[Webbert]

Also habe folgendes Problem. Nach dem ich des Spiel NFS-MW beendet habe und einen Ordner geöffnet habe kam die Fehlermeldung drwtsn32.exe. Wollte ein Screenshot machen aber als ich die Fehlermeldung wegklickte hieng der PC. Dann als ich mal wieder den PC hochgefahren habe kam wieder als ich einen Ordner öffnete die Fehlermeldung konnte aber ein Bild mit meim Handy machen können. Und als ich die Fehlermeldung wegklickte hieng der PC wieder. Aber der Task-manager konnte ich einschalten also ging es wieder.

Als erstes kam dieses Problem:


Und das Problem drwtsn32.exe:


Was kann ich machen das die Fehlermeldung nicht mehr kommt? Was hat es aufsich mit dieser Fehlermeldung?
Please help

Dieser Beitrag wurde von Webbert bearbeitet: 03. Juli 2007 - 09:43

[Systemfailure]

Hmm, das ist eine Nadel im Heuhaufen.

Mach mal einen Scandisk. Was ist das denn was für einen Ordner du da öffnest (Mit welchem Inhalt)


by
Systemfailure

[Webbert]

Ganz normaler Ordner von meinem USB-Stick mit Auto-Bilder, der Fehler kommt aber auch wenn ich Ordner aufm Desktop öffne.

edit: Ich hab mal chkdsk schon durchlaufen lassen aber die Fehlermeldung kam danach auch noch. Der PC ist noch Jung, also die Fehlermeldung müsste gleich am Anfang schon da gewesen sein.
Und die Fehlermeldung kam bis jetz auch nur 2mal. Bin aber zur-zeit auch nur selten an dem PC.

edit: Wie kann ich des Scandisk durchlaufen lassen?

Dieser Beitrag wurde von Webbert bearbeitet: 03. Juli 2007 - 10:25

[DK2000]

@Hinterwäldler:
DrWatson ist keine Systembremse. Er wird nur bei Fehlern aufgerufen. Ansonsten läuft er über haupt nicht permanent mit. Und Nur weil Du mit den Logdateien nichts anfangen kannst, heisst das nicht, dass sie unnütz sind. Gerade in dem Falle wären die Textasugabe der Logdatei ungemein nützlich um überhaupt mal zu sehen, was für ein Problem vorliegt.

@Webbert:
Die Screenshotz sind aber unnütz. Interessanter wären die Ausgaben von DrWatson, wenn Du auf "Klicken sie hier" gehst und dann auf Ausführlich oder mal in der Ereignisanzeige nachschaust, was Dort der Doc so protokolliert hat. Mit den von Dir eingestellten Fehlerhinweisen kann man leider nicht viel anfangen.

Dieser Beitrag wurde von DK2000 bearbeitet: 03. Juli 2007 - 11:48

[Webbert]

@Hinterwäldler

Zitat

Gebe in die Start-Ausführen-Zeile C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe ein und lege unter [Allgemein] den normalen Systemstart fest. Anschließend System neu starten.

Ich hab des mal eingegeben aber ich hab den normalen Systemstart schon drinnen.
Was kann ich jetz machen?

[DK2000]

Garnichts. Die Einstellungen sind so vollkommen normal, auch das sich DrWatson bei Fehlern zu Wort meldet. Wenn Du den jetzt deaktiviertst, behälst Du Deinen eigentlichen Fehler, erhälst aber nur eine meist unverständliche Fehlermeldung, mit der wirklich niemand etwas Anfangen kann oder das System friert einfach so ohne Fehlermeldung ein.

Suche mal lieber in der Ereignisanzeige nach dem Fehler bzw. gebe mal drwtsn32.exe in Start/Ausführen ein, markiere im unteren Bereich den Fehler und lasse ihn Dir mal anzeigen. Vermutlich läuft das ganze aber auf irgend ein defektes/inkompatibles Plugin hinaus. Da DrWatson allerdings selber beendet wird, könnte es auch ein etwas schwerwiegenderes Problem sein (z.B. defekter Speicher) oder der Doc ist einfach falsch konfiguriert.

Dieser Beitrag wurde von DK2000 bearbeitet: 03. Juli 2007 - 12:20

[Webbert]

Hmm das wär nicht toll. Habe mal den Memtest 3.2.iso durchlaufen lassen (ca.14:40h) und mir wurden keine Errors angezeigt. Also ich hab drwtsn32.exe gesucht und folgndes:

Unter dem Fehler:

Kommt dies wenn ichs mir anzeigen lass:

Anwendungsausnahme aufgetreten:
Anwendung: D:\autorun.exe (pid=1664)
Wann: 07.06.2007 @ 21:03:34.062
Ausnahmenummer: c0000006 (Serien E/A-Fehler)

*----> Systeminformationen <----*
Computername: WEBBER
Benutzername: Webbert
Terminalsitzungskennung: 0
Prozessoranzahl: 2
Prozessortyp: x86 Family 6 Model 15 Stepping 6
Windows-Version: 5.1
Aktuelles Build: 2600
Service Pack: 2
Aktueller Typ: Multiprocessor Free
Firma:
Besitzer: Webbert

*----> Taskliste <----*
0 System Process
4 System
396 smss.exe
444 csrss.exe
468 winlogon.exe
512 services.exe
524 lsass.exe
684 svchost.exe
752 svchost.exe
792 svchost.exe
856 svchost.exe
880 svchost.exe
1008 spoolsv.exe
1140 Iaantmon.exe
1184 nvsvc32.exe
1248 wdfmgr.exe
1524 alg.exe
1880 Explorer.EXE
1980 Iaanotif.exe
1996 RUNDLL32.EXE
2004 CTHELPER.EXE
2012 CTXFIHLP.EXE
2020 PDVDServ.exe
2036 ctfmon.exe
252 CTXFISPI.EXE
1596 wuauclt.exe
748 wpabaln.exe
1664 autorun.exe
320 autorun.exe
716 drwtsn32.exe

*----> Modulliste <----*
(0000000000400000 - 0000000000434000: D:\autorun.exe
(000000005b0f0000 - 000000005b128000: C:\WINDOWS\system32\uxtheme.dll
(000000005b420000 - 000000005b427000: C:\WINDOWS\system32\umdmxfrm.dll
(000000005d100000 - 000000005d107000: C:\WINDOWS\system32\serwvdrv.dll
(0000000076af0000 - 0000000076b1e000: C:\WINDOWS\system32\WINMM.dll
(00000000773a0000 - 00000000774a2000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll
(0000000077b10000 - 0000000077b32000: C:\WINDOWS\system32\Apphelp.dll
(0000000077bd0000 - 0000000077bd8000: C:\WINDOWS\system32\VERSION.dll
(0000000077be0000 - 0000000077c38000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d10000 - 0000000077da0000: C:\WINDOWS\system32\USER32.dll
(0000000077da0000 - 0000000077e4a000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e50000 - 0000000077ee1000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077ef0000 - 0000000077f36000: C:\WINDOWS\system32\GDI32.dll
(0000000077f40000 - 0000000077fb6000: C:\WINDOWS\system32\SHLWAPI.dll
(000000007c800000 - 000000007c906000: C:\WINDOWS\system32\kernel32.dll
(000000007c910000 - 000000007c9c7000: C:\WINDOWS\system32\ntdll.dll
(000000007c9d0000 - 000000007d1ee000: C:\WINDOWS\system32\SHELL32.dll

*----> Statusabbild für Threadkennung 0x734 <----*

eax=00400000 ebx=7ffd5000 ecx=00000065 edx=7c98e4c0 esi=00000000 edi=7c80b529
eip=00401000 esp=0012fe9c ebp=0012ffc0 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Module load completed but symbols could not be loaded for D:\autorun.exe
Funktion: autorun
00400fec 0000 add [eax],al
00400fee 0000 add [eax],al
00400ff0 0000 add [eax],al
00400ff2 0000 add [eax],al
00400ff4 0000 add [eax],al
00400ff6 0000 add [eax],al
00400ff8 0000 add [eax],al
00400ffa 0000 add [eax],al
00400ffc 0000 add [eax],al
00400ffe 0000 add [eax],al
FEHLER ->00401000 55 push ebp
00401001 8bec mov ebp,esp
00401003 81ec580e0000 sub esp,0xe58
00401009 57 push edi
0040100a c685d0f1ffff00 mov byte ptr [ebp-0xe30],0x0
00401011 b9d8020000 mov ecx,0x2d8
00401016 33c0 xor eax,eax
00401018 8dbdd1f1ffff lea edi,[ebp-0xe2f]
0040101e f3ab rep stosd
00401020 66ab stosw
00401022 aa stosb

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
ChildEBP RetAddr Args to Child
0012fe98 00413433 00400000 00000000 00152321 autorun+0x1000
0012ffc0 7c816d4f 0069006c 00610063 7ffd5000 autorun+0x13433
0012fff0 00000000 004132b2 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

