App Error in IE when using Sharepoint

[Guest]

Am trying to deploy Windows Sharepoint Services in my small company.

Most of us are getting a App error at 0x7470b439 in Internet Explorer when
we try to add an Announcement or Task in any of the Sharepoint sites.

When I look at the error info it shows Mod Ver 0.0.0.0 and Offset 00000010

I do not get this error when I run IE at a server conosole or when I use
Netscape instead of IE to access the Sharepoint site! and some workstations
do not get it either, though I am not clear what the difference between them
and the rest of us are.

We are all using Windows XP pro SP2 with IE 6 with SP1 and all updates.

I saw in another posting about using the Process Explorer to see what might
be using the address above. Is there a way to do a search in that utility or
do I have to go one by one through every process to see what is loaded in
each location? Kinda new to this utility. Any ideas? Thanks for the help

 

[Guest]

I have done more checking and found the folowing.
1. App error says "error writing to that memory location" 0x7470b439
2. App error occurs even when running XP in Safe mode with networking though
address of error changes to 0x021bb439
3. Saw other posting about Sharepoint and the MSN search addin. Checked my
IE install and it does NOT have this addin. Also tried disabling any addins
that where loaded in IE and the error still occurs.

Please help, thanks

 

[Robert Aldwinckle]

Am trying to deploy Windows Sharepoint Services in my small company.

Most of us are getting a App error at 0x7470b439 in Internet Explorer when
we try to add an Announcement or Task in any of the Sharepoint sites.

When I look at the error info it shows Mod Ver 0.0.0.0 and Offset 00000010

That undefined version is a pretty good clue that the crashing module
is not one from Microsoft.

I do not get this error when I run IE at a server conosole or when I use
Netscape instead of IE to access the Sharepoint site! and some workstations
do not get it either, though I am not clear what the difference between them
and the rest of us are.

We are all using Windows XP pro SP2 with IE 6 with SP1 and all updates.

I saw in another posting about using the Process Explorer to see what might
be using the address above. Is there a way to do a search in that utility or
do I have to go one by one through every process to see what is loaded in
each location? Kinda new to this utility. Any ideas? Thanks for the help

Turn on lower pane view by .dll (e.g. press Ctrl-d)
Make sure that that view includes Base Address.
(E.g. use Select Columns... on the DLL tab to check that option)
Then sort by Base Address. (E.g. click on that column header
and observe the triangle to indicate that it is the primary sort field.)

Then scroll down looking for something which either starts at
0x74700000 or contains that address between its base address
and its size. (E.g. more generally, take your crash address,
replace the low half with zeros and look for that.)

BTW an alternative way to obtain the same information
without Process Explorer would be to deliberately crash
IE with a breakpoint dump. E.g. use Task Manager
or tasklist (in a cmd window) to find the PID of the task
you want a dump of and then Run... (e.g. press Win-R and enter

drwtsn32 -p <PID>

(where <PID> represents the decimal number you find
using Task Manager or tasklist.)

Then you just inspect drwtsn32.log looking for the
crash's module map and do a similar check for load
point.

Post back if you need more details about this
alternative procedure because I admit I have only
sketched it out and have left a lot of assumptions


Good luck

Robert Aldwinckle
---

 

[Guest]

Robert Thanks so much for your responce.

I have tried both of your suggested methods and both seem to point to
msimtf.dll

On both the drwtsn32.log and Process explorer it loads from
(00000000746f0000 - 000000007471a000: C:\WINDOWS\system32\msimtf.dll
Since the error reports x7470b439 it seems to be in that range. Since this
IS a OS file. What to you suggest I do? Would this DLL be corrupt and on some
many computers?

Rob Scalise

--------

 

[Robert Aldwinckle]

Robert Thanks so much for your responce.

I have tried both of your suggested methods and both seem to point to
msimtf.dll

On both the drwtsn32.log and Process explorer it loads from
(00000000746f0000 - 000000007471a000: C:\WINDOWS\system32\msimtf.dll
Since the error reports x7470b439 it seems to be in that range. Since this
IS a OS file. What to you suggest I do? Would this DLL be corrupt and on some
many computers?

