.NET Application requires Local Administrator Rights

[eltonchew]

Hi,

We have an inhouse developed VB.NET Windows application which runs
successfully only when the user is given a local administrator rights.
Without which, it fails to start. There isn't anything reported on the
event viewer. Giving the user full access to C:\ drive also doesn't do
the trick. Unfortunately, we do not have the code of this application
and hence cannot view what the application is trying to access. Note
that we have both .NET 1.1 and 2.0 running on the machine but the
app.config file has been configured to point to ver. 1.1 runtime.

We need to run the application without giving user local administor
rights. Can anyone suggest what might be the cause of this problem and
approach of troubleshooting it?

Thanks in advance
ec.

 

[Marc Gravell]

Perhaps trying to access some protected area of the registry or file
system... possibly something event-log related, possibly trying to
open a port that hasn't previously been opened by an administrator

My advice: download Lutz Roeder's .NET Reflector, and look at the
code. I'd hazard a guess that it isn't obfuscated, so you should be
able to see what is going on.

Marc

 

[ECEE]

Thanks for your reply.

I took a look through the Reflector but can't seems to figure out
anything.

Does anyone know if there is there any tool out there that allows me
to monitor what resources (files/registry/ports) the main application
is trying to open/access?

As I am not a programming guru, can anyone also guide me into
performing somekind of debug print when the error is thrown?

ec.

 

[Mr. Arnold]

Thanks for your reply.

I took a look through the Reflector but can't seems to figure out
anything.

Does anyone know if there is there any tool out there that allows me
to monitor what resources (files/registry/ports) the main application
is trying to open/access?

As I am not a programming guru, can anyone also guide me into
performing somekind of debug print when the error is thrown?

http://www.microsoft.com/technet/sysinternals/default.mspx

Active Ports and CurrPort are free.

Try
code
Catch Exception ex
debug.Print(ex.Message)

end Try

 

[Paul Hadfield]

Windbg and associated programs are your friend in these cases! Whilst not a
5 second thing, it's not as scary as it first seems. There are lots of demo
and help guides out there:

http://en.wikipedia.org/wiki/WinDbg
http://www.codeproject.com/debug/windbg_part1.asp

With a few commands you can usually find if an exception is being thrown
(and hidden by code), etc.

- Paul.

 

[-pb-]

Try giving FullTrust Permision Set to Machine-"Code-
Groups"-"AllCode"-"Edit Code Group Properties" for Runtime Security
Policy using 1.1 or 2.0 configuration tool.

If this works then reduce the Permission set to one level below the
previous one till you reach the correct Permission Set which allows
you applicaiton to run. Try to reach the optimised Permission Set
setting which doesn't compromise security. Don't forget to remove the
user from Local admin before trying this out.

 

[ECEE]

Try giving FullTrust Permision Set to Machine-"Code-
Groups"-"AllCode"-"Edit Code Group Properties" for Runtime Security
Policy using 1.1 or 2.0 configuration tool.

If this works then reduce the Permission set to one level below the
previous one till you reach the correct Permission Set which allows
you applicaiton to run. Try to reach the optimised Permission Set
setting which doesn't compromise security. Don't forget to remove the
user from Local admin before trying this out.






- Show quoted text -

Thanks pb but unfortunately this doesn't work...

 

[ECEE]

Windbg and associated programs are your friend in these cases! Whilst not a
5 second thing, it's not as scary as it first seems. There are lots of demo
and help guides out there:

http://en.wikipedia.org/wiki/WinDbghttp://www.codeproject.com/debug/windbg_part1.asp

With a few commands you can usually find if an exception is being thrown
(and hidden by code), etc.

- Paul.

Paul,

I downloaded Windbg and tried out a couple of things, but couldn't
seem to be able to track the exception that has been thrown. As I am
not a programmer myself, would you be able to give me a few pointers
to start with?

Thank you so much.

 

[Paul Hadfield]

Sorry,

Sorry I can't be more help, I've not had to do this myself either - I just
saw it in a DevWeek session earlier this year - so know it is possible.
Maybe some one else in the newsgroup could be of assistance. Maybe start a
new thread asking for assistance on using WinDbg to trap a "an unexpected
silent program exit" that could occur in either managed or un-managed code.

