Page 1 of 1

avg?

Posted: Fri Jul 20, 2007 1:15 pm
by fk0
( it is in reply to http://www.netwu.com/newspro/phpBB2/vie ... php?t=2285 )

I only have the latest three crashes (in a few hours) in the log because i created a new database and deleted the older one, after seeing the crashes i searched for different problems and found about the antivirus trouble.
if you see samething interesting for you i can email it, but not much inside:

the errors where like

UE1960R internal error (49476C/C0000005)
UE1960R internal error (5A3804/C0000005)
UE1960R internal error (49FDFA/C0000005)

so then i did same memory check and there was no errors, and i tried to make and check many big archives with no errors again but i never tried to make an archive while poking avg.
Ah, actually UE is working from three days with a very larde amount of headers and no problems while before was crashing with a minimal recreated database; i actuallu putting same cpu and disk heavy load to test the system stability while running all standard programs and i didn't noticed troubles.

Just i wonder of the fact that other programs seem to work fine was not true, just they never triggered the issue; at least while playing with the avg updater and burning a dvd i got same errors on verify-after-writing, no read errors, just same data was changed; i wasn't aware of the avg troubles that i found later because i was trying also other things but it moved my searches to filesystem and drivers and any type of possible filter installed that involved data transfer and ide drivers related..
I'm still unsure about everything, to remove and install avg without make same more test was probably an error, avg actually install many drivers at system level and i don't know what versions where installed before.

Posted: Fri Jul 20, 2007 2:45 pm
by alex
if you saw changed data while burning dvd then you probably realize something is changing process memory content.

it looks like memory corruption, the same picture i saw at least one such case in the past.

ue database is mapped into memory. if the memory content changed by some outside factor and the database is hit the database integrity is violated.

i only can verify the database when you start the program or load newsgroup (e.g. if something got corrupted on the disk it will be fixed), but memory is presumed to work properly.

if you didn't have any blue screens, it would indicate the memory probably is ok (i mean the hardware), otherwise something in the system mode would be hit at least few times causing the system crash.

so then you better install a clean system and run ue there, no problem then install other programs one by one until you'll find the culprit if you are not sure now what it is.

it doesn't appear to be allocation related, just something corrupts memory randomly, in UE it would cause rather database crashes than the process allocation heap crashes since UE is using its own memory management, so when its own custom allocations take 99+% of all allocations it is much more likely you hit the database what we can observe in your case.

with burning dvd the burning program apparently using a memory buffer, if it is large enough it will be hit exactly in the same way as the UE process memory (probably the burning program doesn't verify the integrity of data after it loaded it into memory). now the burning code itself is small and is unlikely to be hit so what you got is corrupted data after burning instead of crashes while burning, those are just probabilities, the larger the area in the memory the more likely it is to be hit. just programs keep different data, in burning they don't use the interlinked data, they are using memory only for caching.

avg it is or not i cannot tell, when you ran memory check http://www.netwu.com/newspro/MemTest.zip did you stop other programs and the amount of memory tested was close to the amount of RAM you have but smaller than that so the MemTest will still run at 100% processor usage (no thrashing)? again if you didn't have blue screens it is less likely to be a defective memory.

if you did see system blue screens in the same time you need to run memory tests more thoroughly covering most of RAM for considerable time like a couple of hours (maximal coverage just before disk thrashing starts).

when you find what it was don't forget to mention it here :)

the picture with reliability is now excellent, it was the purpose to achieve the best possible level before proceeding with major updates, much easier to see if something has been introduced.

Posted: Sat Jul 21, 2007 9:54 am
by fk0
Brief responce for now, i'm still under testing; it's simple to me recover the partition from a mirror but i'm interest more to understand what happened and prevent it...

>if you saw changed data while burning dvd then you probably realize something is changing process memory content.

you're right, i'm using Nero and it use a 80mb of ram buffer for thata while writing so the memory containing those data probably was corrupted, but from who? It's not likely any process can poke in other memory processes until hi has same extra rights like a driver....And i remember also another thing, unfortunately i understimate it before: running elp->diagnostic->integrity game me same errors but it was rare......i noticed an error now too , this is getting interesting.....

>if you didn't have any blue screens, it would indicate the memory probably is ok (i mean the hardware), otherwise something in the system mode would be hit at least few times causing the system crash.

i'm sure i havent' experienced blue screen in 2007, i don't remember in 2006 if it happen, however the system is running from more time; however if i don't reboot the system after a month weird thing happens especially on explorer shell, i suppose it's not so strange.
Corrupted downloads are a rare thing and it's impossible to tell if has samething to do with memory corruption or they cames directly from usenet path, on downloads from other tools i don't remember any sort of problem.
Just the dvd burn thing that at least hel to restrict the problem, i'll do same
tests while burning and see what happen.