Hmm... never heard of this one. But TechNet has a few hits for it
and the DLL Help Database has some info.

Serendipity: that tool's functionality seems to have been greatly improved
since I last looked at it. However, it still isn't showing real up-to-date
version information. E.g. mine isn't listed there 5.1.2600.2180

For example, picking the closest version and clicking details gives

http://support.microsoft.com/dllhelp/?fid=68203&l=55&det=1

Notice that the preferred base address is consistent with
where you found it loaded.

BTW DependencyWalker shows the same address for the version
that I have.

Also notice from the list of Exported Functions
that the module is a COM module so you could try
either unregistering it or re-registering it.

In fact, just unregistering it seems to be advised as a workaround
in some instances: (specific title is irrelevant to example.)

<title>KB823664 - Problem Error Message When You...

(TechNet search for
msimtf
)


Another possibility is that the crashing module is a victim of its caller
or another module in its call stack. In order to check that out you would
extract the Stack Back Trace for the crashing task from your drwtsn32.log.
The crashing task is indicated (in an English version of Dr Watson)
by the prefix FAULT -> on the crash address. Scroll to the next section
to see the Stack Back Trace.


I still think that that version that you are reporting is suspect though.
Perhaps you have a Trojan version of that module?

http://file.net/process/msimtf.dll.html

(MSN search for
msimtf Trojan
)


Does it verify with sigverif? If it is from a Trojan I think you should
seek help to have the whole malware package removed properly;
otherwise I suppose a corrupt version could be replaced by sfc /scannow

<title>KB310747 - Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)</title>


HTH

Robert
---

 

[Guest]

Robert,

Thanks again for all your assistance and suggestions. I have checked into
every one of them and unfortunately nothing has stopped this problem from
occuring. Unless you have any other thoughts, I guess it's time for me to pay
for a MS tech support call to have it escalated.

 

[Robert Aldwinckle]

Robert,

Thanks again for all your assistance and suggestions. I have checked into
every one of them and unfortunately nothing has stopped this problem from
occuring. Unless you have any other thoughts, I guess it's time for me to pay
for a MS tech support call to have it escalated.

You're not giving us much feedback.
Most of my suggestions were ways to gather more information.

Have you figured out why you were seeing a discrepancy with the
version of that module? What changed when you tried unregistering
the module? What did the Stack Back Trace show? Etc.


Robert
---

 

[Guest]

Robert,

Sorry for the lack of detail. Here goes as far as I understand.

Have you figured out why you were seeing a discrepancy with the version of
that module? I have verified that the version number 5.1.2600.2180 is infact
the version with XP pro SP2 the link you sent me was to version 5.1.2600.1106
which is for Windows XP Service Pack 1.

What changed when you tried unregistering the module? - no change.

