locked
crashing/freezing RRS feed

  • Question

  • I have been fighting with crashing/freezing issues for a while now. I have tried to repair Windows (didn't work), did a full reinstall of Windows (hasn't helped), checked the files using the install disc (didn't help). Anyway, I was running Dr. Watson when it crashed again today and it came up the WGA.exe that caused the crash. I ran the diagnostics that were here in a sticky and here is the info.

    Diagnostic Report (1.7.0012.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Genuine
    Detailed Status: N/A
    Windows Product Key: *****-*****-QKXMW-VVM37-3V8BB
    Windows Product Key Hash: +EGhhQliZPojIaymV6fRGFP75l0=
    Windows Product ID: 76477-OEM-2159864-56960
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 5.1.2600.2.00010300.2.0.hom
    ID: f9ca22cf-9019-4252-b481-63a04e507e6b
    Is Admin: Yes
    AutoDial:
    Registry: 0x0
    WGA Version: Registered, 1.7.17.0
    Signed By: Microsoft
    Product Name: N/A
    Architecture: N/A
    Build lab: N/A
    TTS Error: N/A
    Validation Diagnostic:
    Resolution Status: N/A

    Notifications Data-->
    Cached Result: 0
    File Exists: Yes
    Version: 1.7.17.0
    WgaTray.exe Signed By: Microsoft
    WgaLogon.dll Signed By: Microsoft

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: Registered, 1.6.21.0
    Signed By: Microsoft
    Office Diagnostics: B4D0AA8B-469-80070002

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\PROGRA~1\MOZILL~1\FIREFOX.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>f9ca22cf-9019-4252-b481-63a04e507e6b</UGUID><Version>1.7.0012.0</Version><OS>5.1.2600.2.00010300.2.0.hom</OS><PKey>*****-*****-*****-*****-3V8BB</PKey><PID>76477-OEM-2159864-56960</PID><PIDType>3</PIDType><SID>S-1-5-21-842925246-1425521274-725345543</SID><SYSTEM><Manufacturer>NVIDIA</Manufacturer><Model>AWRDACPI</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="2"/><Date>20040804000000.000000+000</Date></BIOS><HWID>5A92306F0184605B</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/></MachineData>   <Software><Office><Result>109</Result><Products/></Office></Software></GenuineResults> 

     

     

    Tuesday, April 3, 2007 12:33 PM

Answers

  • Hi girlfreddy,

     

      Would you post the Dr. Watson output?

     

    Thank you,

    Darin Smith

    WGA Forum Program Manager

    --------------------------------------------------------
    All Users: Please go to http://forums.microsoft.com/Genuine/ShowPost.aspx?PostID=1255325&SiteID=25 before posting a question.

    --------------------------------------------------------

     

     

    Wednesday, April 4, 2007 1:00 AM
  • Here it is. There was only one crash listed. (I added the next crash from Tuesday morning so there's two now.)

     


    Microsoft (R) DrWtsn32
    Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.

     

    Application exception occurred:
            App: C:\WINDOWS\system32\WgaTray.exe (pid=2788)
            When: 4/3/2007 @ 22:00:34.906
            Exception number: c0000005 (access violation)

    *----> System Information <----*
            Computer Name: HOME
            User Name: helene
            Terminal Session Id: 0
            Number of Processors: 1
            Processor Type: x86 Family 6 Model 8 Stepping 1
            Windows Version: 5.1
            Current Build: 2600
            Service Pack: 2
            Current Type: Uniprocessor Free
            Registered Organization: home
            Registered Owner: Helene McKenzie

