB
Page File: Available: 759 MB
Page File: In Use: 559 MB
Page File Location(s): C:\pagefile.sys
Domain: xxx
Logon Server: \\xxx

Event Viewer: System

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 3/30/2010
Time: 12:12:43 AM
User: N/A
Computer: xxx
Description:
The Lansweeper Server service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Viewer: Application

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000
Date: 3/30/2010
Time: 12:12:08 AM
User: N/A
Computer: xxx
Description:
Faulting application lansweeperservice.exe, version 4.0.0.11, stamp 4b99f67b, faulting module msvcr80.dll, version 8.0.50727.3053, stamp 4889d619, debug? 0, fault address 0x000150d8.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 6c 00 61 00 6e 00 .l.a.n.
0030: 73 00 77 00 65 00 65 00 s.w.e.e.
0038: 70 00 65 00 72 00 73 00 p.e.r.s.
0040: 65 00 72 00 76 00 69 00 e.r.v.i.
0048: 63 00 65 00 2e 00 65 00 c.e...e.
0050: 78 00 65 00 20 00 34 00 x.e. .4.
0058: 2e 00 30 00 2e 00 30 00 ..0...0.
0060: 2e 00 31 00 31 00 20 00 ..1.1. .
0068: 34 00 62 00 39 00 39 00 4.b.9.9.
0070: 66 00 36 00 37 00 62 00 f.6.7.b.
0078: 20 00 69 00 6e 00 20 00 .i.n. .
0080: 6d 00 73 00 76 00 63 00 m.s.v.c.
0088: 72 00 38 00 30 00 2e 00 r.8.0...
0090: 64 00 6c 00 6c 00 20 00 d.l.l. .
0098: 38 00 2e 00 30 00 2e 00 8...0...
00a0: 35 00 30 00 37 00 32 00 5.0.7.2.
00a8: 37 00 2e 00 33 00 30 00 7...3.0.
00b0: 35 00 33 00 20 00 34 00 5.3. .4.
00b8: 38 00 38 00 39 00 64 00 8.8.9.d.
00c0: 36 00 31 00 39 00 20 00 6.1.9. .
00c8: 66 00 44 00 65 00 62 00 f.D.e.b.
00d0: 75 00 67 00 20 00 30 00 u.g. .0.
00d8: 20 00 61 00 74 00 20 00 .a.t. .
00e0: 6f 00 66 00 66 00 73 00 o.f.f.s.
00e8: 65 00 74 00 20 00 30 00 e.t. .0.
00f0: 30 00 30 00 31 00 35 00 0.0.1.5.
00f8: 30 00 64 00 38 00 0d 00 0.d.8...
0100: 0a 00 ..

[Hemoco]

This will be a hard one to debug.

[sebouh]

Not 64-bit, but appears to be a virtual machine running under VMware.

OS Name Microsoft(R) Windows(R) Server 2003, Enterprise Edition
Version 5.2.3790 Service Pack 2 Build 3790
Other OS Description R2
OS Manufacturer Microsoft Corporation
System Name DEV-SERVER
System Manufacturer VMware, Inc.
System Model VMware Virtual Platform
System Type X86-based PC
Processor x86 Family 6 Model 15 Stepping 8 GenuineIntel ~2991 Mhz
BIOS Version/Date Phoenix Technologies LTD 6.00, 1/30/2008
SMBIOS Version 2.31
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.2.3790.3959 (srv03_sp2_rtm.070216-1710)"

[Hemoco]

Is this a 64 bit machine/windows?

[sebouh]

Windows Server 2003 SP2
.NET 2.0 SP2
.NET 3.0 SP2
.NET 3.5 SP1

This may not have occurred during IP Range Scanning but when I was running lstrigger.exe. I wrote a simple batch file (sample with IP addresses changed below) that I run every 2 hours to scan our VPN subnet for machines. We have a lot of remote users and this ensures that I captured the ones that only connect via VPN. Would repetetive calls to lstrigger.exe cause that too?

@ECHO OFF
FOR /L %%G IN (1,1,254) DO (
ECHO.Checking 192.168.1.%%G
ping -n 2 192.168.1.%%G | find /i "bytes=" >NUL
if ERRORLEVEL 0 IF NOT ERRORLEVEL 1 "C:\Program Files\Lansweeper\Actions\lstrigger.exe" dev-server.mydomain.com 192.168.1.%%G mydomain
)

Sebouh

[Hemoco]

As far as I can see this happened most likely during the IP range scanning.

What is the OS/SP of the server?
What is the SP of the installed frameworks?