Looking through the notes I took, as always, they mean absolutely nothing
now - and I don't have windbg, etc set up on this PC. I just know that you
can get everything you should need through windbg - you can get more info
using some of the managed extensions for that tool (SOS I think it's
called). The one helpful link I can find is a reference to this book which
the presenter recommended:

http://www.microsoft.com/mspress/books/8650.aspx

I do remember that in the demo we saw how to catch the following exception,
which would never be caught be the expected error trapping in FuncA()
because FuncB() hides it.

- Paul.

FuncA()
{
try
{
FuncB();
}
catch(Exception ex)
{
Console.WriteLine(ex.Message);
}
}

FuncB()
{
try
{
// Open some file that you don't have any access to
}
catch
{
// Don't do anything, but we've just hidden the exception from the
calling function
}
}

 

[-pb-]

Hi,

We have an inhouse developed VB.NET Windows application which runs
successfully only when the user is given a local administrator rights.
Without which, it fails to start. There isn't anything reported on the
event viewer. Giving the user full access to C:\ drive also doesn't do
the trick. Unfortunately, we do not have the code of this application
and hence cannot view what the application is trying to access. Note
that we have both .NET 1.1 and 2.0 running on the machine but the
app.config file has been configured to point to ver. 1.1 runtime.

We need to run the application without giving user local administor
rights. Can anyone suggest what might be the cause of this problem and
approach of troubleshooting it?

Thanks in advance
ec.

If you are still having the rpblem then can you pl. upload the error
message shown when the user is not a local admin.

 

[ECEE]

If you are still having the rpblem then can you pl. upload the error
message shown when the user is not a local admin.

Hi Pb, The exact message as follow:

==================================================
HEADER:
Application.exe - Common Language Runtime Debugging Services
DETAILS:
Application has generated and exception that could not be handled.
Process id=0x12d8(4824), Thread id=0x13b4(5044)

Click OK to terminate the application.
Click CANCEL to debug the application.
==================================================

Thanks you so much.

 

[-pb-]

Hi Pb, The exact message as follow:

==================================================
HEADER:
Application.exe - Common Language Runtime Debugging Services
DETAILS:
Application has generated and exception that could not be handled.
Process id=0x12d8(4824), Thread id=0x13b4(5044)

Click OK to terminate the application.
Click CANCEL to debug the application.
==================================================

Thanks you so much.

Sorry for replying late as I was kind of busy during the week end.
Anyways if you are still facing this problem then please also let me
following things to get to root cause of the problem and if you stll
want to reslove it.

Are you running 64 bit OS?
Then use this link http://www.dotnet247.com/247reference/a.aspx?u=http://support.microsoft.com/?id=283150
to register this application to use Dr Watson as a stack trace. The
run the application and it will generate the stack tract in windows
\system32 wit name drwatson or something like that. Post the content
of this file to check where exactly it is failing.

 

[ECEE]

Sorry for replying late as I was kind of busy during the week end.
Anyways if you are still facing this problem then please also let me
following things to get to root cause of the problem and if you stll
want to reslove it.

Are you running 64 bit OS?
Then use this link http://www.dotnet247.com/247reference/a.aspx?u=http://support.microsoft.com/?id=283150
to register this application to use Dr Watson as a stack trace. The
run the application and it will generate the stack tract in windows
\system32 wit name drwatson or something like that. Post the content
of this file to check where exactly it is failing.

Pb, Thanks for taking the time to work this out with me. I really
appreciate your enthusiasm.

However, I am not running a 64-bit OS. Its Windows Server 2003 SP2.
Note that I have both .NET 1.1 and 2.0 framework installed on this
machine.

Thanks again.

 

[ECEE]

Hi all,

I did a dbgview on against the application using an administrator and
non-administrator account. Seems like there's something happening with
gdiplus.dll. However, the exception was not handled during
administrative access, which is why it went through.

Can anyone please direct me towards some troubleshooting steps? Thank
you very much.

Below are the logs.

=================================================================================
Administrator Access
=================================================================================
Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search
path. *
* Use .symfix to have the debugger choose a symbol
path. *
* After setting your symbol path, use .reload to refresh symbol
locations. *
****************************************************************************
Executable search path is:
ModLoad: 11000000 11080000 OneVue.exe
ModLoad: 7c800000 7c8c0000 ntdll.dll
ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.dll
(18e0.18e4): Break instruction exception - code 80000003 (first
chance)
eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877f4
edi=00141f38
eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c81a3e1 cc int 3
0:000> g
ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 662d0000 662f8000 C:\Program Files\Citrix
\system32\mfaphook.dll
ModLoad: 679b0000 67a0d000 C:\Program Files\Citrix
\system32\CtxSbxHook.DLL
ModLoad: 65a90000 65a98000 C:\Program Files\Citrix
\system32\mmhook.dll
ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.dll
ModLoad: 651c0000 651c9000 C:\Program Files\Citrix
\system32\tzhook.dll
ModLoad: 656f0000 65709000 C:\Program Files\Citrix
\system32\scardhook.dll
ModLoad: 65200000 652e4000 C:\Program Files\Citrix
\system32\twnhook.dll
ModLoad: 67750000 67757000 C:\Program Files\Citrix
\System32\cxinjime.dll
ModLoad: 650f0000 650f7000 C:\Program Files\Citrix
\system32\wdmaudhook.dll
ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorwks.dll
ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\fusion.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77420000 77523000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll
ModLoad: 79780000 7998e000 c:\windows\microsoft.net\framework
\v1.1.4322\mscorlib.dll
ModLoad: 79990000 79cce000 c:\windows\assembly
\nativeimages1_v1.1.4322\mscorlib
\1.0.5000.0__b77a5c561934e089_80f5fe39\mscorlib.dll
ModLoad: 79510000 79523000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorsn.dll
ModLoad: 4b3c0000 4b410000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 79430000 7947d000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\MSCORJIT.DLL
ModLoad: 51a70000 51af0000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\diasymreader.dll
ModLoad: 7b610000 7b80a000 c:\windows\assembly\gac
\system.windows.forms
\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
ModLoad: 7b810000 7baf6000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.windows.forms
\1.0.5000.0__b77a5c561934e089_74d52831\system.windows.forms.dll
ModLoad: 7b0a0000 7b1d0000 c:\windows\assembly\gac\system
\1.0.5000.0__b77a5c561934e089\system.dll
ModLoad: 7b1d0000 7b3b4000 c:\windows\assembly
\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_f7fcee5f
\system.dll
ModLoad: 7b490000 7b506000 c:\windows\assembly\gac\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
ModLoad: 7b510000 7b5de000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a_9fba7b6e\system.drawing.dll
ModLoad: 7a6e0000 7a820000 c:\windows\assembly\gac\system.data
\1.0.5000.0__b77a5c561934e089\system.data.dll
ModLoad: 033b0000 03675000 C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 7bc10000 7bd60000 c:\windows\assembly\gac\system.xml
\1.0.5000.0__b77a5c561934e089\system.xml.dll
ModLoad: 7bd60000 7bf66000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.xml
\1.0.5000.0__b77a5c561934e089_2d5b5e95\system.xml.dll
ModLoad: 52b80000 52bce000 c:\windows\assembly\gac
\microsoft.visualbasic\7.0.5000.0__b03f5f7f11d50a3a
\microsoft.visualbasic.dll
ModLoad: 4dd60000 4df07000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.3790.3959_x-
ww_8251BDDE\gdiplus.dll
(18e0.18e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00600902 ebx=00000006 ecx=038d0005 edx=00600902 esi=03911fc8
edi=00000006
eip=4deac97d esp=0012dcf0 ebp=0012dd18 iopl=0 nv up ei pl nz
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.3790.3959_x-
ww_8251BDDE\gdiplus.dll -
gdiplus!GdipCloneBitmapArea+0xa5f8f:
4deac97d 8801 mov byte ptr [ecx],al ds:
0023:038d0005=??
0:000> g
ModLoad: 77530000 775c7000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_5.82.3790.3959_x-ww_78FCF8D0\comctl32.dll