What did the Stack Back Trace show? -See Below
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\mshtml.dll -
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\jscript.dll -
ChildEBP RetAddr Args to Child
0013d6f8 7d50aa7c 0023f990 0013d784 7d562db4 0x10
0013d704 7d562db4 02444ed4 00000000 0245a870 mshtml+0x6aa7c
0013d784 7d5363ea 00000000 02466850 001cf2b8 mshtml+0xc2db4
0013d7ac 7d53a30d 00000001 00000001 001b14a0 mshtml+0x963ea
0013d804 7d609387 00000000 00000000 00000000 mshtml+0x9a30d
0013d88c 7d625562 00000005 0247f5e0 ffffffff
mshtml!CreateHTMLPropertyPage+0x25d4d
0013d8ac 7d6256eb 0247fd00 00000001 000003f6
mshtml!CreateHTMLPropertyPage+0x41f28
0013d8d0 7d5a9bde 0247fd00 ffffffff 00000000
mshtml!CreateHTMLPropertyPage+0x420b1
0013d8ec 7d64317a 000003f6 00000000 7d4b3a78 mshtml!DllGetClassObject+0x1bda0
0013d944 7d5b2162 046e5e1c 00000000 0247fd0c
mshtml!MatchExactGetIDsOfNames+0x509b
0013d960 7d573739 0247fd00 046e5e1c 7d4b3a78 mshtml!DllGetClassObject+0x24324
0013d980 7d572ec8 0247fd00 046e5e1c 02ca34d8 mshtml+0xd3739
0013d9a4 7d538123 0247fd00 02ca34d8 02465b80 mshtml+0xd2ec8
0013da24 7d537fbf 0247fd00 000003f6 7d572e42 mshtml+0x98123
0013da50 7d54632f 0247fd00 000003f6 00000409 mshtml+0x97fbf
0013da9c 7d50df99 0247fd00 7d537f9a 00000000 mshtml+0xa632f
0013daf0 75c56bfb 0247fd00 000003f6 00000409 mshtml+0x6df99
0013db28 75c631c9 02c80770 024661a0 000003f6 jscript+0x6bfb
0013db98 75c576d7 02c80770 024661a0 000003f6 jscript!DllCanUnloadNow+0x1c85
0013dbe0 75c5764d 02c80770 0013dc00 0000000c jscript+0x76d7
0013dc20 75c577bc 02c80770 0000000c 00000000 jscript+0x764d
0013de0c 75c54d34 00000000 00000000 02c7fc10 jscript+0x77bc
0013ded0 75c61512 00000000 00000005 02bf8970 jscript+0x4d34
0013df64 75c577f6 02c80770 02beff48 00000001 jscript!DllGetClassObject+0x3757
0013df90 75c62f32 02c80770 00000000 00000001 jscript+0x77f6
0013e184 75c54d34 00000000 00000000 0013e2a0 jscript!DllCanUnloadNow+0x19ee
0013e248 75c57869 00000000 00000000 02bf8a40 jscript+0x4d34
0013e2dc 75c577f6 02c80770 00000000 00000001 jscript+0x7869
0013e308 75c6206c 02c80770 00000000 00000001 jscript+0x77f6
0013e34c 75c5764d 02c80770 0013e36c 00000001 jscript!DllCanUnloadNow+0xb28
0013e38c 75c56688 02c80770 00000001 00000000 jscript+0x764d
0013e3b0 75c62f32 02c80770 00000000 00000001 jscript+0x6688
0013e5a4 75c54d34 0013e690 75c51b40 0013e690 jscript!DllCanUnloadNow+0x19ee
0013e668 75c5655f 0013e690 00000000 00000000 jscript+0x4d34
0013e6e0 75c5cf2c 02c51128 0013e888 00000000 jscript+0x655f
0013e730 75c5eeb4 0013e888 0013e868 00000000 jscript+0xcf2c
0013e790 75c5ed06 02431104 024a27e4 00000000 jscript!DllGetClassObject+0x10f9
0013e7bc 7d5410d9 02c7d5bc 02431104 024a27e4 jscript!DllGetClassObject+0xf4b
0013e818 7d541393 00000000 02462a20 00000000 mshtml+0xa10d9
0013e8d0 7d541207 00000000 00000000 00000000 mshtml+0xa1393
0013e908 7d53ffa9 024a2aa0 00075adc 00000000 mshtml+0xa1207
00000000 00000000 00000000 00000000 00000000 mshtml+0x9ffa9

When I used Sfc.exe to check the system files with a current SP2 CD. Nothing
was reported.

I downloaed the Security Task Manager as recomended on MSN search for
inspection of "msimtf Trojan" and it found no malware, trojans, spyware or
improper verions. It found nothing at all about this dll.

That's all I have, hope it helps, Thanks again,
Rob

 

[Guest]

Robert

By accident to we found the cause of this issue. Are you ready?

Content advisor!

Being new to this company I was not aware they where using it and it was not
even on my redar. The company uses a central proxy with content filtering so
why use Content Advisor? Not only did it solve this issue but other
unresolved issues concerning IE. The guys in helpdesk today are calling me a
hero....

The question still remains, why would Content Advisor cause IE to crash
instead of displaying some sort of warning dialog?

Though it is too soon to call it for sure, my testing for the last hour
seems to indicate that this issue for us is solved and we can get on with
using Sharepoint.

Thank you so much for your patience and assistance,
Robert Scalise
LAN Admin
Florida Irrigation

--
Rob Scalise

Robert,

Sorry for the lack of detail. Here goes as far as I understand.