    *----> Task List <----*
       0 System Process
       4 System
     456 smss.exe
     528 csrss.exe
     552 winlogon.exe
     596 services.exe
     608 lsass.exe
     760 svchost.exe
     820 svchost.exe
     884 svchost.exe
     912 InCDsrv.exe
    1060 svchost.exe
    1088 svchost.exe
    1344 spoolsv.exe
    1528 Explorer.EXE
    1692 Error 0xD0000022
    1712 avgamsvr.exe
    1724 InCD.exe
    1752 avgcc.exe
    1796 Error 0xD0000022
    1812 avgupsvc.exe
    1848 jusched.exe
    1872 avgemc.exe
    1880 HPWuSchd2.exe
    1924 Error 0xD0000022
    1944 RUNDLL32.EXE
    1972 RunDll32.exe
    1992 avgas.exe
    2028 ctfmon.exe
     144 nvsvc32.exe
     208 HPZipm12.exe
     244 svchost.exe
     348 reader_sl.exe
     308 QuickDCF.exe
     492 hpqtra08.exe
     572 soffice.exe
     752 soffice.BIN
    2116 hpqSTE08.exe
    2456 alg.exe
    2780 firefox.exe
    2788 WgaTray.exe
    2832 svchost.exe
    2984 wmiprvse.exe
    3120 dwwin.exe
    3136 wuauclt.exe
    3284 wuauclt.exe
    3344 drwtsn32.exe

    *----> Module List <----*
    (0000000000400000 - 0000000000409000: C:\WINDOWS\system32\Normaliz.dll
    (0000000001000000 - 0000000001052000: C:\WINDOWS\system32\WgaTray.exe
    (0000000001280000 - 00000000013e9000: C:\WINDOWS\system32\legitcheckcontrol.dll
    (000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
    (0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
    (000000004d4f0000 - 000000004d548000: C:\WINDOWS\system32\WINHTTP.dll
    (000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
    (000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\netapi32.dll
    (000000006e850000 - 000000006e895000: C:\WINDOWS\system32\iertutil.dll
    (0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
    (0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\ws2_32.dll
    (00000000722b0000 - 00000000722b5000: C:\WINDOWS\system32\SensApi.dll
    (0000000074720000 - 000000007476b000: C:\WINDOWS\system32\MSCTF.dll
    (0000000074980000 - 0000000074a8e000: C:\WINDOWS\system32\msxml3.dll
    (0000000074ed0000 - 0000000074ede000: C:\WINDOWS\system32\wbem\wbemsvc.dll
    (0000000074ef0000 - 0000000074ef8000: C:\WINDOWS\system32\wbem\wbemprox.dll
    (0000000075290000 - 00000000752c7000: C:\WINDOWS\system32\wbem\wbemcomn.dll
    (0000000075690000 - 0000000075706000: C:\WINDOWS\system32\wbem\fastprox.dll
    (0000000075e60000 - 0000000075e73000: C:\WINDOWS\system32\cryptnet.dll
    (0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
    (0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP60.dll
    (0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL
    (00000000767a0000 - 00000000767b3000: C:\WINDOWS\system32\NTDSAPI.dll
    (00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\userenv.dll
    (0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WinTrust.dll
    (0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
    (0000000076f20000 - 0000000076f47000: C:\WINDOWS\system32\DNSAPI.dll
    (0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
    (0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
    (0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
    (0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
    (00000000771b0000 - 000000007727f000: C:\WINDOWS\system32\WININET.dll
    (00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll
    (00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
    (0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
    (0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
    (0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
    (0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
    (0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
    (0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
    (0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
    (0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
    (0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
    (0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll
    (0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
    (0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\secur32.dll
    (000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
    (000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
    (000000007c9c0000 - 000000007d1d5000: C:\WINDOWS\system32\SHELL32.dll

    *----> State Dump for Thread Id 0xae8 <----*

    eax=000007de ebx=4c7455e0 ecx=d713e26d edx=54c7455e esi=8ff34781 edi=4ed26fca
    eip=01640380 esp=0006e95c ebp=0006e9ac iopl=0         nv up ei pl nz na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