*----> Raw Stack Dump <----*
000000000012fe9c 33 34 41 00 00 00 40 00 - 00 00 00 00 21 23 15 00 34A...@.....!#..
000000000012feac 01 00 00 00 94 00 00 00 - 05 00 00 00 01 00 00 00 ................
000000000012febc 28 0a 00 00 02 00 00 00 - 53 65 72 76 69 63 65 20 (.......Service
000000000012fecc 50 61 63 6b 20 32 00 20 - 00 04 00 00 18 fc 64 aa Pack 2. ......d.
000000000012fedc 00 00 00 00 ff ff a3 56 - 64 b6 6a a3 9c 49 95 5c .......Vd.j..I.\
000000000012feec 00 00 00 00 57 1a 4e 80 - 80 69 67 ff ff ff ff ff ....W.N..ig.....
000000000012fefc 54 08 b0 66 00 00 00 00 - 30 da a1 87 60 da a1 87 T..f....0...`...
000000000012ff0c ff ff ff ff 0c fc 64 aa - ef 1a 4e 80 80 69 67 ff ......d...N..ig.
000000000012ff1c ff ff ff ff 54 08 b0 66 - 00 00 00 00 30 da a1 87 ....T..f....0...
000000000012ff2c 38 f5 df ff 8b cc 4d 80 - 02 9e 48 67 61 27 4e 80 8.....M...Hga'N.
000000000012ff3c f8 02 56 80 ca 32 41 00 - 6c 00 69 00 63 00 61 00 ..V..2A.l.i.c.a.
000000000012ff4c 00 50 fd 7f 06 00 00 c0 - 30 da a1 00 21 23 15 00 .P......0...!#..
000000000012ff5c 44 00 00 00 68 32 15 00 - c8 32 15 00 e0 32 15 00 D...h2...2...2..
000000000012ff6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012ff7c 00 00 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00 ................
000000000012ff8c 01 00 00 00 00 00 00 00 - ff ff ff ff ff ff ff ff ................
000000000012ff9c ff ff ff ff 00 00 00 00 - 00 00 00 00 b0 fe 12 00 ................
000000000012ffac bc fa 12 00 e0 ff 12 00 - 48 94 41 00 88 d5 41 00 ........H.A...A.
000000000012ffbc 00 00 00 00 f0 ff 12 00 - 4f 6d 81 7c 6c 00 69 00 ........Om.|l.i.
000000000012ffcc 63 00 61 00 00 50 fd 7f - 06 00 00 c0 c8 ff 12 00 c.a..P..........

Unter dem Fehler:

Kommt dies wenn ichs anzeigen lass:

Anwendungsausnahme aufgetreten:
Anwendung: C:\WINDOWS\Explorer.EXE (pid=1796)
Wann: 24.06.2007 @ 01:02:48.843
Ausnahmenummer: c0000005 (Zugriffsverletzung)

*----> Systeminformationen <----*
Computername: WEBBER
Benutzername: Webbert
Terminalsitzungskennung: 0
Prozessoranzahl: 2
Prozessortyp: x86 Family 6 Model 15 Stepping 6
Windows-Version: 5.1
Aktuelles Build: 2600
Service Pack: 2
Aktueller Typ: Multiprocessor Free
Firma:
Besitzer: Webbert

*----> Taskliste <----*
0 System Process
4 System
396 smss.exe
444 csrss.exe
468 winlogon.exe
512 services.exe
524 lsass.exe
684 svchost.exe
752 svchost.exe
792 svchost.exe
856 svchost.exe
884 svchost.exe
1016 spoolsv.exe
1208 Iaantmon.exe
1260 nvsvc32.exe
1372 wdfmgr.exe
1796 Explorer.EXE
1804 alg.exe
1904 Iaanotif.exe
1964 RUNDLL32.EXE
1980 CTHELPER.EXE
1992 CTXFIHLP.EXE
2000 PDVDServ.exe
2040 ctfmon.exe
216 NMIndexingService.exe
240 CTXFISPI.EXE
244 wmiprvse.exe
1944 wuauclt.exe
820 drwtsn32.exe

*----> Modulliste <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\Explorer.EXE
(0000000001300000 - 0000000001313000: C:\WINDOWS\system32\browselc.dll
(0000000001590000 - 00000000015eb000: C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
(00000000018a0000 - 00000000018b9000: C:\Programme\Nero\Nero 7\Nero BackItUp\NBShell.dll
(0000000001a00000 - 0000000001bb9000: C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
(0000000001bc0000 - 0000000001c1b000: C:\Programme\SpeedProject\Squeez 5\SQShell.dll
(0000000002000000 - 0000000002006000: C:\WINDOWS\system32\ctagent.dll
(00000000024e0000 - 00000000025e2000: C:\Programme\Nero\Nero 7\Nero BackItUp\MFC71U.DLL
(00000000025f0000 - 0000000002707000: C:\Programme\SpeedProject\Squeez 5\MxMfc72.DLL
(00000000028b0000 - 000000000293e000: C:\WINDOWS\system32\shdoclc.dll
(00000000034e0000 - 0000000003897000: C:\Programme\Nero\Nero 7\Nero CoverDesigner\covered-deu.NLS
(0000000010000000 - 0000000010010000: C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
(0000000020000000 - 00000000202d9000: C:\WINDOWS\system32\xpsp2res.dll
(0000000038a70000 - 0000000038a7c000: C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
(000000004d5c0000 - 000000004d618000: C:\WINDOWS\system32\WINHTTP.dll
(000000004eba0000 - 000000004ed43000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1d
f_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll
(00000000597d0000 - 0000000059824000: C:\WINDOWS\system32\NETAPI32.dll
(000000005b0f0000 - 000000005b128000: C:\WINDOWS\system32\UxTheme.dll
(000000005b420000 - 000000005b427000: C:\WINDOWS\system32\umdmxfrm.dll
(000000005b9b0000 - 000000005ba22000: C:\WINDOWS\system32\themeui.dll
(000000005ce90000 - 000000005cefe000: C:\WINDOWS\system32\shimgvw.dll
(000000005cf00000 - 000000005cf26000: C:\WINDOWS\system32\ShimEng.dll
(000000005d100000 - 000000005d107000: C:\WINDOWS\system32\serwvdrv.dll
(000000005d450000 - 000000005d4e7000: C:\WINDOWS\system32\comctl32.dll
(0000000060010000 - 0000000060043000: C:\WINDOWS\system32\msutb.dll
(000000006c670000 - 000000006c6bd000: C:\WINDOWS\system32\DUSER.dll
(000000006fd90000 - 000000006ff5a000: C:\WINDOWS\AppPatch\AcGenral.DLL
(0000000071a00000 - 0000000071a08000: C:\WINDOWS\system32\WS2HELP.dll
(0000000071a10000 - 0000000071a27000: C:\WINDOWS\system32\WS2_32.dll
(0000000071a30000 - 0000000071a3a000: C:\WINDOWS\system32\WSOCK32.dll
(0000000071a80000 - 0000000071a92000: C:\WINDOWS\system32\MPR.dll
(0000000071b70000 - 0000000071b83000: C:\WINDOWS\system32\SAMLIB.dll
(0000000071cc0000 - 0000000071cdc000: C:\WINDOWS\system32\actxprxy.dll
(0000000072c80000 - 0000000072c88000: C:\WINDOWS\system32\msacm32.drv
(0000000072c90000 - 0000000072c99000: C:\WINDOWS\system32\wdmaud.drv
(0000000072f70000 - 0000000072f96000: C:\WINDOWS\system32\WINSPOOL.DRV
(0000000073250000 - 0000000073255000: C:\WINDOWS\system32\RICHED32.DLL
(00000000732f0000 - 0000000073348000: C:\WINDOWS\system32\zipfldr.dll
(0000000073aa0000 - 0000000073ab4000: C:\WINDOWS\system32\mscms.dll
(00000000746a0000 - 00000000746eb000: C:\WINDOWS\system32\MSCTF.dll
(0000000074900000 - 0000000074a30000: C:\WINDOWS\system32\msxml3.dll
(0000000074a50000 - 0000000074a58000: C:\WINDOWS\system32\POWRPROF.dll
(0000000074a70000 - 0000000074a7a000: C:\WINDOWS\system32\BatMeter.dll
(0000000074ab0000 - 0000000074af8000: C:\WINDOWS\system32\webcheck.dll
(0000000074db0000 - 0000000074e1c000: C:\WINDOWS\system32\RICHED20.dll
(0000000075dc0000 - 0000000075e51000: C:\WINDOWS\system32\mlang.dll
(0000000075f20000 - 000000007601c000: C:\WINDOWS\system32\BROWSEUI.dll
(0000000076300000 - 0000000076310000: C:\WINDOWS\system32\WINSTA.dll
(0000000076320000 - 0000000076325000: C:\WINDOWS\system32\MSIMG32.dll
(00000000763a0000 - 000000007654b000: C:\WINDOWS\system32\NETSHELL.dll
(00000000765a0000 - 00000000765bd000: C:\WINDOWS\System32\CSCDLL.dll
(00000000765c0000 - 00000000765e1000: C:\WINDOWS\system32\stobject.dll
(0000000076620000 - 00000000766d5000: C:\WINDOWS\system32\USERENV.dll
(0000000076880000 - 0000000076905000: C:\WINDOWS\system32\CRYPTUI.dll
(0000000076930000 - 0000000076938000: C:\WINDOWS\system32\LINKINFO.dll
(0000000076940000 - 0000000076966000: C:\WINDOWS\system32\ntshrui.dll
(0000000076970000 - 0000000076a21000: C:\WINDOWS\system32\SXS.DLL
(0000000076ad0000 - 0000000076ae1000: C:\WINDOWS\system32\ATL.DLL
(0000000076af0000 - 0000000076b1e000: C:\WINDOWS\system32\WINMM.dll
(0000000076bc0000 - 0000000076bef000: C:\WINDOWS\system32\credui.dll
(0000000076bf0000 - 0000000076c1e000: C:\WINDOWS\system32\WINTRUST.dll
(0000000076c50000 - 0000000076c78000: C:\WINDOWS\system32\IMAGEHLP.dll
(0000000076d20000 - 0000000076d39000: C:\WINDOWS\system32\iphlpapi.dll
(0000000076e40000 - 0000000076e4e000: C:\WINDOWS\system32\rtutils.dll
(0000000076f10000 - 0000000076f18000: C:\WINDOWS\system32\WTSAPI32.dll
(0000000076f20000 - 0000000076f4d000: C:\WINDOWS\system32\WLDAP32.dll
(0000000076f90000 - 000000007700f000: C:\WINDOWS\system32\CLBCATQ.DLL
(0000000077010000 - 00000000770e3000: C:\WINDOWS\system32\COMRes.dll
(00000000770f0000 - 000000007717c000: C:\WINDOWS\system32\OLEAUT32.dll
(0000000077180000 - 0000000077227000: C:\WINDOWS\system32\WININET.dll
(0000000077230000 - 00000000772cd000: C:\WINDOWS\system32\urlmon.dll
(00000000773a0000 - 00000000774a2000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(00000000774b0000 - 00000000775ec000: C:\WINDOWS\system32\ole32.dll
(0000000077730000 - 000000007789c000: C:\WINDOWS\system32\SHDOCVW.dll
(00000000778f0000 - 00000000779e4000: C:\WINDOWS\system32\SETUPAPI.dll
(00000000779f0000 - 0000000077a46000: C:\WINDOWS\System32\cscui.dll
(0000000077a50000 - 0000000077ae5000: C:\WINDOWS\system32\CRYPT32.dll
(0000000077af0000 - 0000000077b02000: C:\WINDOWS\system32\MSASN1.dll
(0000000077b10000 - 0000000077b32000: C:\WINDOWS\system32\appHelp.dll
(0000000077ba0000 - 0000000077ba7000: C:\WINDOWS\system32\midimap.dll
(0000000077bb0000 - 0000000077bc5000: C:\WINDOWS\system32\MSACM32.dll
(0000000077bd0000 - 0000000077bd8000: C:\WINDOWS\system32\VERSION.dll
(0000000077be0000 - 0000000077c38000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d10000 - 0000000077da0000: C:\WINDOWS\system32\USER32.dll
(0000000077da0000 - 0000000077e4a000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e50000 - 0000000077ee1000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077ef0000 - 0000000077f36000: C:\WINDOWS\system32\GDI32.dll
(0000000077f40000 - 0000000077fb6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fc0000 - 0000000077fd1000: C:\WINDOWS\system32\Secur32.dll
(0000000078130000 - 00000000781cb000: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.5
0727.163_x-ww_681e29fb\MSVCR80.dll
(000000007c140000 - 000000007c243000: C:\Programme\Gemeinsame Dateien\Ahead\Lib\MFC71.DLL
(000000007c340000 - 000000007c396000: C:\Programme\Gemeinsame Dateien\Ahead\Lib\MSVCR71.dll
(000000007c3a0000 - 000000007c41b000: C:\Programme\Gemeinsame Dateien\Ahead\Lib\MSVCP71.dll
(000000007c800000 - 000000007c906000: C:\WINDOWS\system32\kernel32.dll
(000000007c910000 - 000000007c9c7000: C:\WINDOWS\system32\ntdll.dll
(000000007c9d0000 - 000000007d1ee000: C:\WINDOWS\system32\SHELL32.dll
(000000007d1f0000 - 000000007d4a2000: C:\WINDOWS\system32\msi.dll

