Don't you love it when they publish internal documents? Now if they would only publish the hotfix. Jeff Pitsch -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Kenzig http://thin.net Sent: Monday, September 27, 2004 11:43 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] KB: CTX105002 - INTERNAL - Application crashes in Seamless mode inside WS2_32 dll CTX105002 - INTERNAL - Application crashes in Seamless mode inside WS2_32 dll This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX105002 Document ID: CTX105002, Created on: Sep 24, 2004, Updated: Sep 27, 2004 Products: Citrix MetaFrame XP 1.0 for Microsoft Windows 2000 Symptoms Application crash in seamless mode with the following stack trace: 0:000> kv ChildEBP RetAddr Args to Child 0012cf4c 77f8819b 75040800 7503d4ee 75040840 ntdll!RtlpWaitForCriticalSection+0x8a 0012cf54 7503d4ee 75040840 00000001 ffffffff ntdll!RtlEnterCriticalSection+0x46 0012cf70 1140731f 7c576325 00000000 00000001 WS2_32!WSACleanup+0x13 and mfaphook.dll (MF XP FR3) has the following timestamp: Timestamp: Wed May 07 02:19:12 2003 (3EB85F10) Checksum: 0000BE04 Also you may have the following exception point: 0:000> r eax=00000000 ebx=00000000 ecx=75040850 edx=000001cc esi=75040840 edi=00000000 eip=77f88216 esp=0012ceec ebp=0012cf4c iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!RtlpWaitForCriticalSection+0x8a: 77f88216 ff4010 inc dword ptr [eax+0x10] ds:0023:00000010=???????? Cause This is caused by incorrectly hooking dll loading functions and corrupting process headers. Resolution Ask the customer to apply hot fix Hotfix Name XE103W2K063 More Information To check this use the following sequence of WinDbg commands: 1. Open WinDbg 2. Verify that File\Symbol File Path... dialog contains the path to Microsoft Symbol Server srv*c:\symdownstream*http://msdl.microsoft.com/download/symbols 3. execute !analyze -v command and look for STACK_TEXT section in the output: STACK_TEXT: 0012cf4c 77f8819b 75040800 7503d4ee 75040840 ntdll!RtlpWaitForCriticalSection+0x8a 0012cf54 7503d4ee 75040840 00000001 ffffffff ntdll!RtlEnterCriticalSection+0x46 0012cf70 1140731f 7c576325 00000000 00000001 WS2_32!WSACleanup+0x13 4. execute !lmi mfaphook command to get time stamp: 0:000> !lmi mfaphook Loaded Module Info: [mfaphook] Module: mfaphook Base Address: 67b00000 Image Name: mfaphook.dll Machine Type: 332 (I386) Time Stamp: 3eb85f10 Wed May 07 02:19:12 2003 Size: 7000 ******************************************************** This Weeks Sponsor RTO Software Do you know which applications are abusing your CPU and memory? Would you like to learn? -- Free for a limited time! Get the RTO Performance Analyzer to quickly learn the applications, users, and time of day possible problems exist. http://www.rtosoft.com/enter.asp?id=320 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm ******************************************************** This Weeks Sponsor RTO Software Do you know which applications are abusing your CPU and memory? Would you like to learn? -- Free for a limited time! Get the RTO Performance Analyzer to quickly learn the applications, users, and time of day possible problems exist. http://www.rtosoft.com/enter.asp?id20 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm