Interesting. I have two new things to report. When BoC was crashed (with 0x20202020) by VLC playing the same files as in Miro this led to a very interesting effect when I shutdown the system a few hours later:
Windows complained about that an app is not responding and has its countdown and the "kill now" button. That function that crashed was named nsAppShellEventWindow which seems to belong to NSClean's BOClean :-)
The second thing is: After I shuffeled around data on my harddisks, Miro was unable to find the location where its videos were and defaulted to a (nonexistant, because my Win is German) "My Documents/My Videos" path. But BoC did not crash!! This leads to the conclusion that Kevin was on the right track to follow with difficult filename handling.
HTH
weaker
Hey guys! Apologies for being sidetracked ... got handed a "critical mission" by Melih and had to put this aside whilst doing some other things, including an official "hajj" to New Jersey earlier this week. Heh. Bottom line though is YOUR probloem got solved in code last week, but have been too busy to "come out and play" this week.
Glad to see that you had the opportunity to see that it isn't BOClean once WE were out of the way! And for anyone who cares, the "nsAppShellEventWindow" thingy is actually MIRO's doing. The lower-case "ns" function names actually were a universal naming convention of "NetScape" from which that function derives. When "NSClean" was originally born back in 1995, the "NS" also meant "NetScape" since we were the very first "Privacy Software (Corp)" which dealt with cleaning up the original Netscape and elminating traces of "internet records" ... but that's where the "NS" angle ends. This is the MIRO program's "main window" which receives "PostMessage()" results from the underlying player once it's talked to the kernel ... I saw that crash often myself in the research into this "WTF?" Heh.
But that was MIRO being broken, and unable to take itself down completely, leaving that as one of MANY "hung DLL's" when Miro bites the bag. LOTS of old Netscape code in MIRO! This is one of the problems with "open source" in that someone else posts BAD code in hopes that someone ELSE can fix it, people download it, write their own code around it and never FIX it. I'll just leave the reality there since it's not germaine to what happened here.
The REAL problem which caused the BOClean "whoopsie" on Miro is that MIRO ran the system completely out of memory! When THIS happens, Windows will try to find all the memory it can, based upon what the kernel's internal tables *think* are not allocated anymore ... "garbage collection" was what it was called in the "old days." But WHAT IF the tables have been turned to garbage themselves as a result of "shooting buckshot" in memory by a badly programmed program? If WINDOWS was told the memory was freed, then it WAS ... only problem is that the way MIRO is working, it was trashing memory in the kernel itself!
BOClean uses PSAPI functions, as well as WDF in order to have a shot at detecting rootkits. The actual crash wassn't happening in BOClean itself, but rather in the Microsoft PSAPI libraries which suddenly had no memory available to pull a database of memory allocation (which BOClean needs in order to find where to look) and having the rug pulled out from under the kernel was the cause of this problem as MIRO blew up windows itself!
Anyhoo, solved that last week. BOClean now holds the memory for what it calls under PSAPI now and will NOT allow it to be "garbage-collected" by an errant kernel. That was the solution. I still have a few other "last program installed gets blamed for all the others" and have also fixed the alert on a bad download, explanation of "module not found" and better 'try this" results, and have one LAST complaint involving services which were excluded but are STILL being detected yet to be recoded.
Once I have THAT done (and hope to find some time over the weekend coming) then I will offer you guys a "test build" to play with to replace your existing BOC426.exe to test it out with. Stay tuned, but I've EARNED a few days off ... will be back to ya's all with some HAPPINESS! =)
Edit: added information as to the origin of "ns" and its relationship to "NSClean" ...
Author