*----> Statusabbild für Threadkennung 0x708 <----*

eax=01793210 ebx=00000003 ecx=0179343c edx=00000015 esi=000d21b8 edi=00000000
eip=7c91eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\Explorer.EXE
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
ChildEBP RetAddr Args to Child
0007ff08 7ca42c57 00000000 0007ff5c 01016e95 ntdll!KiFastSystemCallRet
0007ff14 01016e95 000d21b8 7ffde000 0007ffc0 SHELL32!Ordinal201+0x28
0007ff5c 0101e2b6 00000000 00000000 000205e2 Explorer+0x16e95
0007ffc0 7c816d4f 00000002 5d453c48 7ffde000 Explorer+0x1e2b6
0007fff0 00000000 0101e24e 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

*----> Raw Stack Dump <----*
000000000007fef0 f5 93 d1 77 ee 95 a4 7c - ac 92 80 7c b8 21 0d 00 ...w...|...|.!..
000000000007ff00 b8 21 0d 00 14 ff 07 00 - 14 ff 07 00 57 2c a4 7c .!..........W,.|
000000000007ff10 00 00 00 00 5c ff 07 00 - 95 6e 01 01 b8 21 0d 00 ....\....n...!..
000000000007ff20 00 e0 fd 7f c0 ff 07 00 - 00 00 00 00 24 fd 07 00 ............$...
000000000007ff30 50 ff 07 00 e0 ff 07 00 - 27 e0 91 7c ed aa 80 7c P.......'..|...|
000000000007ff40 ff ff ff ff 0c 00 00 00 - 00 00 00 00 06 33 00 00 .............3..
000000000007ff50 a8 00 00 00 01 00 00 00 - b8 21 0d 00 c0 ff 07 00 .........!......
000000000007ff60 b6 e2 01 01 00 00 00 00 - 00 00 00 00 e2 05 02 00 ................
000000000007ff70 01 00 00 00 02 00 00 00 - 48 3c 45 5d 44 00 00 00 ........H<E]D...
000000000007ff80 34 06 02 00 14 06 02 00 - e4 05 02 00 00 00 00 00 4...............
000000000007ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 e4 f2 07 00 ................
000000000007ffa0 24 00 02 00 d0 f0 07 00 - 01 00 00 00 01 00 00 00 $...............
000000000007ffb0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000007ffc0 f0 ff 07 00 4f 6d 81 7c - 02 00 00 00 48 3c 45 5d ....Om.|....H<E]
000000000007ffd0 00 e0 fd 7f fa 22 55 80 - c8 ff 07 00 a8 4d a2 87 ....."U......M..
000000000007ffe0 ff ff ff ff f3 99 83 7c - 58 6d 81 7c 00 00 00 00 .......|Xm.|....
000000000007fff0 00 00 00 00 00 00 00 00 - 4e e2 01 01 00 00 00 00 ........N.......
0000000000080000 41 63 74 78 20 00 00 00 - 01 00 00 00 98 24 00 00 Actx ........$..
0000000000080010 c4 00 00 00 00 00 00 00 - 20 00 00 00 00 00 00 00 ........ .......
0000000000080020 14 00 00 00 01 00 00 00 - 06 00 00 00 34 00 00 00 ............4...

*----> Statusabbild für Threadkennung 0x720 <----*

eax=00c6ff54 ebx=00000000 ecx=000a9650 edx=7c91eb94 esi=000a9650 edi=000a96f4
eip=7c91eb94 esp=00c6fe1c ebp=00c6ff80 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00c6ff80 77e56c22 00c6ffa8 77e56a3b 000a9650 ntdll!KiFastSystemCallRet
00c6ff88 77e56a3b 000a9650 00000000 0007f88c RPCRT4!I_RpcBCacheFree+0x5ea
00c6ffa8 77e56c0a 000a9508 00c6ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
00c6ffb4 7c80b50b 000b3660 00000000 0007f88c RPCRT4!I_RpcBCacheFree+0x5d2
00c6ffec 00000000 77e56bf0 000b3660 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000c6fe1c 99 e3 91 7c 03 67 e5 77 - 8c 01 00 00 70 ff c6 00 ...|.g.w....p...
0000000000c6fe2c 00 00 00 00 c8 83 18 00 - 4c ff c6 00 ff ff ff cf ........L.......
0000000000c6fe3c ff f3 ff ff fb ff bf fb - f7 7f ff ff ff ef ff fb ................
0000000000c6fe4c ef ff ff ff 02 fd ff fd - 00 00 f7 7f fe f9 ff ff ................
0000000000c6fe5c 3a bf f7 7f ff ff ff ff - ff fb df fb f6 ef ff f7 :...............
0000000000c6fe6c 04 5d 88 8a ff ff fd bf - ff 7f df ff ff f7 fd fd .]..............
0000000000c6fe7c ff f7 ff 5f fe fb ff ff - ff ef ff ff ff ff ff fb ..._............
0000000000c6fe8c ff ff ff ff f7 7f df ff - ff 3f 7e be ef fb ef b9 .........?~.....
0000000000c6fe9c dc 7a 6d 7e 47 2b b2 13 - 7d 3f 3f 0b 6b a3 c8 d2 .zm~G+..}?.k...
0000000000c6feac 5f b7 1d 07 ff ff ff ff - ff ff ff ff ff ff ff ff _...............
0000000000c6febc ff ff ff ff ff ff ff ff - ff fb ff fd ff ff ff ff ................
0000000000c6fecc ff ff ff ff 63 67 17 fd - ed bb e7 73 4a e3 39 fd ....cg.....sJ.9.
0000000000c6fedc e5 b2 f7 60 9e b9 5f ef - f5 bf 93 bf 9f bd 5f cf ...`.._......._.
0000000000c6feec d3 39 b5 bd 1f 00 00 00 - 40 f5 df ff 42 cf 4d 80 [email protected].
0000000000c6fefc ff ff ff ff 46 02 00 00 - 77 cd 4d 80 28 5c c6 a9 ....F...w.M.(\..
0000000000c6ff0c 98 c0 a2 87 20 f1 df ff - 34 c2 a2 87 09 22 4e 80 .... ...4...."N.
0000000000c6ff1c 08 c1 a2 87 98 c0 a2 87 - 3f 22 4e 80 04 c2 a2 87 ........?"N.....
0000000000c6ff2c 98 c0 a2 87 80 ff c6 00 - 99 66 e5 77 4c ff c6 00 .........f.wL...
0000000000c6ff3c a9 66 e5 77 ed 10 91 7c - c8 2f 0b 00 60 36 0b 00 .f.w...|./..`6..
0000000000c6ff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff ../M.....]......

