Random Acrobat crashing

Report · Jul 02, 2019

This issue will require some explanation. We currently provide software to our customers that allows them to preview PDF files. This happens through an internet explorer window embedded into the software, that runs acrobat to display the PDF file when it's attached. We have done this for years without issue.

Recently, a customer has informed us about our software crashing when previewing files, and we have gone through many steps to try and reproduce the issue, to no avail. This happens on two computers in their office and doesn't always happen.

They are previewing files saved on a network share, as everybody in their office needs access to them. The crashing does not happen if the files are saved locally.

Here is a video of the crashing:

(Link removed by Moderator)

We have determined this is caused by Acrobat due to the system logs we receive:

-----

Faulting application name: pp.exe, version: 17.0.0.0, time stamp: 0x5c0fcc90

Faulting module name: IA32.api, version: 19.12.20034.1161, time stamp: 0x5ccb995b

Exception code: 0xc0000005

Fault offset: 0x0000573b

Faulting process id: 0x2f90

Faulting application start time: 0x01d528396cb4b1d5

Faulting application path: C:\Printer's Plan\pp.exe

Faulting module path: C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\plug_ins\IA32.api

Report Id: 134d61fd-005e-4628-9e69-3f1122f59ab4

Faulting package full name:

Faulting package-relative application ID:

-----

As you can see, something is happening in acrobat causing this crash to happen.

We have tried many things, reinstalling acrobat fully using the cleaner tool, reinstalling IE, renaming the files, and we have not been able to fix this issue.

We have also tried countless options to try and reproduce this internally, but also have not found a solution. We thought maybe "Enable Protected Mode at Startup" was causing an issue, and disabled this, but it did not stop the crashing.

We can't figure out why this is happening, and after hours of reading discussion articles with no resolution, we wanted to turn this over to the Adobe team.
Please let me know if you have any help.

Report · Jul 02, 2019

This problem I would approach it from a computer repair point of view.

I would delete the "pp.exe" unless the folder that your crash log revealed is for a program that you have installed there with other things...either case if, the "Printers Plan" folder is just for saving PDF documents it does not make any sense to have an executable showing in there as the faulting application.

When was the last time that the C:\Windows\Temp folder was examined for its contents or emptied out?

And when was the last time that you remember that everything in your StartUp folder was deleted or disable?

Also, would it be possible for you to do a full system virus scan from a good-known working computer and then run the executable virus scanning tool from a USB key in the affected computer?

Disconnect from the your Internet when you do the following:

- Reboot the affected computer in Safe Mode

-- While in Safe Mode, run the virus scanning utiliy without interrupting any part of this process; if something pops up as an infection make notes of other paths and dependencies that may also be related to the offending app.

-- If nothing is found, still it is highly recommended to run from the command pormpt the following as administrtor:

checkdsk with these parameters “chkdsk c: /f /r /x” on your drives.

Also run a file system check (also in Administrator Mode from your command prompt) with this command: sfc /scannow to repair and revert damaged files (if any) to their default state.

As for the Adobe Internet Plug In "IA32.api" you may also want to a reputable third-party registry checker application to repair the integrity of your registry (if problems were found due to malicious software infection) and actually clean your entire registry.

Lastly, you can always go back in time and select a windows recovery check point that you can identify before this started happening and revert to that; I am more inclined in doing thorough cleanups to rule out the weird stuff though.

You also mentioned that the PDF is viewed from an Internet Explorer window.

Disable this addon too with IE opened.

Hit ALT +X to open the tools icon. MANAGE ADDONS----- VIEW ALL ADDONS and disble or remove from internet explorer. You can enable it or reinstall it later.

Do a backup on a separate drive or network directory. And delete the old network shared folder. Recreate the new shared folder and make sure to assigned it as a shared/public folder.

Restore your backup in it.

If you dont want to do this then check the attributes of the current network folder and see if for some reason it became a read only folder.

If it is read only change its attribute to , read, write, execute. And specify the user group that will have access to it

Then remove the mapped network drive in the affected computer(s) and recreate it ... see if by assigning it a different drive letter will also do the trick and map it to the new shared folder.