Have you figured out why you were seeing a discrepancy with the version of
that module? I have verified that the version number 5.1.2600.2180 is infact
the version with XP pro SP2 the link you sent me was to version 5.1.2600.1106
which is for Windows XP Service Pack 1.

What changed when you tried unregistering the module? - no change.

What did the Stack Back Trace show? -See Below
*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\mshtml.dll -
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\jscript.dll -
ChildEBP RetAddr Args to Child
0013d6f8 7d50aa7c 0023f990 0013d784 7d562db4 0x10
0013d704 7d562db4 02444ed4 00000000 0245a870 mshtml+0x6aa7c
0013d784 7d5363ea 00000000 02466850 001cf2b8 mshtml+0xc2db4
0013d7ac 7d53a30d 00000001 00000001 001b14a0 mshtml+0x963ea
0013d804 7d609387 00000000 00000000 00000000 mshtml+0x9a30d
0013d88c 7d625562 00000005 0247f5e0 ffffffff
mshtml!CreateHTMLPropertyPage+0x25d4d
0013d8ac 7d6256eb 0247fd00 00000001 000003f6
mshtml!CreateHTMLPropertyPage+0x41f28
0013d8d0 7d5a9bde 0247fd00 ffffffff 00000000
mshtml!CreateHTMLPropertyPage+0x420b1
0013d8ec 7d64317a 000003f6 00000000 7d4b3a78 mshtml!DllGetClassObject+0x1bda0
0013d944 7d5b2162 046e5e1c 00000000 0247fd0c
mshtml!MatchExactGetIDsOfNames+0x509b
0013d960 7d573739 0247fd00 046e5e1c 7d4b3a78 mshtml!DllGetClassObject+0x24324
0013d980 7d572ec8 0247fd00 046e5e1c 02ca34d8 mshtml+0xd3739
0013d9a4 7d538123 0247fd00 02ca34d8 02465b80 mshtml+0xd2ec8
0013da24 7d537fbf 0247fd00 000003f6 7d572e42 mshtml+0x98123
0013da50 7d54632f 0247fd00 000003f6 00000409 mshtml+0x97fbf
0013da9c 7d50df99 0247fd00 7d537f9a 00000000 mshtml+0xa632f
0013daf0 75c56bfb 0247fd00 000003f6 00000409 mshtml+0x6df99
0013db28 75c631c9 02c80770 024661a0 000003f6 jscript+0x6bfb
0013db98 75c576d7 02c80770 024661a0 000003f6 jscript!DllCanUnloadNow+0x1c85
0013dbe0 75c5764d 02c80770 0013dc00 0000000c jscript+0x76d7
0013dc20 75c577bc 02c80770 0000000c 00000000 jscript+0x764d
0013de0c 75c54d34 00000000 00000000 02c7fc10 jscript+0x77bc
0013ded0 75c61512 00000000 00000005 02bf8970 jscript+0x4d34
0013df64 75c577f6 02c80770 02beff48 00000001 jscript!DllGetClassObject+0x3757
0013df90 75c62f32 02c80770 00000000 00000001 jscript+0x77f6
0013e184 75c54d34 00000000 00000000 0013e2a0 jscript!DllCanUnloadNow+0x19ee
0013e248 75c57869 00000000 00000000 02bf8a40 jscript+0x4d34
0013e2dc 75c577f6 02c80770 00000000 00000001 jscript+0x7869
0013e308 75c6206c 02c80770 00000000 00000001 jscript+0x77f6
0013e34c 75c5764d 02c80770 0013e36c 00000001 jscript!DllCanUnloadNow+0xb28
0013e38c 75c56688 02c80770 00000001 00000000 jscript+0x764d
0013e3b0 75c62f32 02c80770 00000000 00000001 jscript+0x6688
0013e5a4 75c54d34 0013e690 75c51b40 0013e690 jscript!DllCanUnloadNow+0x19ee
0013e668 75c5655f 0013e690 00000000 00000000 jscript+0x4d34
0013e6e0 75c5cf2c 02c51128 0013e888 00000000 jscript+0x655f
0013e730 75c5eeb4 0013e888 0013e868 00000000 jscript+0xcf2c
0013e790 75c5ed06 02431104 024a27e4 00000000 jscript!DllGetClassObject+0x10f9
0013e7bc 7d5410d9 02c7d5bc 02431104 024a27e4 jscript!DllGetClassObject+0xf4b
0013e818 7d541393 00000000 02462a20 00000000 mshtml+0xa10d9
0013e8d0 7d541207 00000000 00000000 00000000 mshtml+0xa1393
0013e908 7d53ffa9 024a2aa0 00075adc 00000000 mshtml+0xa1207
00000000 00000000 00000000 00000000 00000000 mshtml+0x9ffa9