    function: <nosymbols>
            01640363 3d8b7de8c7       cmp     eax,0xc7e87d8b
            01640368 45               inc     ebp
            01640369 d420             aam     ???
            0164036b 0000             add     [eax],al
            0164036d 00897de88bfa     add     [ecx+0xfa8be87d],cl
            01640373 c1ef05           shr     edi,0x5
            01640376 8bda             mov     ebx,edx
            01640378 c1e304           shl     ebx,0x4
            0164037b 33fb             xor     edi,ebx
            0164037d ff4dd4           dec     dword ptr [ebp-0x2c]
    FAULT ->01640380 8bde             mov     ebx,esi
            01640382 c1eb0b           shr     ebx,0xb
            01640385 83e303           and     ebx,0x3
            01640388 8b5c9dec         mov     ebx,[ebp+ebx*4-0x14]
            0164038c 03de             add     ebx,esi
            0164038e 2b75e8           sub     esi,[ebp-0x18]
            01640391 03fa             add     edi,edx
            01640393 33fb             xor     edi,ebx
            01640395 2bcf             sub     ecx,edi
            01640397 8bf9             mov     edi,ecx
            01640399 c1ef05           shr     edi,0x5

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\legitcheckcontrol.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\OLEAUT32.dll -
    *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\WgaTray.exe
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
    ChildEBP RetAddr  Args to Child             
    0006e9ac 01630aa9 0006e9c0 01282ec4 00000000 0x1640380
    0006ebcc 012b0781 0006f198 01282ec4 00000000 0x1630aa9
    0006efe8 012a86b4 0006f01c 00000104 01282ec4 legitcheckcontrol+0x30781
    0006f124 012a9341 009d9168 00000003 013f37fc legitcheckcontrol+0x286b4
    0006f150 0129adf4 00000001 00000001 00000000 legitcheckcontrol+0x29341
    0006fad8 771273d0 013f37f0 0006fb38 0006fbf8 legitcheckcontrol+0x1adf4
    0006faf4 771279e0 013f37f0 0000001c 00000004 OLEAUT32!DispCallFunc+0xc3
    0006fb84 0129bac0 000c2eec 013f37f0 00000000 OLEAUT32!DispCallFunc+0x6d3
    0006fbb0 01009999 013f37f0 00000001 01002df0 legitcheckcontrol+0x1bac0
    0006fc48 0100aea8 0006fc74 0006fc88 0006fc90 WgaTray+0x9999
    0006feb4 0100bd0b 01043020 02fac500 01043024 WgaTray+0xaea8
    0006ff10 0100dc03 01000000 00000000 0002061a WgaTray+0xbd0b
    0006ffa8 0103004b 00de6c38 016ef944 7ffdf000 WgaTray+0xdc03
    0006ffc0 7c816fd7 00de6c38 016ef944 7ffdf000 WgaTray+0x3004b
    0006fff0 00000000 0102ffd4 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

    *----> Raw Stack Dump <----*
    000000000006e95c  98 f1 06 00 04 01 00 00 - 00 00 00 00 28 0a 00 00  ............(...
    000000000006e96c  02 00 00 00 30 48 3f 01 - 01 00 00 00 00 00 00 00  ....0H?.........
    000000000006e97c  05 00 00 00 08 00 00 00 - 04 04 00 00 00 00 65 01  ..............e.
    000000000006e98c  08 04 00 00 6d 11 00 00 - b9 79 37 9e 12 98 ef 6b  ....m....y7....k
    000000000006e99c  12 c5 cc e4 98 42 71 08 - 96 ee d2 3e e1 3d 06 00  .....Bq....>.=..
    000000000006e9ac  cc eb 06 00 a9 0a 63 01 - c0 e9 06 00 c4 2e 28 01  ......c.......(.
    000000000006e9bc  00 00 00 00 43 3a 5c 57 - 49 4e 44 4f 57 53 5c 73  ....C:\WINDOWS\s
    000000000006e9cc  79 73 74 65 6d 33 32 5c - 4f 45 4d 42 49 4f 53 2e  ystem32\OEMBIOS.
    000000000006e9dc  44 41 54 00 00 00 00 00 - 00 00 00 00 00 00 00 00  DAT.............
    000000000006e9ec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006e9fc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea2c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea3c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea4c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea5c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea6c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea7c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea8c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb5c <----*