*----> Statusabbild für Threadkennung 0x724 <----*

eax=774c319a ebx=00007530 ecx=00000009 edx=00000000 esi=00000000 edi=00ccff50
eip=7c91eb94 esp=00ccff20 ebp=00ccff78 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
ChildEBP RetAddr Args to Child
00ccff78 7c802451 0000ea60 00000000 00ccffb4 ntdll!KiFastSystemCallRet
00ccff88 774c2fcb 0000ea60 000b5dd8 774c314d kernel32!Sleep+0xf
00ccffb4 7c80b50b 000b5dd8 00000000 7c92094e ole32!StringFromGUID2+0x2d1
00ccffec 00000000 774c319a 000b5dd8 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000ccff20 5c d8 91 7c ed 23 80 7c - 00 00 00 00 50 ff cc 00 \..|.#.|....P...
0000000000ccff30 50 25 80 7c f0 56 5d 77 - 30 75 00 00 14 00 00 00 P%.|.V]w0u......
0000000000ccff40 01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00 ................
0000000000ccff50 00 ba 3c dc ff ff ff ff - 08 4f 4b 77 50 ff cc 00 ..<......OKwP...
0000000000ccff60 30 ff cc 00 d0 4f 09 00 - dc ff cc 00 f3 99 83 7c 0....O.........|
0000000000ccff70 58 24 80 7c 00 00 00 00 - 88 ff cc 00 51 24 80 7c X$.|........Q$.|
0000000000ccff80 60 ea 00 00 00 00 00 00 - b4 ff cc 00 cb 2f 4c 77 `............/Lw
0000000000ccff90 60 ea 00 00 d8 5d 0b 00 - 4d 31 4c 77 00 00 00 00 `....]..M1Lw....
0000000000ccffa0 00 00 00 00 d8 5d 0b 00 - 00 00 4b 77 b5 31 4c 77 .....]....Kw.1Lw
0000000000ccffb0 4e 09 92 7c ec ff cc 00 - 0b b5 80 7c d8 5d 0b 00 N..|.......|.]..
0000000000ccffc0 00 00 00 00 4e 09 92 7c - d8 5d 0b 00 00 b0 fd 7f ....N..|.]......
0000000000ccffd0 00 f6 1e 8a c0 ff cc 00 - 08 4a a1 87 ff ff ff ff .........J......
0000000000ccffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00 ...|...|........
0000000000ccfff0 00 00 00 00 9a 31 4c 77 - d8 5d 0b 00 00 00 00 00 .....1Lw.]......
0000000000cd0000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000cd0010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000cd0020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000cd0030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000cd0040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000cd0050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x728 <----*

eax=7ffda000 ebx=77d1b762 ecx=0001007c edx=7c91eb94 esi=010460d8 edi=00000000
eip=7c91eb94 esp=00d0ff14 ebp=00d0ff44 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHLWAPI.dll -
ChildEBP RetAddr Args to Child
00d0ff44 01011e8b 00000000 00d0ffb4 77f5f5de ntdll!KiFastSystemCallRet
00d0ff50 77f5f5de 010460d8 0000005c 0007fc04 Explorer+0x11e8b
00d0ffb4 7c80b50b 00000000 0000005c 0007fc04 SHLWAPI!Ordinal505+0x369
00d0ffec 00000000 77f5f56f 0007fdbc 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000d0ff14 f5 93 d1 77 40 1a 00 01 - 00 00 00 00 d8 60 04 01 ...w@........`..
0000000000d0ff24 00 00 00 00 78 00 01 00 - 13 01 00 00 08 00 00 00 ....x...........
0000000000d0ff34 00 00 00 00 c4 e1 00 00 - 86 02 00 00 48 02 00 00 ............H...
0000000000d0ff44 50 ff d0 00 8b 1e 01 01 - 00 00 00 00 b4 ff d0 00 P...............
0000000000d0ff54 de f5 f5 77 d8 60 04 01 - 5c 00 00 00 04 fc 07 00 ...w.`..\.......
0000000000d0ff64 bc fd 07 00 62 1e 01 01 - b1 79 01 01 ac 01 00 00 ....b....y......
0000000000d0ff74 d8 60 04 01 08 00 00 00 - 00 00 00 00 00 00 00 00 .`..............
0000000000d0ff84 00 00 00 00 00 00 00 00 - 00 00 00 00 b0 07 ae 87 ................
0000000000d0ff94 7c bb 4f 80 00 00 00 00 - 00 00 00 00 00 00 00 00 |.O.............
0000000000d0ffa4 84 bb 4f 80 00 00 00 00 - f2 4e 70 80 dc e2 91 7c ..O......Np....|
0000000000d0ffb4 ec ff d0 00 0b b5 80 7c - 00 00 00 00 5c 00 00 00 .......|....\...
0000000000d0ffc4 04 fc 07 00 bc fd 07 00 - 00 a0 fd 7f 00 f6 1e 8a ................
0000000000d0ffd4 c0 ff d0 00 b8 46 a1 87 - ff ff ff ff f3 99 83 7c .....F.........|
0000000000d0ffe4 18 b5 80 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 ...|............
0000000000d0fff4 6f f5 f5 77 bc fd 07 00 - 00 00 00 00 00 00 00 00 o..w............
0000000000d10004 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d10014 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d10024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d10034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d10044 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x72c <----*

eax=7c93798d ebx=00000000 ecx=77da6a51 edx=77da6a18 esi=ffffffff edi=7c91fb78
eip=7c91eb94 esp=00d4ff9c ebp=00d4ffb4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00d4ffb4 7c80b50b 00000000 7c91fb78 ffffffff ntdll!KiFastSystemCallRet
00d4ffec 00000000 7c93798d 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000d4ff9c 5c d8 91 7c d4 79 93 7c - 01 00 00 00 ac ff d4 00 \..|.y.|........
0000000000d4ffac 00 00 00 00 00 00 00 80 - ec ff d4 00 0b b5 80 7c ...............|
0000000000d4ffbc 00 00 00 00 78 fb 91 7c - ff ff ff ff 00 00 00 00 ....x..|........
0000000000d4ffcc 00 90 fd 7f 00 d6 1e 8a - c0 ff d4 00 08 7f 50 89 ..............P.
0000000000d4ffdc ff ff ff ff f3 99 83 7c - 18 b5 80 7c 00 00 00 00 .......|...|....
0000000000d4ffec 00 00 00 00 00 00 00 00 - 8d 79 93 7c 00 00 00 00 .........y.|....
0000000000d4fffc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5000c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5001c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5002c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5003c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5004c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5005c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5006c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5007c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5008c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d5009c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d500ac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d500bc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d500cc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x730 <----*

eax=00d8d598 ebx=00000000 ecx=00d8d584 edx=7fffff97 esi=7c98c380 edi=7c98c3a0
eip=7c91eb94 esp=00d8ff70 ebp=00d8ffb4 iopl=0 nv up ei ng nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000286

