Program Mysteriously Shutting Down

[Randall_M_]

I have a strange problem that just started popping up with a program I have been marketing for ten years now. It seems to be related to Win-7, but I cannot reproduce it on any of my own computers. The program installs and runs, but after roughly ten seconds, it shuts down on its own. I'm thinking maybe an anti-virus program, but why would it wait until the program is running to shut it down? I'm running VS 10.0.40219.1 SP1Rel and .NET 4.5.50938 SP1Rel. If anybody has any ideas on what to look for, I would sure appreciate your input.

[Steven_L_Intel1]

Is this a Fortran program? If so, which Fortran are you using? I have in the past seen a program simply exit when the stack gets corrupted. But there can be other causes. Is this a console application, QuickWin or something else? What does the system event log show, if anything, when this occurs?

AV programs could detect what they think is malicious behavior and shut the program down, but they would then usually alert the user or log the action.

[Randall_M_]

Hello Steve,

Yes, it is an Intel Fortran program. Compiler 10.1.011. It is a window application, using a third party GUI (Winteracter). The program doesn't shut down on any of the half dozen computers I have at my disposal. I've used the exact same install program that the client used.

What should I look for in the clients system event log?

Randy

[Steven_L_Intel1]

Event Viewer > Windows Logs > Application. Filter for Critical and Error events. For example, on my system I see this event:

Faulting application name: OUTLOOK.EXE, version: 15.0.4569.1503, time stamp: 0x52b0b282
Faulting module name: ntdll.dll, version: 6.1.7601.22436, time stamp: 0x521eaa80
Exception code: 0xc0000374
Fault offset: 0x000ce723
Faulting process id: 0x1b54
Faulting application start time: 0x01cf4f65c989f7f1
Faulting application path: C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE
Faulting module path: C:\windows\SysWOW64\ntdll.dll
Report Id: 708f26fb-bc08-11e3-bbd6-001cc094eea2

You may or may not see anything useful here, but if you do, at least you'll know whether it was a runtime error or some external action that killed the process.

[Randall_M_]

Steve,

I just finished a skype session with the client. There weren't any error log entries, and no entries in the Symantec AV log. One thing I haven't looked at lately is static analysis. Maybe I'll find something there.

[Randall_M_]

Steve,

Here is how I finally solved the problem.

My sister is also a developer, and she had a windows-8 machine on which the disappearing program problem would occur. We setup a remote logon so I could recompile with debug statements added. Since I use WINTERACTER, I just used their standard Idebug calls. We thought we found the culprit when it appeared that the last statement to execute was always a call to Winteracter WMESSAGE.

Lawson Wakefield at Winteracter suggested that the problem was probably occurring earlier in the program, and to try chopping out bits of code until the problem went away. After many iterations of chopping down my code, I zeroed in on a much earlier call to a software protection routine for my Keylok USB dongle. It turns out that as part of their standard interface routines, there is an anti-debugger called PPMON.EXE which gets launched. This is supposed to protect against reverse engineering some sort of bypass the protection scheme. I commented out the call that launches this anti-debugger, and the problem went away.

According to the keylok user's manual, "If a kernel-level debugger is detected, this program will terminate the application within 10 seconds of detection."

I'm not sure why a kernel-level debugger is detected on certain systems and not others. Sure as heck explains why the program would startup and then go away after about ten seconds!

I feel pretty foolish, now that I found the answer. I hope that this saves somebody else about two days of work tracking down the same problem!

This wasn't showing up in any computer system error logs, I suppose because it isn't an error. The PPMON.EXE is doing what it is supposed to.

Thanks for your guidance and input.

Randy Martin

[Steven_L_Intel1]

Randy,

Thanks for filling us in on the resolution! I am sure it will be useful to others in the future.