I know this is a long answer and I might be all over the place but you did specified "it will require an explanation"

Report · Jul 09, 2019

Just to address some of this:

I would delete the "pp.exe" unless the folder that your crash log revealed is for a program that you have installed there with other things...either case if, the "Printers Plan" folder is just for saving PDF documents it does not make any sense to have an executable showing in there as the faulting application.

pp.exe is our provided software that displays the PDF files using IE and Acrobat. We can not delete this. Additionally, the "Printer's Plan" folder on the C drive is not where files are saved, this is the program install location. As aforementioned, files are saved on the network drive.

When was the last time that the C:\Windows\Temp folder was examined for its contents or emptied out?

And when was the last time that you remember that everything in your StartUp folder was deleted or disable?

Also, would it be possible for you to do a full system virus scan from a good-known working computer and then run the executable virus scanning tool from a USB key in the affected computer?

Disconnect from the your Internet when you do the following:

- Reboot the affected computer in Safe Mode

-- While in Safe Mode, run the virus scanning utiliy without interrupting any part of this process; if something pops up as an infection make notes of other paths and dependencies that may also be related to the offending app.

-- If nothing is found, still it is highly recommended to run from the command pormpt the following as administrtor:

checkdsk with these parameters “chkdsk c: /f /r /x” on your drives.

Also run a file system check (also in Administrator Mode from your command prompt) with this command: sfc /scannow to repair and revert damaged files (if any) to their default state.

Being an IT myself, I can't seem to think of any reason these might help. These are relatively new computers that run totally fine on their own. The suggestions are appreciated, however.

As for the Adobe Internet Plug In "IA32.api" you may also want to a reputable third-party registry checker application to repair the integrity of your registry (if problems were found due to malicious software infection) and actually clean your entire registry.

Lastly, you can always go back in time and select a windows recovery check point that you can identify before this started happening and revert to that; I am more inclined in doing thorough cleanups to rule out the weird stuff though.

I may try this registry suggestion, but likely as a last-ditch option. This crashing has always happened. There are no recovery points in this case so restoring from a backup is unnecessary.

You also mentioned that the PDF is viewed from an Internet Explorer window.

Disable this addon too with IE opened.

Hit ALT +X to open the tools icon. MANAGE ADDONS----- VIEW ALL ADDONS and disble or remove from internet explorer. You can enable it or reinstall it later.

We have tried this actually. If we do this, our program will launch the default PDF viewer to display the PDFs. This stops the crashing as far as we know, but this is not an ideal resolution - the files should display in our software.

ls_rbls  wrote
Do a backup on a separate drive or network directory. And delete the old network shared folder. Recreate the new shared folder and make sure to assigned it as a shared/public folder.
Restore your backup in it.
If you dont want to do this then check the attributes of the current  network folder and see if for some reason it became a read only folder.
If it is read only change its attribute to , read, write, execute. And  specify the user group that will have access to it 
Then remove the mapped network drive in the affected computer(s) and recreate it ... see if by assigning it a different drive letter will also do the trick and map it to the new shared folder.

I would say this sounds right, except many people save to this network location, ruling out it being read only. Additionally, the crashing only happens SOMETIMES, so this suggestion seems too out of the ordinary.

I would also like to reiterate, this is the only customer using our software that we know of where this is happening on two computers. No other person out of the thousands is experiencing this issue. This leads me to believe it could possibly be something with their internal network configuration, or maybe some permissions issues. Thoughts?

Report · Jul 09, 2019

Hello again,

I apologize if some of my guidance sounds too basic or unnecessary;

I've never been an IT Manager or Network Admin.

Most of my experience in computing comes from assisting backup operators, network administrators and IT Managers as a computer repair technician.

So, out of a habit, my approach into assessing any computer issue will always have as a premise to put in perspective what were the end users doing in those computers when they say " it was working before, this just started happening the other day", and also when they say that " they don't know what happened".

And now that you specified that the problem is narrowed down to two of your customers computers, then it would make a little more sense to try one or two things suggested earlier in those two computers.

Like, the pp.exe, for example, when you research the web about this type of executable, it also comes back as an Internet Explorer browser hijacking spyware that use the same name as the software that you are trying to troubleshoot in those machines.

Just food for thought.

Because if that was the case, even if the computers were brand new, once we hook them up to the Internet, so many things can happen.