    eax=00000000 ebx=003efed0 ecx=003eff7c edx=00000000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=003efea8 ebp=003eff44 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    003eff44 77df9b26 00000002 003eff6c 00000000 ntdll!KiFastSystemCallRet
    003effb4 7c80b683 00000000 7c9140bb 00000000 ADVAPI32!RegDeleteKeyW+0x2a2
    003effec 00000000 77df9981 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000003efea8  ab e9 90 7c e2 94 80 7c - 02 00 00 00 d0 fe 3e 00  ...|...|......>.
    00000000003efeb8  01 00 00 00 01 00 00 00 - 04 ff 3e 00 e0 2e 82 00  ..........>.....
    00000000003efec8  40 65 e4 77 00 10 00 00 - 5c 00 00 00 68 00 00 00  @e.w....\...h...
    00000000003efed8  c0 fe 3e 00 ec 7b fe f2 - dc ff 3e 00 a8 9a 83 7c  ..>..{....>....|
    00000000003efee8  b0 0a 81 7c 00 10 00 00 - 14 00 00 00 01 00 00 00  ...|............
    00000000003efef8  00 00 00 00 00 00 00 00 - 10 00 00 00 00 a2 2f 4d  ............../M
    00000000003eff08  ff ff ff ff 00 10 00 00 - 00 f0 fd 7f 00 d0 fd 7f  ................
    00000000003eff18  dc ff 3e 00 04 ff 3e 00 - d0 fe 3e 00 06 00 00 00  ..>...>...>.....
    00000000003eff28  02 00 00 00 c4 fe 3e 00 - 06 00 00 00 dc ff 3e 00  ......>.......>.
    00000000003eff38  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 b4 ff 3e 00  ...|...|......>.
    00000000003eff48  26 9b df 77 02 00 00 00 - 6c ff 3e 00 00 00 00 00  &..w....l.>.....
    00000000003eff58  e0 93 04 00 01 00 00 00 - bb 40 91 7c 00 00 00 00  .........@.|....
    00000000003eff68  00 00 00 00 5c 00 00 00 - 68 00 00 00 00 10 00 00  ....\...h.......
    00000000003eff78  e0 2e 82 00 00 00 00 00 - 00 10 00 00 e8 3e 82 00  .............>..
    00000000003eff88  a0 66 e4 77 28 00 00 00 - 80 66 e4 77 00 10 00 00  .f.w(....f.w....
    00000000003eff98  00 00 00 00 a0 66 e4 77 - e0 2e 82 00 80 66 e4 77  .....f.w.....f.w
    00000000003effa8  e5 03 00 00 00 10 00 00 - e8 3e 82 00 ec ff 3e 00  .........>....>.
    00000000003effb8  83 b6 80 7c 00 00 00 00 - bb 40 91 7c 00 00 00 00  ...|.....@.|....
    00000000003effc8  00 00 00 00 00 d0 fd 7f - 00 46 3c 82 c0 ff 3e 00  .........F<...>.
    00000000003effd8  e0 9a d6 81 ff ff ff ff - a8 9a 83 7c 90 b6 80 7c  ...........|...|