>so then you better install a clean system and run ue there, no problem then install other programs one by one until you'll find the culprit if you are not sure now what it is.

i have a one year old partition mirror so i can do it easily, but i'm interest to learn what's happened and if it works now...

>with burning dvd the burning program apparently using a memory buffer, if it is large enough

it use 80mb so it make sense

>it will be hit exactly in the same way as the UE process memory[cut]

>now the burning code itself is small and is unlikely to be hit so what you got is corrupted data after burning instead of crashes while burning, those are just probabilities, the larger the area in the memory the more likely it is to be hit. just programs keep different data, in burning they don't use the interlinked data, they are using memory only for caching.

maybe also the corruption isn't directly in memory but filling it or reading it; what does c0000005 error mean?

>when you ran memory check did you stop other programs and the amount of memory tested was close to the amount of RAM you have but smaller than that so the MemTest will still run at 100% processor usage (no thrashing)? again if you didn't have blue screens it is less likely to be a defective memory.

actually i ran it for a night with a 1.4gb segment ram, before i ran a dos tool for an hour or two, standard programs where running normally during the check and ramtest took probably over 95% of cpu since the usage is usually low unless i compress data;
oh, i usually compress and expand big rars but i never experienced errors on them, maybe the corruption has a trigger.

still checking now; however i understood that samething is corrupting the memory in same way and probably the problem is still there; if the diagnostic tool of the database continue to tell me about errors in database at least i can do same try and see what happen;
i hate to install programs on this machine but i can mirror the partition before. next step now is to check on database integrity to understand if it happen often and the frequency, then when i have a picture i'll go to check on programs and drivers

Posted: Sat Jul 21, 2007 1:59 pm
by alex
C0000005 error means access violation. data in UE database are interlinked it means it contains pointers in one or another form. if something change the memory content and hit a pointer it is very likely the pointer will point to an invalid address (an address which doesn't have RAM allocated to it) which will result in this error.

with burning dvd if data to be burned is corrupted in memory it won't cause any error if it doesn't check data integrity in memory while burning process in progress, since it is just cached content, the content is not used to point other data but is rather a data just to be copied.

as to probabilites for example the burning dvd program variables take 1MB and when you burn 4GB say you get 5 data corruptions per dvd, it means the variable area is about 4000/5=800 times less likely to be hit than the buffer area, it means the dvd program itself given there are no other bugs in it may crash 1 times in 2-3 years because of the memory corruption problem.

from other side since UE database is stongly optimized - memory corruption is very likely to hit a sensitive data area (pointer directly or even flag which determines where is the pointer).

Posted: Sat Jul 21, 2007 10:10 pm
by fk0
>C0000005 [cut] and hit a pointer it is very likely the pointer will point to an invalid address [cut]

my bad, i know it well.....

>with burning dvd if data to be burned is corrupted in memory it won't cause any error [cut]

i always verify the data after writing using nero and casually a PI/PO scan with cdspeed to evaluate the writing quality; if i can't verify the written disk i do a full binary files comparison with a utility i writed myself.
what's happened is that on the verify of the disk there was a bunch of near sector that failed the comparison; i was not able to get that error again how many things i tried.
At last not knowing what lse do i put the machine o heavy load like avg scan, spybot scan and filecopy to the same disk while i was archiving with the compression and burning at 4x (everything at the same time), it took an hour to burn because of the underruns, verify went fine and the pi/po scan showed that there was no quality problem even if the writer stopped continuosly; so avg is not causing any problem but i removed and reinstalled it so not much to say about; now avg seem to work well , just i wonder what happened when he screwed.
But i remember on reading avg logs that the errors increased day by day while the time passed just like Ue increased the crash frequency; win event viewer did not help.

About the errors, they were located in the same portion of the disk, i suppose it's happened at the moment that avg tried to update his files and failed, i barely remember that avg failed to update at 1/3 of the burning and it's where the errors are located.

UE integrity check now does everything good.


EDIT: i'll simply edit a previous message because there is no priority;
After a week i have same statistics, like:
-at least one time a day i have the diagnostic that say that there are corrupted articles, i can see it also because apparently i can't delete same headers, but they just doesn't disappear before restarting UE, i had at least one crash, also a power outage (rare event here) that did nothing to UE but both Emule and uTorrent download list just disappeared??? (and mule *.met was filled of zeroes....).
Nothing much to say, the environment it's the same and i don't care too much about of those problems, however it's the time to try samething....