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00d8ffb4 7c80b50b 00000000 00d0fce4 00d0fce8 ntdll!KiFastSystemCallRet
00d8ffec 00000000 7c920760 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000d8ff70 1b e3 91 7c 9d 07 92 7c - d4 01 00 00 ac ff d8 00 ...|...|........
0000000000d8ff80 b0 ff d8 00 98 ff d8 00 - a0 ff d8 00 e4 fc d0 00 ................
0000000000d8ff90 e8 fc d0 00 00 00 00 00 - 00 00 00 00 a8 ca 0d 00 ................
0000000000d8ffa0 00 7c 28 e8 ff ff ff ff - a0 9c c5 a9 69 75 93 7c .|(.........iu.|
0000000000d8ffb0 58 9b 77 01 ec ff d8 00 - 0b b5 80 7c 00 00 00 00 X.w........|....
0000000000d8ffc0 e4 fc d0 00 e8 fc d0 00 - 00 00 00 00 00 80 fd 7f ................
0000000000d8ffd0 00 d6 1e 8a c0 ff d8 00 - 28 3a 56 89 ff ff ff ff ........(:V.....
0000000000d8ffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00 ...|...|........
0000000000d8fff0 00 00 00 00 60 07 92 7c - 00 00 00 00 00 00 00 00 ....`..|........
0000000000d90000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d90090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000d900a0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x734 <----*

eax=000000c0 ebx=00000000 ecx=00d0fb00 edx=00000000 esi=00000000 edi=00000001
eip=7c91eb94 esp=00dcfcec ebp=00dcffb4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00dcffb4 7c80b50b 00000000 00000020 00d0fce4 ntdll!KiFastSystemCallRet
00dcffec 00000000 7c939fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000dcfcec ab e9 91 7c d5 a0 93 7c - 03 00 00 00 30 fd dc 00 ...|...|....0...
0000000000dcfcfc 01 00 00 00 01 00 00 00 - 00 00 00 00 20 00 00 00 ............ ...
0000000000dcfd0c e4 fc d0 00 00 00 00 00 - 08 e5 98 7c 08 e5 98 7c ...........|...|
0000000000dcfd1c dc 01 00 00 34 07 00 00 - 03 00 00 00 03 00 00 00 ....4...........
0000000000dcfd2c 02 00 00 00 d8 01 00 00 - c0 01 00 00 04 05 00 00 ................
0000000000dcfd3c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd4c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfd9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfdac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfdbc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfdcc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfddc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfdec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfdfc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfe0c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dcfe1c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x754 <----*

eax=00e8eb18 ebx=00e8fd58 ecx=000907d8 edx=0000002f esi=00000000 edi=7ffde000
eip=7c91eb94 esp=00e8fd30 ebp=00e8fdcc iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00e8fdcc 77d1bbfe 00000008 00e8fdf4 00000000 ntdll!KiFastSystemCallRet
00e8fe28 7ca043d9 00000007 00e8fe50 ffffffff USER32!SetWindowTextW+0x120
00e8ff4c 7ca4114e 77f5f5de 00000000 7c809988 SHELL32!SHCreateShellFolderView+0x3d6b
00e8ffb4 7c80b50b 00000000 7c809988 00090000 SHELL32!Ordinal753+0x133
00e8ffec 00000000 77f5f56f 00d0f4d4 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000e8fd30 ab e9 91 7c f2 94 80 7c - 08 00 00 00 58 fd e8 00 ...|...|....X...
0000000000e8fd40 01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e8fd50 08 00 00 00 02 00 00 00 - 70 04 00 00 3c 03 00 00 ........p...<...
0000000000e8fd60 24 03 00 00 38 03 00 00 - 08 02 00 00 28 02 00 00 $...8.......(...
0000000000e8fd70 2c 02 00 00 00 02 00 00 - 14 00 00 00 01 00 00 00 ,...............
0000000000e8fd80 e8 f5 0b 00 00 00 00 00 - 00 00 00 00 ec fd e8 00 ................
0000000000e8fd90 94 04 d4 77 08 88 d1 77 - 00 e0 fd 7f 00 60 fd 7f ...w...w.....`..
0000000000e8fda0 a5 89 d1 77 00 00 00 00 - 58 fd e8 00 76 00 01 00 ...w....X...v...
0000000000e8fdb0 08 00 00 00 4c fd e8 00 - 00 00 00 00 dc ff e8 00 ....L...........
0000000000e8fdc0 f3 99 83 7c 90 95 80 7c - 00 00 00 00 28 fe e8 00 ...|...|....(...
0000000000e8fdd0 fe bb d1 77 08 00 00 00 - f4 fd e8 00 00 00 00 00 ...w............
0000000000e8fde0 ff ff ff ff 01 00 00 00 - a0 0f 12 00 07 00 00 00 ................
0000000000e8fdf0 00 00 00 00 70 04 00 00 - 3c 03 00 00 24 03 00 00 ....p...<...$...
0000000000e8fe00 38 03 00 00 08 02 00 00 - 28 02 00 00 2c 02 00 00 8.......(...,...
0000000000e8fe10 00 02 00 00 33 8e 00 00 - 00 00 00 00 01 00 00 00 ....3...........
0000000000e8fe20 00 60 fd 7f 00 02 00 00 - 4c ff e8 00 d9 43 a0 7c .`......L....C.|
0000000000e8fe30 07 00 00 00 50 fe e8 00 - ff ff ff ff ff 04 00 00 ....P...........
0000000000e8fe40 f4 fd e8 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000e8fe50 70 04 00 00 3c 03 00 00 - 24 03 00 00 38 03 00 00 p...<...$...8...
0000000000e8fe60 08 02 00 00 28 02 00 00 - 2c 02 00 00 2c 02 00 00 ....(...,...,...

*----> Statusabbild für Threadkennung 0x764 <----*

eax=00f10000 ebx=0113da34 ecx=00001000 edx=7c91eb94 esi=00000820 edi=00000000
eip=7c91eb94 esp=0113da18 ebp=0113dd20 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0113dd20 7c83aa6b 0113dd48 7c839a54 0113dd50 ntdll!KiFastSystemCallRet
0113ffec 00000000 7c920760 00000000 00000000 kernel32!FindAtomW+0x110c

*----> Raw Stack Dump <----*
000000000113da18 ab e9 91 7c d5 33 86 7c - 02 00 00 00 50 db 13 01 ...|.3.|....P...
000000000113da28 01 00 00 00 01 00 00 00 - 00 00 00 00 43 00 3a 00 ............C.:.
000000000113da38 5c 00 57 00 49 00 4e 00 - 44 00 4f 00 57 00 53 00 \.W.I.N.D.O.W.S.
000000000113da48 5c 00 73 00 79 00 73 00 - 74 00 65 00 6d 00 33 00 \.s.y.s.t.e.m.3.
000000000113da58 32 00 5c 00 64 00 72 00 - 77 00 74 00 73 00 6e 00 2.\.d.r.w.t.s.n.
000000000113da68 33 00 32 00 20 00 2d 00 - 70 00 20 00 31 00 37 00 3.2. .-.p. .1.7.
000000000113da78 39 00 36 00 20 00 2d 00 - 65 00 20 00 32 00 30 00 9.6. .-.e. .2.0.
000000000113da88 38 00 30 00 20 00 2d 00 - 67 00 00 00 00 00 00 00 8.0. .-.g.......
000000000113da98 2e 00 00 00 00 00 00 00 - 00 00 00 00 20 dd 13 01 ............ ...
000000000113daa8 0f 32 86 7c 05 00 00 00 - 20 dd 13 01 41 32 86 7c .2.|.... ...A2.|
000000000113dab8 69 32 86 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 i2.|............
000000000113dac8 44 00 00 00 00 00 00 00 - 78 34 86 7c 00 00 00 00 D.......x4.|....
000000000113dad8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000113dae8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000113daf8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000113db08 00 00 00 00 00 f0 fa 7f - d8 c0 98 7c 14 00 16 00 ...........|....
000000000113db18 30 00 fe 7f 00 f0 fa 7f - 18 ee 91 7c 38 07 92 7c 0..........|8..|
000000000113db28 ff ff ff ff 32 07 92 7c - ab 06 92 7c eb 06 92 7c ....2..|...|...|
000000000113db38 f4 df 13 01 fe 00 00 00 - 34 00 00 c0 48 dc 13 01 ........4...H...
000000000113db48 34 de 13 01 04 00 00 00 - 20 08 00 00 10 08 00 00 4....... .......