=================================================================================
Non-administrator Access
=================================================================================
Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search
path. *
* Use .symfix to have the debugger choose a symbol
path. *
* After setting your symbol path, use .reload to refresh symbol
locations. *
****************************************************************************
Executable search path is:
ModLoad: 11000000 11080000 OneVue.exe
ModLoad: 7c800000 7c8c0000 ntdll.dll
ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.dll
(1404.16c0): Break instruction exception - code 80000003 (first
chance)
eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877f4
edi=00141f38
eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei pl nz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c81a3e1 cc int 3
0:000> g
ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 662d0000 662f8000 C:\Program Files\Citrix
\system32\mfaphook.dll
ModLoad: 679b0000 67a0d000 C:\Program Files\Citrix
\system32\CtxSbxHook.DLL
ModLoad: 65a90000 65a98000 C:\Program Files\Citrix
\system32\mmhook.dll
ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.dll
ModLoad: 651c0000 651c9000 C:\Program Files\Citrix
\system32\tzhook.dll
ModLoad: 656f0000 65709000 C:\Program Files\Citrix
\system32\scardhook.dll
ModLoad: 65200000 652e4000 C:\Program Files\Citrix
\system32\twnhook.dll
ModLoad: 67750000 67757000 C:\Program Files\Citrix
\System32\cxinjime.dll
ModLoad: 650f0000 650f7000 C:\Program Files\Citrix
\system32\wdmaudhook.dll
ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorwks.dll
ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\fusion.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77420000 77523000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll
ModLoad: 79780000 7998e000 c:\windows\microsoft.net\framework
\v1.1.4322\mscorlib.dll
ModLoad: 79990000 79cce000 c:\windows\assembly
\nativeimages1_v1.1.4322\mscorlib
\1.0.5000.0__b77a5c561934e089_80f5fe39\mscorlib.dll
ModLoad: 79510000 79523000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorsn.dll
ModLoad: 4b3c0000 4b410000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 79430000 7947d000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\MSCORJIT.DLL
ModLoad: 51a70000 51af0000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\diasymreader.dll
ModLoad: 7b610000 7b80a000 c:\windows\assembly\gac
\system.windows.forms
\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
ModLoad: 7b810000 7baf6000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.windows.forms
\1.0.5000.0__b77a5c561934e089_74d52831\system.windows.forms.dll
ModLoad: 7b0a0000 7b1d0000 c:\windows\assembly\gac\system
\1.0.5000.0__b77a5c561934e089\system.dll
ModLoad: 7b1d0000 7b3b4000 c:\windows\assembly
\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_f7fcee5f
\system.dll
ModLoad: 7b490000 7b506000 c:\windows\assembly\gac\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
ModLoad: 7b510000 7b5de000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a_9fba7b6e\system.drawing.dll
ModLoad: 7a6e0000 7a820000 c:\windows\assembly\gac\system.data
\1.0.5000.0__b77a5c561934e089\system.data.dll
ModLoad: 033b0000 03675000 C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 7bc10000 7bd60000 c:\windows\assembly\gac\system.xml
\1.0.5000.0__b77a5c561934e089\system.xml.dll
ModLoad: 7bd60000 7bf66000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.xml
\1.0.5000.0__b77a5c561934e089_2d5b5e95\system.xml.dll
ModLoad: 52b80000 52bce000 c:\windows\assembly\gac
\microsoft.visualbasic\7.0.5000.0__b03f5f7f11d50a3a
\microsoft.visualbasic.dll
ModLoad: 4dd60000 4df07000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.3790.3959_x-
ww_8251BDDE\gdiplus.dll
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (!!! second chance !!!)
eax=0012f4a0 ebx=00000001 ecx=0014f2b8 edx=00000000 esi=00000000
edi=00000000
eip=77e4bee7 esp=0012f49c ebp=0012f4f0 iopl=0 nv up ei pl zr
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\KERNEL32.dll -
KERNEL32!RaiseException+0x3c:
77e4bee7 5e pop esi
0:000> g
WARNING: Continuing a non-continuable exception
eax=7903dff8 ebx=00000000 ecx=7903ddf8 edx=00000001 esi=7c827c0f
edi=00000000
eip=7c8285ec esp=0012f3e8 ebp=0012f4dc iopl=0 nv up ei pl zr
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246
ntdll!KiFastSystemCallRet:
7c8285ec c3 ret
0:000> g
^ No runnable debuggees error in 'g'

 

[-pb-]

Hi all,

I did a dbgview on against the application using an administrator and
non-administrator account. Seems like there's something happening with
gdiplus.dll. However, the exception was not handled during
administrative access, which is why it went through.

Can anyone please direct me towards some troubleshooting steps? Thank
you very much.

Below are the logs.