Just keeping track of logs and examining dumps by itself could be a career field if you think about it.

I will document myself better and see if I can come up with more ideas.

Report · Jul 09, 2019

I forgot to ask about so many other things. Lately Ive been reading other threads in which files that have embedded videos and rich media are crashingas well... specially when the original file was created using InDesign and later exported to PDF.

I tried to recreate a scenario in my computer that took me hours to figure out; the videos rich media addon tool was working fine but the problem was not updating the flash player plugin to the correct version of my OS.

Long story short, I have windows10 which is 64bit operating system. But ironically ot was not the 64 bit flash player plugin that worked; it was the 32bit version.

So, what I am trying to suggest (even if the prior example does not apply to your customer), before doing any changes to folder permissions and networking settings, try this:

If there is a setting under EDIT -----> PREFERENCES, that tells Acrobat to open PDF files automatically; how about configuring it to open pdf documents in Reader Mode View only? And also how about disabling that here and selecting the browser as default.

Then, is there a way in Internet Explorer that you can force the file to be downloaded first to a local folder first before it opens automatically in a browser tab?

I know that there is a setting in mozilla and chrome engines-based browsers that you can have the browser to download the file as PDF instead of forcing it to display immediately in a browser tab.

Would this be convenient to try and see if it helps in any way?

Report · Jul 09, 2019

And then figure out if it is a plugin issue like the 32bit versus 64 bit plugins

Report · Jul 10, 2019

Hello again,

This will be my last post on this topic as the more I research the more my brain seems to run low on "memory space".

After I examined the crash log that you provided I felt like reading about memory addressing tables and memory paging.

With just the crash log on hand it is very hard to tell if the segmented fault and its offset is exclusively related to Adobe.

The Adobe internet plugin module IA32.api was detected as the faulting module, but so was the pp.exe as the faulting application.

If this would've happened over 15 years ago in older computers it would've been easier to trace the exception code 0×c0000005 by referencing to a memory address table.

I remeber the days that Dr. Watson (every version of windows used to have it... not sure if still exists in windows 10 as we move to learning power shell skills); it used to save my life many times when performing computer repairs.

That little program when it was combined with a good memory adress table as a reference would never fail to get to the root of these hexadecimal and binary "machine word" mysteries.

Hypothetically speaking, nowadays people prefer to pay $500 to have a person to erase and reinstall the operating system in their computer as a solution... hold on, wait $500 is just the assessment.

Regular computer users get afraid when a real tech guy asks very humbly for $75.00 an hour to get to the root of a problem... but that is beyond the point and far from this topic.

Anyway, I think you will see what I meant if you have the time and patience to continue reading beyond this point.

Not only that exception code is part of an instruction set that attempted to write itself in an virtual memory area, by which the memory segmentation and the memory paging was handled entirely by the operating system.

Furthermore, when you also research about the exception code 0xc0000005 it also manifests when there are viruses in a computer, incorrect browser configurations, plugin issues, hard disk failures, bad memory chips, and anything from incorect upgrades, or lack of applying patches and updates, to corrupted drivers, system files and file servers.

In which case there is no physycal trace to reference to as if, for example, a defective memory chip in the physical RAM / CMOS chips was the cause, outdated cpu / chipset drivers, or even in a hard drive where an area was reserved as temporary folder (in windows) or a swap file ( in unix like systems).

In today's 64 bit computers with most current operating systems all that memory paging is handled in a virtual memory space; there is no easy way to trace where exactly did the OS assigned available addresses for those two programs that you are using.

From further reading I learned that the best way to get a hint of what is the real cause is to examine Windows mini dump file with a debugger program, such as WinDbg.

The real key to the problem is in learning to identify and interpret through the debugger the "fault process ID 0x2f90" with the debugging software and which identify which memory page was assigned for pp.exe and IA32.api respectively when they were trying to execute and somehow accessed a forbidden addressing space as indicated in the fault offset 0000573b.

In theory, this may lead us to find out that the OS had that space reserved for another program (and maybe uninstalling that program, unknown to us yet, will free up the memory area(s) that the IA32.api and pp.exe need for themselves to coexist).

Without a debugger that could help us interpret this information we cannot really tell who is guilty yet; the Adobe product ? or the Printer's Plan software ? (or both ???).