*----> Statusabbild für Threadkennung 0x76c <----*

eax=000e61a0 ebx=00000000 ecx=13eb0013 edx=13ea0012 esi=000a9650 edi=000a96f4
eip=7c91eb94 esp=0120fe1c ebp=0120ff80 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0120ff80 77e56c22 0120ffa8 77e56a3b 000a9650 ntdll!KiFastSystemCallRet
0120ff88 77e56a3b 000a9650 00000000 003c0178 RPCRT4!I_RpcBCacheFree+0x5ea
0120ffa8 77e56c0a 000a9508 0120ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
0120ffb4 7c80b50b 00153a60 00000000 003c0178 RPCRT4!I_RpcBCacheFree+0x5d2
0120ffec 00000000 77e56bf0 00153a60 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000120fe1c 99 e3 91 7c 03 67 e5 77 - 8c 01 00 00 70 ff 20 01 ...|.g.w....p. .
000000000120fe2c 00 00 00 00 48 d9 16 00 - 4c ff 20 01 58 ec 10 e3 ....H...L. .X...
000000000120fe3c 34 fb 19 ac 20 ed 10 e3 - 25 cb 4d 80 2c fc 19 ac 4... ...%.M.,...
000000000120fe4c a0 8c ab 87 20 ed 10 e3 - 00 00 00 00 48 d5 13 8a .... .......H...
000000000120fe5c 00 74 b7 f7 b0 fb 19 ac - fe 74 b7 f7 13 77 b7 f7 .t.......t...w..
000000000120fe6c 20 ed 10 e3 30 a8 72 89 - 00 00 00 00 70 ef 10 e3 ...0.r.....p...
000000000120fe7c 70 ef 10 e3 d0 ee 10 e3 - 00 00 00 00 38 f5 df ff p...........8...
000000000120fe8c 8b cc 4d 80 00 fc 19 ac - e4 26 4e 80 00 00 00 00 ..M......&N.....
000000000120fe9c 70 de a8 87 00 00 00 00 - b4 fb 19 ac c9 c0 4e 80 p.............N.
000000000120feac 8c fc 19 ac 01 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000120febc 70 de a8 87 00 00 00 00 - a0 8c ab 87 00 00 00 00 p...............
000000000120fecc 01 ed 10 e3 e6 26 b5 00 - c4 fb 19 ac 3b 27 b5 f7 .....&......;'..
000000000120fedc 20 ed 10 e3 30 a8 72 89 - 50 fc 19 ac ba 74 b7 f7 ...0.r.P....t..
000000000120feec a0 8c ab 87 1f 00 00 00 - 40 75 71 f7 69 cf 4d 80 [email protected].
000000000120fefc ff ff ff ff 46 02 00 00 - 77 cd 4d 80 28 fc 19 ac ....F...w.M.(...
000000000120ff0c d8 37 a0 87 20 71 71 f7 - 74 39 a0 87 09 22 4e 80 .7.. qq.t9..."N.
000000000120ff1c 48 38 a0 87 d8 37 a0 87 - 3f 22 4e 80 44 39 a0 87 H8...7..?"N.D9..
000000000120ff2c d8 37 a0 87 80 ff 20 01 - 99 66 e5 77 4c ff 20 01 .7.... ..f.wL. .
000000000120ff3c a9 66 e5 77 ed 10 91 7c - 18 66 15 00 60 3a 15 00 .f.w...|.f..`:..
000000000120ff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff ../M.....]......

*----> Statusabbild für Threadkennung 0x578 <----*

eax=00000001 ebx=00004e20 ecx=0146fce0 edx=7c91eb94 esi=0146fd68 edi=77d191a3
eip=7c91eb94 esp=0146fcf8 ebp=0146fd14 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\stobject.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0146fd14 765c1513 0146fd68 00000000 00000000 ntdll!KiFastSystemCallRet
0146fd8c 765c3746 765c0000 00000000 00010124 stobject+0x1513
0146ffb4 7c80b50b 00000000 00000000 00000000 stobject!DllCanUnloadNow+0x1fa4
0146ffec 00000000 765c36f7 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000146fcf8 9b 91 d1 77 ce 91 d1 77 - 68 fd 46 01 00 00 00 00 ...w...wh.F.....
000000000146fd08 00 00 00 00 00 00 00 00 - 00 00 00 00 8c fd 46 01 ..............F.
000000000146fd18 13 15 5c 76 68 fd 46 01 - 00 00 00 00 00 00 00 00 ..\vh.F.........
000000000146fd28 00 00 00 00 00 00 00 00 - 00 00 5c 76 00 00 00 00 ..........\v....
000000000146fd38 30 00 00 00 00 40 00 00 - 21 13 5c 76 00 00 00 00 0....@..!.\v....
000000000146fd48 1e 00 00 00 00 00 5c 76 - 77 00 02 00 11 00 01 00 ......\vw.......
000000000146fd58 10 00 00 00 00 00 00 00 - f4 31 5c 76 00 00 00 00 .........1\v....
000000000146fd68 24 01 01 00 13 01 00 00 - 05 00 00 00 00 00 00 00 $...............
000000000146fd78 dd a1 00 00 c7 03 00 00 - 0e 00 00 00 00 00 00 00 ................
000000000146fd88 00 00 00 00 b4 ff 46 01 - 46 37 5c 76 00 00 5c 76 ......F.F7\v..\v
000000000146fd98 00 00 00 00 24 01 01 00 - 01 00 00 00 00 00 00 00 ....$...........
000000000146fda8 43 00 3a 00 5c 00 57 00 - 49 00 4e 00 44 00 4f 00 C.:.\.W.I.N.D.O.
000000000146fdb8 57 00 53 00 5c 00 73 00 - 79 00 73 00 74 00 65 00 W.S.\.s.y.s.t.e.
000000000146fdc8 6d 00 33 00 32 00 5c 00 - 73 00 74 00 6f 00 62 00 m.3.2.\.s.t.o.b.
000000000146fdd8 6a 00 65 00 63 00 74 00 - 2e 00 64 00 6c 00 6c 00 j.e.c.t...d.l.l.
000000000146fde8 00 00 81 7c 1b 00 00 00 - 00 02 00 00 fc ff 46 01 ...|..........F.
000000000146fdf8 23 00 00 00 56 08 81 7c - 1b 00 00 00 00 02 00 00 #...V..|........
000000000146fe08 fc ff 28 01 23 00 00 00 - 05 20 00 60 00 20 82 00 ..(.#.... .`. ..
000000000146fe18 20 60 00 20 40 a0 00 08 - 44 00 08 00 12 00 00 00 `. @...D.......
000000000146fe28 00 00 00 00 40 80 00 00 - 00 00 20 80 00 0a 14 00 ....@..... .....

*----> Statusabbild für Threadkennung 0x204 <----*

eax=72c930e8 ebx=014efef8 ecx=0000002d edx=0016dc30 esi=00000000 edi=7ffde000
eip=7c91eb94 esp=014efed0 ebp=014eff6c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\wdmaud.drv -
ChildEBP RetAddr Args to Child
014eff6c 7c809c86 00000002 014effa4 00000000 ntdll!KiFastSystemCallRet
014eff88 72c9312a 00000002 014effa4 00000000 kernel32!WaitForMultipleObjects+0x18
014effb4 7c80b50b 00000000 00000000 00090000 wdmaud!midMessage+0x348
014effec 00000000 72c930e8 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
00000000014efed0 ab e9 91 7c f2 94 80 7c - 02 00 00 00 f8 fe 4e 01 ...|...|......N.
00000000014efee0 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000000014efef0 00 00 00 00 00 00 00 00 - dc 04 00 00 c4 04 00 00 ................
00000000014eff00 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000000014eff10 00 00 00 00 00 00 00 00 - 14 00 00 00 01 00 00 00 ................
00000000014eff20 98 d2 16 00 00 00 00 00 - 00 00 00 00 20 70 94 87 ............ p..
00000000014eff30 54 70 94 87 00 94 a0 87 - 00 e0 fd 7f 00 b0 fa 7f Tp..............
00000000014eff40 20 70 94 87 00 00 00 00 - f8 fe 4e 01 9c bb 4f 80 p........N...O.
00000000014eff50 02 00 00 00 ec fe 4e 01 - 00 00 00 00 dc ff 4e 01 ......N.......N.
00000000014eff60 f3 99 83 7c 90 95 80 7c - 00 00 00 00 88 ff 4e 01 ...|...|......N.
00000000014eff70 86 9c 80 7c 02 00 00 00 - a4 ff 4e 01 00 00 00 00 ...|......N.....
00000000014eff80 ff ff ff ff 00 00 00 00 - b4 ff 4e 01 2a 31 c9 72 ..........N.*1.r
00000000014eff90 02 00 00 00 a4 ff 4e 01 - 00 00 00 00 ff ff ff ff ......N.........
00000000014effa0 00 00 09 00 dc 04 00 00 - c4 04 00 00 f2 4e 70 80 .............Np.
00000000014effb0 dc e2 91 7c ec ff 4e 01 - 0b b5 80 7c 00 00 00 00 ...|..N....|....
00000000014effc0 00 00 00 00 00 00 09 00 - 00 00 00 00 00 b0 fa 7f ................
00000000014effd0 00 d6 1e 8a c0 ff 4e 01 - d8 11 9a 87 ff ff ff ff ......N.........
00000000014effe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00 ...|...|........
00000000014efff0 00 00 00 00 e8 30 c9 72 - 00 00 00 00 00 00 00 00 .....0.r........
00000000014f0000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x624 <----*