===========================================================================­======
Administrator Access
===========================================================================­======
Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"
Symbol search path is: *** Invalid ***
***************************************************************************­*
* Symbol loading may be unreliable without a symbol search
path. *
* Use .symfix to have the debugger choose a symbol
path. *
* After setting your symbol path, use .reload to refresh symbol
locations. *
***************************************************************************­*
Executable search path is:
ModLoad: 11000000 11080000 OneVue.exe
ModLoad: 7c800000 7c8c0000 ntdll.dll
ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.dll
(18e0.18e4): Break instruction exception - code 80000003 (first
chance)
eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877f4
edi=00141f38
eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei plnz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c81a3e1 cc int 3
0:000> g
ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 662d0000 662f8000 C:\Program Files\Citrix
\system32\mfaphook.dll
ModLoad: 679b0000 67a0d000 C:\Program Files\Citrix
\system32\CtxSbxHook.DLL
ModLoad: 65a90000 65a98000 C:\Program Files\Citrix
\system32\mmhook.dll
ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.dll
ModLoad: 651c0000 651c9000 C:\Program Files\Citrix
\system32\tzhook.dll
ModLoad: 656f0000 65709000 C:\Program Files\Citrix
\system32\scardhook.dll
ModLoad: 65200000 652e4000 C:\Program Files\Citrix
\system32\twnhook.dll
ModLoad: 67750000 67757000 C:\Program Files\Citrix
\System32\cxinjime.dll
ModLoad: 650f0000 650f7000 C:\Program Files\Citrix
\system32\wdmaudhook.dll
ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorwks.dll
ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\fusion.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77420000 77523000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll
ModLoad: 79780000 7998e000 c:\windows\microsoft.net\framework
\v1.1.4322\mscorlib.dll
ModLoad: 79990000 79cce000 c:\windows\assembly
\nativeimages1_v1.1.4322\mscorlib
\1.0.5000.0__b77a5c561934e089_80f5fe39\mscorlib.dll
ModLoad: 79510000 79523000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorsn.dll
ModLoad: 4b3c0000 4b410000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 79430000 7947d000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\MSCORJIT.DLL
ModLoad: 51a70000 51af0000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\diasymreader.dll
ModLoad: 7b610000 7b80a000 c:\windows\assembly\gac
\system.windows.forms
\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
ModLoad: 7b810000 7baf6000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.windows.forms
\1.0.5000.0__b77a5c561934e089_74d52831\system.windows.forms.dll
ModLoad: 7b0a0000 7b1d0000 c:\windows\assembly\gac\system
\1.0.5000.0__b77a5c561934e089\system.dll
ModLoad: 7b1d0000 7b3b4000 c:\windows\assembly
\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_f7fcee5f
\system.dll
ModLoad: 7b490000 7b506000 c:\windows\assembly\gac\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
ModLoad: 7b510000 7b5de000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.drawing
\1.0.5000.0__b03f5f7f11d50a3a_9fba7b6e\system.drawing.dll
ModLoad: 7a6e0000 7a820000 c:\windows\assembly\gac\system.data
\1.0.5000.0__b77a5c561934e089\system.data.dll
ModLoad: 033b0000 03675000 C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 7bc10000 7bd60000 c:\windows\assembly\gac\system.xml
\1.0.5000.0__b77a5c561934e089\system.xml.dll
ModLoad: 7bd60000 7bf66000 c:\windows\assembly
\nativeimages1_v1.1.4322\system.xml
\1.0.5000.0__b77a5c561934e089_2d5b5e95\system.xml.dll
ModLoad: 52b80000 52bce000 c:\windows\assembly\gac
\microsoft.visualbasic\7.0.5000.0__b03f5f7f11d50a3a
\microsoft.visualbasic.dll
ModLoad: 4dd60000 4df07000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.3790.3959_x-
ww_8251BDDE\gdiplus.dll
(18e0.18e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00600902 ebx=00000006 ecx=038d0005 edx=00600902 esi=03911fc8
edi=00000006
eip=4deac97d esp=0012dcf0 ebp=0012dd18 iopl=0 nv up ei plnz
na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.3790.3959_x-
ww_8251BDDE\gdiplus.dll -
gdiplus!GdipCloneBitmapArea+0xa5f8f:
4deac97d 8801 mov byte ptr [ecx],al ds:
0023:038d0005=??
0:000> g
ModLoad: 77530000 775c7000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_5.82.3790.3959_x-ww_78FCF8D0\comctl32.dll