    *----> State Dump for Thread Id 0xb64 <----*

    eax=000000c0 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
    eip=7c90eb94 esp=010dfcec ebp=010dffb4 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    010dffb4 7c80b683 00000000 00090000 00000000 ntdll!KiFastSystemCallRet
    010dffec 00000000 7c929fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000010dfcec  ab e9 90 7c d5 a0 92 7c - 14 00 00 00 30 fd 0d 01  ...|...|....0...
    00000000010dfcfc  01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 09 00  ................
    00000000010dfd0c  00 00 00 00 00 00 00 00 - 08 e5 97 7c 08 e5 97 7c  ...........|...|
    00000000010dfd1c  c4 01 00 00 64 0b 00 00 - 14 00 00 00 14 00 00 00  ....d...........
    00000000010dfd2c  13 00 00 00 bc 01 00 00 - 44 00 00 00 00 02 00 00  ........D.......
    00000000010dfd3c  10 02 00 00 2c 02 00 00 - 38 02 00 00 44 02 00 00  ....,...8...D...
    00000000010dfd4c  74 02 00 00 78 02 00 00 - 80 02 00 00 8c 02 00 00  t...x...........
    00000000010dfd5c  94 02 00 00 a0 02 00 00 - ac 02 00 00 b8 02 00 00  ................
    00000000010dfd6c  c0 02 00 00 cc 02 00 00 - d8 02 00 00 e4 02 00 00  ................
    00000000010dfd7c  ec 02 00 00 2c 04 00 00 - 38 04 00 00 44 04 00 00  ....,...8...D...
    00000000010dfd8c  50 04 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  P...............
    00000000010dfd9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdac  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdcc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfddc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdfc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb68 <----*

    eax=769c8831 ebx=0111fef4 ecx=0006f1cc edx=0006f480 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=0111fecc ebp=0111ff68 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\userenv.dll -
    ChildEBP RetAddr  Args to Child             
    0111ff68 7c80a075 00000003 76a60310 00000000 ntdll!KiFastSystemCallRet
    0111ff84 769c888d 00000003 76a60310 00000000 kernel32!WaitForMultipleObjects+0x18
    0111ffb4 7c80b683 00000000 00000000 00000000 userenv!UnregisterGPNotification+0x15c
    0111ffec 00000000 769c8831 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000111fecc  ab e9 90 7c e2 94 80 7c - 03 00 00 00 f4 fe 11 01  ...|...|........
    000000000111fedc  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111feec  b8 03 a6 76 47 9b 80 7c - 14 02 00 00 18 02 00 00  ...vG..|........
    000000000111fefc  1c 02 00 00 5c fe 11 01 - 6c ff 11 01 6c ff 11 01  ....\...l...l...
    000000000111ff0c  18 ee 90 7c 70 05 91 7c - 14 00 00 00 01 00 00 00  ...|p..|........
    000000000111ff1c  00 00 00 00 00 00 00 00 - 10 00 00 00 f6 1b 80 7c  ...............|
    000000000111ff2c  00 00 00 00 00 00 00 00 - 00 f0 fd 7f 00 a0 fd 7f  ................
    000000000111ff3c  48 f8 0b 00 00 00 00 00 - f4 fe 11 01 00 00 00 00  H...............
    000000000111ff4c  03 00 00 00 e8 fe 11 01 - 00 00 00 00 dc ff 11 01  ................
    000000000111ff5c  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 84 ff 11 01  ...|...|........
    000000000111ff6c  75 a0 80 7c 03 00 00 00 - 10 03 a6 76 00 00 00 00  u..|.......v....
    000000000111ff7c  ff ff ff ff 00 00 00 00 - b4 ff 11 01 8d 88 9c 76  ...............v
    000000000111ff8c  03 00 00 00 10 03 a6 76 - 00 00 00 00 ff ff ff ff  .......v........
    000000000111ff9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 9c 76  ...............v
    000000000111ffac  03 00 00 00 00 00 00 00 - ec ff 11 01 83 b6 80 7c  ...............|
    000000000111ffbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111ffcc  00 a0 fd 7f 00 46 3c 82 - c0 ff 11 01 18 f6 e1 81  .....F<.........
    000000000111ffdc  ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00  .......|...|....
    000000000111ffec  00 00 00 00 00 00 00 00 - 31 88 9c 76 00 00 00 00  ........1..v....
    000000000111fffc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb6c <----*