When I used Sfc.exe to check the system files with a current SP2 CD. Nothing
was reported.

I downloaed the Security Task Manager as recomended on MSN search for
inspection of "msimtf Trojan" and it found no malware, trojans, spyware or
improper verions. It found nothing at all about this dll.

That's all I have, hope it helps, Thanks again,
Rob

 

[Robert Aldwinckle]

Robert,

Sorry for the lack of detail. Here goes as far as I understand.

Have you figured out why you were seeing a discrepancy with the version of
that module? I have verified that the version number 5.1.2600.2180 is infact
the version with XP pro SP2 the link you sent me was to version 5.1.2600.1106
which is for Windows XP Service Pack 1.

That's what I meant about the DLL Help Database not being up-to-date. ; )

What changed when you tried unregistering the module? - no change.

Are you sure? <eg> There is no sign of msimtf.dll in the appended SBT.
In fact nothing referring to an address anywhere even in the 0x74xxxxxx range.
Perhaps you found the wrong dump or didn't look for the FAULT -> line?
OR <EG> perhaps your symptom has changed?

However, one clue you might take from this serendipitously,
assuming it was from the right dump but the wrong thread
(or that it is the right SBT but your symptom has changed)
is that scripting was involved. E.g. note references to jscript.dll
In that case you might try treating your symptom as a scripting
problem.

BTW is there anything particular that you are doing to cause this
symptom? If it's reproducible others could try it and see if they
get the same results. Etc.


HTH

Robert
---

 

[Guest]

Robert

By accident to we found the cause of this issue. Are you ready?

Content advisor!

Being new to this company I was not aware they where using it and it was not
even on my redar. The company uses a central proxy with content filtering
product via ISA so why use Content Advisor? Not only did it solve this issue
but other
unresolved issues concerning IE. The guys in helpdesk today are calling me a
hero....

The question still remains, why would Content Advisor cause IE to crash
instead of displaying some sort of warning dialog?

Though it is too soon to call it for sure, my testing for the last hour
seems to indicate that this issue for us is solved and we can get on with
using Sharepoint.

Thank you so much for your patience and assistance,
Robert Scalise
LAN Admin
Florida Irrigation

 

[Robert Aldwinckle]

Robert

By accident to we found the cause of this issue. Are you ready?

Content advisor!

Good clue! There was a hotfix in that area apparently:

<title>KB897166 - You receive an error message if you click a hyperlink
to open a form in Internet Explorer 6 Service Pack 1</title>

(TechNet search for
"content advisor" kbie6*
)

Different sample crash address but crash address is not related
to fix location--mshtml.dll

Perhaps you should try installing the QFE version of mshtml.dll?
E.g. see the TechNet Security Bulletin for the latest cumulative update
to Internet Explorer for details.

Being new to this company I was not aware they where using it and it was not
even on my redar. The company uses a central proxy with content filtering so
why use Content Advisor? Not only did it solve this issue but other
unresolved issues concerning IE. The guys in helpdesk today are calling me a
hero....

The question still remains, why would Content Advisor cause IE to crash
instead of displaying some sort of warning dialog?

Though it is too soon to call it for sure, my testing for the last hour
seems to indicate that this issue for us is solved and we can get on with
using Sharepoint.

Thank you so much for your patience and assistance,
Robert Scalise
LAN Admin
Florida Irrigation

You're welcome. Thanks for the feedback.


Robert
---