===========================================================================­======
Non-administrator Access
===========================================================================­======
Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Pentafin\OneVue\OneVue.exe"
Symbol search path is: *** Invalid ***
***************************************************************************­*
* Symbol loading may be unreliable without a symbol search
path. *
* Use .symfix to have the debugger choose a symbol
path. *
* After setting your symbol path, use .reload to refresh symbol
locations. *
***************************************************************************­*
Executable search path is:
ModLoad: 11000000 11080000 OneVue.exe
ModLoad: 7c800000 7c8c0000 ntdll.dll
ModLoad: 79000000 79045000 C:\WINDOWS\system32\mscoree.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\KERNEL32.dll
(1404.16c0): Break instruction exception - code 80000003 (first
chance)
eax=78000000 ebx=7ffd5000 ecx=00000007 edx=00000080 esi=7c8877f4
edi=00141f38
eip=7c81a3e1 esp=0012fb70 ebp=0012fcb4 iopl=0 nv up ei plnz
na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c81a3e1 cc int 3
0:000> g
ModLoad: 71c20000 71c32000 C:\WINDOWS\system32\tsappcmp.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77da0000 77df2000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 662d0000 662f8000 C:\Program Files\Citrix
\system32\mfaphook.dll
ModLoad: 679b0000 67a0d000 C:\Program Files\Citrix
\system32\CtxSbxHook.DLL
ModLoad: 65a90000 65a98000 C:\Program Files\Citrix
\system32\mmhook.dll
ModLoad: 7c340000 7c396000 C:\WINDOWS\system32\MSVCR71.dll
ModLoad: 651c0000 651c9000 C:\Program Files\Citrix
\system32\tzhook.dll
ModLoad: 656f0000 65709000 C:\Program Files\Citrix
\system32\scardhook.dll
ModLoad: 65200000 652e4000 C:\Program Files\Citrix
\system32\twnhook.dll
ModLoad: 67750000 67757000 C:\Program Files\Citrix
\System32\cxinjime.dll
ModLoad: 650f0000 650f7000 C:\Program Files\Citrix
\system32\wdmaudhook.dll
ModLoad: 791b0000 79418000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorwks.dll
ModLoad: 00950000 00995000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\fusion.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 7c8d0000 7d0ce000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77420000 77523000 C:\WINDOWS\WinSxS
\x86_Microsoft.Windows.Common-
Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll
ModLoad: 79780000 7998e000 c:\windows\microsoft.net\framework
\v1.1.4322\mscorlib.dll
ModLoad: 79990000 79cce000 c:\windows\assembly
\nativeimages1_v1.1.4322\mscorlib
\1.0.5000.0__b77a5c561934e089_80f5fe39\mscorlib.dll
ModLoad: 79510000 79523000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\mscorsn.dll
ModLoad: 4b3c0000 4b410000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 79430000 7947d000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\MSCORJIT.DLL
ModLoad: 51a70000 51af0000 C:\WINDOWS\Microsoft.NET\Framework
\v1.1.4322\diasymreader.dll
ModLoad: 7b610000 7b80a000 c:\windows\assembly\gac
\system.windows.forms ...

read more »

Looking at the log, it seems that your GDI+ library is not of the same
version of the application you are trying to run. Does this
application uses graphics if so please upgrade your GDI+ library from
the Microsoft. Secondly determine where gdi+ library is installed and
put that path in PATH envornment variable. See if this works....if not
that there very little I can do unless you got hold on the code.

 

[ECEE]

Looking at the log, it seems that your GDI+ library is not of the same
version of the application you are trying to run. Does this
application uses graphics if so please upgrade your GDI+ library from
the Microsoft. Secondly determine where gdi+ library is installed and
put that path in PATH envornment variable. See if this works....if not
that there very little I can do unless you got hold on the code.

Thanks, I will check on those.
But does anyone know what I got a:
"First chance exceptions are reported before any exception handling.
This exception may be expected and handled. "

when accessed by a local admin, while I got:
"(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (first chance)
(1404.16c0): CLR exception - code e0434f4d (!!! second chance !!!)"

Thanks.