[Fwd: Re: [Samba] Drag and Drop and Crash]

[Jim Summers]

Hello List,

Please read Tom's email below.  Has some interesting findings.  The affected 
machine I dealt with also had symantec on it.  Since the repair though there 
hasn't been a problem.  The user even re-applied the patches.  This is to weird.

HTH


-------- Original Message --------
Subject: 	Re: [Samba] Drag and Drop and Crash
Date: 	Mon, 16 Apr 2007 18:12:47 -0700
From: 	Thomas McNeely <Thomas.McNeely at wwu.edu>
To: 	<jsummers at cs.ou.edu>



Jim, sorry to keep doing this to you but the Samba list rejected me
again. Please share this with the list.

Thanks!

Tom

-----

Here's what we've discovered about this problem, including much new
information:

(Most of the tedious version details are deferred to the end of this
message for readability.)

(Dates are expressed American-style as MM/DD/YY.)


On Thursday April 5th our users started experiencing abrupt reboots
(without proper shutdown) when they copied, saved, or renamed files on
our Samba 3.0 shares. This Samba server has run flawlessly for years in
essentially the same configuration as now, and exactly the same
configuration since Christmas. The problem does not occur when writing
to Microsoft or Novell shares.

After trying various experiments on the affected workstations, we
determined that the problem always and only occurs on workstations which
are running both the Novell Client and Symantec AntiVirus. We can only
induce the problem by installing both, and removing either one always
cures the problem.

Regarding Symantec, we have determined that it was a virus definition
file from soon after 3/27/07 (probably one from the week of 4/2/07) that
triggers the problem. The current program version and scan engine
version with virus definition files earlier than 3/27/07 do not trigger
the problem.

Regarding the Novell Client, we have found that only a default
installation is needed to replicate the problem -- no need for Zenworks
client, or even to log in. Also, moving the Novell Client to the bottom
of the "provider order" list does not fix the problem.

Although the timing of the problem's first appearance corresponds
suspiciously with the release of Microsoft's patch KB925902, we have
eliminated this patch as a factor.

We have another Samba server, version 2.2 running on Solaris, whose
users do not experience the problem. So we tried setting up another
Samba 2.2 machine to test with -- in every way similar to our Samba 3.0
machine except for the Samba version. We cannot replicate the problem
when writing to a Samba 2.2 share, regardless of workstation configuration.

Although there are a few contributing factors coming together to create
this problem, we believe that the most likely and appropriate solution
would come from Symantec (e.g. in the form of a fix to their virus
definition files). However, fixes might also be possible in the Novell
Client or Samba.

Hope that helps someone and/or someone can help me!

Tom McNeely

Western Washington University Libraries


Appendix: The software versions tested are:

* Windows XP with Service Pack 2 (no

   other versions tested)

* Novell Client version 4.91.3.20061109,

   default installation, no Zenworks client

* Symantec AntiVirus: program version

   10.1.5.5000, scan engine version

   71.2.0.12, and several virus definitions

   between 4/9/07 (and surely going back

   into the week of 4/2/07) through at least

   4/16/07 rev 17. Virus definitions earlier

   than 3/27/07 (and probably earlier than

   the week of 4/2/07) do not trigger the

   problem.

* Samba version 2.2.5 (installation method

   and options unknown, running on Solaris)

   -- NO problem

* Samba version 2.2.12 (default installation

   from samba.org source code, installed on

   Slackware 10.2) -- NO problem

* Samba versions 3.0.23d and 3.0.24 (default

   installation from samba.org source code,

   installed on Slackware 10.2 and 9.1

   respectively) -- DO have problem




-- 
Jim Summers
School of Computer Science-University of Oklahoma
-------------------------------------------------