    eax=77e76bf0 ebx=00000000 ecx=00000009 edx=7c910732 esi=00108888 edi=00000100
    eip=7c90eb94 esp=0156fe1c ebp=0156ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0156ff80 77e76c22 0156ffa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    0156ff88 77e76a3b 00108888 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5ea
    0156ffa8 77e76c0a 000a77d0 0156ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0156ffb4 7c80b683 000ba3a0 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5d2
    0156ffec 00000000 77e76bf0 000ba3a0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000156fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 56 01  ...|.g.w....p.V.
    000000000156fe2c  00 00 00 00 70 b9 10 00 - 54 ff 56 01 c2 4e b1 3b  ....p...T.V..N.;
    000000000156fe3c  7d cb 1c 3c 25 ca 5e 3c - 66 9f c7 3b 32 c7 f2 3b  }..<%.^<f..;2..;
    000000000156fe4c  5f 26 0a 3c 25 94 be 3b - 8c 2c 19 3c 77 4e b3 3b  _&.<%..;.,.<wN.;
    000000000156fe5c  52 f2 ea 3b 79 23 f3 3b - ef 3c 71 3b 7f 83 f6 3b  R..;y#.;.<q;...;
    000000000156fe6c  7c 0f 97 3b 7e a7 c9 3b - 1f 6a 5b 3b cc 43 a6 3b  |..;~..;.j[;.C.;
    000000000156fe7c  56 0d c2 3b bf 29 ac 3b - 76 6b 99 3b b7 2a 09 3b  V..;.).;vk.;.*.;
    000000000156fe8c  00 00 00 00 98 a6 88 3c - 02 4b 2e 3c 7f 31 37 3f  .......<.K.<.17?
    000000000156fe9c  e6 04 ed 3c 6e 4d 3a 3c - a4 17 35 3c 6a fa ec 3b  ...<nM:<..5<j..;
    000000000156feac  59 fc 26 3c 93 1e 86 3b - ea 76 76 3c 76 8b 40 3c  Y.&<...;.vv<v.@<
    000000000156febc  f1 64 b7 3c 19 ca 09 3c - b2 f2 4b 3c 11 e0 f4 3b  .d.<...<..K<...;
    000000000156fecc  50 89 6b 3b 46 ee e9 3b - 57 ed 9a 3c e7 53 c7 3b  P.k;F..;W..<.S.;
    000000000156fedc  5e 66 58 3b d1 5c 27 3c - 20 08 10 3c 93 8a c6 3c  ^fX;.\'< ..<...<
    000000000156feec  0c 21 67 3c 3e 25 67 3c - ea cd 28 3c 30 62 1f 3c  .!g<>%g<..(<0b.<
    000000000156fefc  88 0e 01 3c 71 3c 1f 3c - 1b 49 02 3c ea 42 ac 3c  ...<q<.<.I.<.B.<
    000000000156ff0c  f0 df bc 3b fe 0a 19 3c - b4 84 c1 81 24 cc a2 f2  ...;...<....$...
    000000000156ff1c  b2 c2 4d 80 ba c2 4d 80 - 84 84 c1 81 18 83 c1 81  ..M...M.........
    000000000156ff2c  4c 83 c1 81 80 ff 56 01 - 99 66 e7 77 4c ff 56 01  L.....V..f.wL.V.
    000000000156ff3c  a9 66 e7 77 ed 10 90 7c - 00 75 10 00 a0 a3 0b 00  .f.w...|.u......
    000000000156ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xb70 <----*