eax=77e56bf0 ebx=00000000 ecx=0000000c edx=00fd3770 esi=000a9650 edi=000a96f4
eip=7c91eb94 esp=0152fe1c ebp=0152ff80 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0152ff80 77e56c22 0152ffa8 77e56a3b 000a9650 ntdll!KiFastSystemCallRet
0152ff88 77e56a3b 000a9650 00000000 00fd0178 RPCRT4!I_RpcBCacheFree+0x5ea
0152ffa8 77e56c0a 000a9508 0152ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
0152ffb4 7c80b50b 00133fb8 00000000 00fd0178 RPCRT4!I_RpcBCacheFree+0x5d2
0152ffec 00000000 77e56bf0 00133fb8 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000152fe1c 99 e3 91 7c 03 67 e5 77 - 8c 01 00 00 70 ff 52 01 ...|.g.w....p.R.
000000000152fe2c 00 00 00 00 c8 70 14 00 - 4c ff 52 01 00 00 00 00 .....p..L.R.....
000000000152fe3c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe4c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152fe9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152feac 00 00 00 00 e8 48 9c 87 - 20 f0 a0 87 40 f5 df ff .....H.. ...@...
000000000152febc 69 cf 4d 80 ff ff ff ff - 02 02 00 00 38 ce 4d 80 i.M.........8.M.
000000000152fecc d0 4b 9f a9 8a bb 4f 80 - e8 48 9c 87 63 4f 70 80 .K....O..H..cOp.
000000000152fedc 00 00 00 00 88 4c 9f a9 - 06 41 70 80 00 00 00 00 .....L...Ap.....
000000000152feec e1 00 00 00 88 4c 9f a9 - 8a bb 4f 80 00 0d db ba .....L....O.....
000000000152fefc 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000152ff0c 00 00 00 00 00 00 00 00 - 00 00 00 00 38 f5 df ff ............8...
000000000152ff1c 8b cc 4d 80 00 48 9c 87 - 4f ca 4d 80 54 4a 9c 87 ..M..H..O.M.TJ..
000000000152ff2c e8 48 9c 87 80 ff 52 01 - 99 66 e5 77 4c ff 52 01 .H....R..f.wL.R.
000000000152ff3c a9 66 e5 77 ed 10 91 7c - 28 14 0e 00 b8 3f 13 00 .f.w...|(....?..
000000000152ff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff ../M.....]......

*----> Statusabbild für Threadkennung 0x62c <----*

eax=000011f8 ebx=00000518 ecx=00001110 edx=01757f00 esi=00b9ff98 edi=77d3ea45
eip=7c91eb94 esp=00b9ff54 ebp=00b9ff78 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\WINMM.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00b9ff78 76af4e3d 00b9ff98 00000000 00000000 ntdll!KiFastSystemCallRet
00b9ffb4 7c80b50b 00000518 00000200 0000002b WINMM!PlaySoundW+0x7e6
00b9ffec 00000000 76af4dd6 00000518 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000b9ff54 9b 91 d1 77 85 ea d3 77 - 98 ff b9 00 00 00 00 00 ...w...w........
0000000000b9ff64 00 00 00 00 00 00 00 00 - 18 05 00 00 45 ea d3 77 ............E..w
0000000000b9ff74 00 00 00 00 b4 ff b9 00 - 3d 4e af 76 98 ff b9 00 ........=N.v....
0000000000b9ff84 00 00 00 00 00 00 00 00 - 00 00 00 00 00 02 00 00 ................
0000000000b9ff94 2b 00 00 00 b0 00 02 00 - 19 02 00 00 07 00 00 00 +...............
0000000000b9ffa4 00 00 00 00 70 a1 00 00 - c7 03 00 00 0e 00 00 00 ....p...........
0000000000b9ffb4 ec ff b9 00 0b b5 80 7c - 18 05 00 00 00 02 00 00 .......|........
0000000000b9ffc4 2b 00 00 00 18 05 00 00 - 00 e0 fa 7f 00 d6 1e 8a +...............
0000000000b9ffd4 c0 ff b9 00 88 9d 94 87 - ff ff ff ff f3 99 83 7c ...............|
0000000000b9ffe4 18 b5 80 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 ...|............
0000000000b9fff4 d6 4d af 76 18 05 00 00 - 00 00 00 00 00 00 00 00 .M.v............
0000000000ba0004 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0014 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0044 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0054 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0064 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0074 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000ba0084 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> Statusabbild für Threadkennung 0x5a8 <----*

eax=00000000 ebx=000d9638 ecx=000d9638 edx=0193fce0 esi=000d964c edi=0193fce0
eip=75f48ea0 esp=0193fcac ebp=0193fcc4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\BROWSEUI.dll -
Funktion: BROWSEUI!Ordinal107
75f48e93 5e pop esi
75f48e94 5b pop ebx
75f48e95 5d pop ebp
75f48e96 c20800 ret 0x8
75f48e99 90 nop
75f48e9a 90 nop
75f48e9b 90 nop
75f48e9c 90 nop
75f48e9d 90 nop
75f48e9e 8bff mov edi,edi
75f48ea0 55 push ebp
75f48ea1 8bec mov ebp,esp
75f48ea3 51 push ecx
75f48ea4 53 push ebx
75f48ea5 56 push esi
75f48ea6 8bf1 mov esi,ecx
75f48ea8 57 push edi
75f48ea9 8dbe64010000 lea edi,[esi+0x164]
75f48eaf bb00000400 mov ebx,0x40000
75f48eb4 851f test [edi],ebx
75f48eb6 757e jnz BROWSEUI!Ordinal107+0x6477 (75f48f36)

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0193fca8 75f4c207 00000000 00000000 000d9638 BROWSEUI!Ordinal107+0x63e1
0193fcc4 75f4e892 000d964c 0193fce0 00000000 BROWSEUI!Ordinal107+0x9748
0193ff28 75f4ea19 00173578 00000000 00000000 BROWSEUI!Ordinal107+0xbdd3
0193ffb4 7c80b50b 00173578 00000000 00000000 BROWSEUI!Ordinal107+0xbf5a
0193ffec 00000000 75f4e9d5 00173578 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000193fcac 07 c2 f4 75 00 00 00 00 - 00 00 00 00 38 96 0d 00 ...u........8...
000000000193fcbc 00 00 00 00 01 00 00 00 - 28 ff 93 01 92 e8 f4 75 ........(......u
000000000193fccc 4c 96 0d 00 e0 fc 93 01 - 00 00 00 00 00 00 00 00 L...............
000000000193fcdc 78 35 17 00 34 01 01 00 - 00 02 00 00 00 00 00 00 x5..4...........
000000000193fcec 92 01 65 01 8a e3 00 00 - 16 03 00 00 4b 02 00 00 ..e.........K...
000000000193fcfc 03 00 00 00 02 00 00 00 - 38 96 0d 00 00 00 00 00 ........8.......
000000000193fd0c f6 00 03 00 10 9f 76 01 - 01 00 00 00 00 00 00 00 ......v.........
000000000193fd1c 57 00 69 00 6e 00 64 00 - 6f 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
000000000193fd2c 45 00 78 00 70 00 6c 00 - 6f 00 72 00 65 00 72 00 E.x.p.l.o.r.e.r.
000000000193fd3c 00 00 00 00 00 00 00 00 - b8 4f 17 00 00 00 00 00 .........O......
000000000193fd4c 9b 4a 70 80 00 0d db ba - 38 f5 df ff 00 00 00 00 .Jp.....8.......
000000000193fd5c 00 00 00 00 00 00 00 00 - 00 00 00 00 7e 33 2e e3 ............~3..
000000000193fd6c f0 cc 3c aa 10 00 3c aa - c8 7a 9b 87 a8 5d 98 87 ..<...<..z...]..
000000000193fd7c 01 00 00 00 90 ca 3c aa - 08 00 00 00 81 a8 55 80 ......<.......U.
000000000193fd8c 38 75 71 f7 46 02 00 00 - f0 cc 3c aa a8 5d 98 87 8uq.F.....<..]..
000000000193fd9c 18 08 95 87 40 75 71 f7 - 60 8f 79 01 f0 cc 3c aa ....@uq.`.y...<.
000000000193fdac 46 02 00 00 0d cd 4d 80 - b4 ca 3c aa a8 5d 98 87 F.....M...<..]..
000000000193fdbc 00 00 00 00 38 00 00 00 - 44 9e d1 77 80 02 d7 77 ....8...D..w...w
000000000193fdcc 00 00 00 00 00 00 00 00 - 78 35 17 00 00 00 00 00 ........x5......
000000000193fddc 1c 00 fb 7f d5 e9 f4 75 - 00 00 00 00 56 08 81 7c .......u....V..|

*----> Statusabbild für Threadkennung 0x700 <----*

eax=00000000 ebx=019efde8 ecx=01771010 edx=00000062 esi=00000000 edi=7ffde000
eip=7c91eb94 esp=019efdc0 ebp=019efe5c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

Funktion: ntdll!KiFastSystemCallRet
7c91eb89 90 nop
7c91eb8a 90 nop
ntdll!KiFastSystemCall:
7c91eb8b 8bd4 mov edx,esp
7c91eb8d 0f34 sysenter
7c91eb8f 90 nop
7c91eb90 90 nop
7c91eb91 90 nop
7c91eb92 90 nop
7c91eb93 90 nop
ntdll!KiFastSystemCallRet:
7c91eb94 c3 ret
7c91eb95 8da42400000000 lea esp,[esp]
7c91eb9c 8d642400 lea esp,[esp]
7c91eba0 90 nop
7c91eba1 90 nop
7c91eba2 90 nop
7c91eba3 90 nop
7c91eba4 90 nop
ntdll!KiIntSystemCall:
7c91eba5 8d542408 lea edx,[esp+0x8]
7c91eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\DUSER.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\msvcrt.dll -
ChildEBP RetAddr Args to Child
019efe5c 77d1bbfe 00000002 019efe84 00000000 ntdll!KiFastSystemCallRet
019efeb8 6c6a4b92 00000001 019efeec ffffffff USER32!SetWindowTextW+0x120
019efed8 6c6a4ddc 000004ff ffffffff 00000001 DUSER+0x34b92
019eff0c 6c69e394 019eff4c 00000000 00000000 DUSER+0x34ddc
019eff2c 6c69a6f1 019eff4c 00000000 00000000 DUSER!GetMessageExA+0x44
019eff80 77c0a3b0 00000000 7c920000 7c9231dc DUSER!DUserStopAnimation+0xa505
019effb4 7c80b50b 0003bd20 7c920000 7c9231dc msvcrt!endthreadex+0xa9
019effec 00000000 77c0a341 0003bd20 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
00000000019efdc0 ab e9 91 7c f2 94 80 7c - 02 00 00 00 e8 fd 9e 01 ...|...|........
00000000019efdd0 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000000019efde0 02 00 00 00 04 00 00 00 - 0c 06 00 00 98 05 00 00 ................
00000000019efdf0 56 00 01 01 00 01 00 00 - 00 02 00 00 00 20 d4 01 V............ ..
00000000019efe00 40 fe 9e 01 b1 a2 68 6c - 14 00 00 00 01 00 00 00 @.....hl........
00000000019efe10 00 00 00 00 00 00 00 00 - 10 00 00 00 00 20 d4 01 ............. ..
00000000019efe20 01 00 04 00 00 00 00 00 - 00 e0 fd 7f 00 70 fa 7f .............p..
00000000019efe30 a4 ff 9e 01 00 00 00 00 - e8 fd 9e 01 ff ff ff ff ................
00000000019efe40 02 00 00 00 dc fd 9e 01 - 00 20 d4 01 a4 ff 9e 01 ......... ......
00000000019efe50 f3 99 83 7c 90 95 80 7c - 00 00 00 00 b8 fe 9e 01 ...|...|........
00000000019efe60 fe bb d1 77 02 00 00 00 - 84 fe 9e 01 00 00 00 00 ...w............
00000000019efe70 ff ff ff ff 00 00 00 00 - b8 a8 79 01 01 00 00 00 ..........y.....
00000000019efe80 4c ff 9e 01 0c 06 00 00 - 98 05 00 00 8e 72 6a 6c L............rjl
00000000019efe90 ff ff ff ff a9 72 6a 6c - 2e 63 00 00 08 10 77 01 .....rjl.c....w.
00000000019efea0 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000000019efeb0 00 70 fa 7f 98 05 00 00 - d8 fe 9e 01 92 4b 6a 6c .p...........Kjl
00000000019efec0 01 00 00 00 ec fe 9e 01 - ff ff ff ff ff 04 00 00 ................
00000000019efed0 84 fe 9e 01 ff ff ff ff - 0c ff 9e 01 dc 4d 6a 6c .............Mjl
00000000019efee0 ff 04 00 00 ff ff ff ff - 01 00 00 00 0c 06 00 00 ................
00000000019efef0 00 00 00 00 00 00 00 00 - 20 bd 03 00 01 00 00 00 ........ .......

*----> Statusabbild für Threadkennung 0x3c8 <----*

eax=8b55ff8b ebx=00090000 ecx=23400025 edx=23400026 esi=00090718 edi=00000003
eip=7c912f17 esp=00f1fbe4 ebp=00090718 iopl=0 nv up ei ng nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000286

Funktion: ntdll!tan
7c912f04 90 nop
7c912f05 90 nop
7c912f06 53 push ebx
7c912f07 55 push ebp
7c912f08 8be9 mov ebp,ecx
7c912f0a 8b5504 mov edx,[ebp+0x4]
7c912f0d 8b4500 mov eax,[ebp]
7c912f10 0bc0 or eax,eax
7c912f12 740c jz ntdll!tan+0xe2 (7c912f20)
7c912f14 8d4aff lea ecx,[edx-0x1]
FEHLER ->7c912f17 8b18 mov ebx,[eax] ds:0023:8b55ff8b=?
7c912f19 f00fc74d00 lock cmpxchg8b qword ptr [ebp]
7c912f1e 75f0 jnz ntdll!tan+0xd2 (7c912f10)
7c912f20 5d pop ebp
7c912f21 5b pop ebx
7c912f22 c3 ret
7c912f23 8d4900 lea ecx,[ecx]
7c912f26 8f0424 pop [esp]
7c912f29 90 nop
7c912f2a 90 nop
7c912f2b 90 nop

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
00090718 23400026 01000037 000024aa 0000018f ntdll!tan+0xd9
8b55ff8b 00000000 00000000 00000000 00000000 0x23400026

*----> Raw Stack Dump <----*
0000000000f1fbe4 18 fc f1 00 00 00 09 00 - 1e 07 92 7c 03 00 00 00 ...........|....
0000000000f1fbf4 18 07 09 00 00 00 09 00 - e8 0c 09 00 f0 fb f1 00 ................
0000000000f1fc04 60 0d 77 01 34 fe f1 00 - 18 ee 91 7c 38 07 92 7c `.w.4......|8..|
0000000000f1fc14 00 00 00 00 44 fe f1 00 - ab 06 92 7c 18 07 09 00 ....D......|....
0000000000f1fc24 00 00 00 00 d8 b3 6d 02 - 00 00 00 00 d0 b3 6d 02 ......m.......m.
0000000000f1fc34 00 00 bc 01 94 8e 92 7c - 50 fc f1 00 87 8f 92 7c .......|P......|
0000000000f1fc44 00 50 fd 7f 00 e0 fd 7f - 00 00 00 00 14 00 00 00 .P..............
0000000000f1fc54 01 00 00 00 00 00 00 00 - 90 b5 79 01 00 00 00 00 ..........y.....
0000000000f1fc64 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000f1fc74 00 00 00 00 00 00 00 00 - 00 e0 fd 7f 00 00 00 00 ................
0000000000f1fc84 a4 1e 19 00 44 fc f1 00 - 00 00 00 00 08 fd f1 00 ....D...........
0000000000f1fc94 18 ee 91 7c d0 8e 92 7c - ff ff ff ff 74 8e 92 7c ...|...|....t..|
0000000000f1fca4 c4 e8 91 7c fa 8d 92 7c - 2c fd f1 00 04 00 00 00 ...|...|,.......
0000000000f1fcb4 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000f1fcc4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000f1fcd4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000f1fce4 00 00 00 00 00 50 fd 7f - 00 00 00 00 00 00 00 00 .....P..........
0000000000f1fcf4 00 00 00 00 00 00 00 00 - 00 00 00 00 ac fc f1 00 ................
0000000000f1fd04 00 00 00 00 ff ff ff ff - 18 ee 91 7c 00 8e 92 7c ...........|...|
0000000000f1fd14 ff ff ff ff fa 8d 92 7c - 25 d6 91 7c cf ea 91 7c .......|%..|...|


Ich hab keine Ahnung was des zu bedeuten hat. Please help. Was sind den das für Fehlermeldungen?

Dieser Beitrag wurde von Webbert bearbeitet: 03. Juli 2007 - 13:22

[DK2000]

Ja, das Meiste davon ist technischer Kram, der erst einmal nicht weiter interessiert. Der interessante Teil ist im Header der beiden Logs versteckt:

1: Ausnahmenummer: c0000006 (Serien E/A-Fehler) oder STATUS_IN_PAGE_ERROR

2: Ausnahmenummer: c0000005 (Zugriffsverletzung) oder STATUS_ACCESS_ VIOLATION

Der erste Fehler sagt aus, dass eine ausgelagerte Speicherseite nicht eingelagert werden konnte bzw. es gab überhaupt Probleme, den Code in den Speicher zu laden,, während D:\autorun.exe leif. Der Grund dafür ist meistens Probleme mit der Festplatte, den Treiber für den Controller, Kabel etc. oder Probleme mit der CPU, Memory Controller oder Speicher. So ein Serien E/A-Fehler hinterlässt eigentlich auch jede Menge in der Ereignisanzeige (meist von der Quelle disk, atapi oder <Treibername vom Controller>).

Der zweite Fehler ist eine ordinäre Zugriffsverletzung, die meist daruch ausgelöst wird, das irgend etwas im Speicher auf eine Art und Weise rumwuselt, wie es nicht sein sollte oder einfach nur ins Leere geht. Letzteres dürfte hier eher der Fall sein. Wenn das immer nur auftritt, wenn Du einen Ordner mit Medieninhalten öffnest, dann liegt das bestimmt an einem defekten/inkompatiblem Audio/Video Codec.

Was mir allerdings auffällt, beide Fehler sind relativ alt (7.6. und 24.06). Von den aktuellen Fehlern steht da nichts, kann aber daran leigen, das DrWatson selber abstürtzt und somit nichts mehr aufzeichnen kann.

Wenn diese Fehler auftreten, hast Du schon einmal auf das blaue "Klicken sie hier" gecklickt? Da müsste dann auch etwas von Ausnahmenummer und Modulen stehen (eventuell noch auf Erweitert gehen).

Dieser Beitrag wurde von DK2000 bearbeitet: 03. Juli 2007 - 14:21