    eax=774fe429 ebx=00007530 ecx=7ffdf000 edx=00000000 esi=00000000 edi=015aff50
    eip=7c90eb94 esp=015aff20 ebp=015aff78 iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
    ChildEBP RetAddr  Args to Child             
    015aff78 7c802451 0000ea60 00000000 015affb4 ntdll!KiFastSystemCallRet
    015aff88 774fe31d 0000ea60 0010f4d8 774fe3dc kernel32!Sleep+0xf
    015affb4 7c80b683 0010f4d8 7c910945 7c91094e ole32!StringFromGUID2+0x51b
    015affec 00000000 774fe429 0010f4d8 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015aff20  5c d8 90 7c ed 23 80 7c - 00 00 00 00 50 ff 5a 01  \..|.#.|....P.Z.
    00000000015aff30  40 25 80 7c f8 6d 60 77 - 30 75 00 00 14 00 00 00  @%.|.m`w0u......
    00000000015aff40  01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00  ................
    00000000015aff50  00 ba 3c dc ff ff ff ff - 00 d1 4e 77 50 ff 5a 01  ..<.......NwP.Z.
    00000000015aff60  30 ff 5a 01 20 53 10 00 - dc ff 5a 01 a8 9a 83 7c  0.Z. S....Z....|
    00000000015aff70  58 24 80 7c 00 00 00 00 - 88 ff 5a 01 51 24 80 7c  X$.|......Z.Q$.|
    00000000015aff80  60 ea 00 00 00 00 00 00 - b4 ff 5a 01 1d e3 4f 77  `.........Z...Ow
    00000000015aff90  60 ea 00 00 d8 f4 10 00 - dc e3 4f 77 00 00 00 00  `.........Ow....
    00000000015affa0  45 09 91 7c d8 f4 10 00 - 00 00 4e 77 44 e4 4f 77  E..|......NwD.Ow
    00000000015affb0  4e 09 91 7c ec ff 5a 01 - 83 b6 80 7c d8 f4 10 00  N..|..Z....|....
    00000000015affc0  45 09 91 7c 4e 09 91 7c - d8 f4 10 00 00 80 fd 7f  E..|N..|........
    00000000015affd0  00 46 3c 82 c0 ff 5a 01 - b0 f0 16 82 ff ff ff ff  .F<...Z.........
    00000000015affe0  a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00  ...|...|........
    00000000015afff0  00 00 00 00 29 e4 4f 77 - d8 f4 10 00 00 00 00 00  ....).Ow........
    00000000015b0000  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0010  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0020  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0030  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0040  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0050  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb78 <----*

    eax=77e76bf0 ebx=00000000 ecx=0156faac edx=7c809740 esi=00108888 edi=00000100
    eip=7c90eb94 esp=015efe1c ebp=015eff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    015eff80 77e76c22 015effa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    015eff88 77e76a3b 00108888 00000040 0156fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    015effa8 77e76c0a 000a77d0 015effec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    015effb4 7c80b683 000ef7b0 00000040 0156fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    015effec 00000000 77e76bf0 000ef7b0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015efe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 5e 01  ...|.g.w....p.^.
    00000000015efe2c  00 00 00 00 08 bd 10 00 - 54 ff 5e 01 6c 00 79 00  ........T.^.l.y.
    00000000015efe3c  20 00 63 00 72 00 65 00 - 61 00 74 00 65 00 64 00   .c.r.e.a.t.e.d.
    00000000015efe4c  2e 00 2c 00 45 00 72 00 - 72 00 6f 00 72 00 20 00  ..,.E.r.r.o.r. .
    00000000015efe5c  25 00 64 00 20 00 74 00 - 6f 00 20 00 63 00 6f 00  %.d. .t.o. .c.o.
    00000000015efe6c  70 00 79 00 20 00 74 00 - 68 00 65 00 20 00 64 00  p.y. .t.h.e. .d.
    00000000015efe7c  65 00 66 00 61 00 75 00 - 6c 00 74 00 20 00 74 00  e.f.a.u.l.t. .t.
    00000000015efe8c  65 00 6d 00 70 00 6c 00 - 61 00 74 00 65 00 20 00  e.m.p.l.a.t.e. .
    00000000015efe9c  74 00 6f 00 20 00 25 00 - 73 00 2e 00 20 00 45 00  t.o. .%.s... .E.
    00000000015efeac  72 00 72 00 6f 00 72 00 - 20 00 25 00 64 00 20 00  r.r.o.r. .%.d. .
    00000000015efebc  74 00 6f 00 20 00 63 00 - 72 00 65 00 61 00 74 00  t.o. .c.r.e.a.t.
    00000000015efecc  65 00 20 00 64 00 69 00 - 72 00 65 00 63 00 74 00  e. .d.i.r.e.c.t.
    00000000015efedc  6f 00 72 00 79 00 20 00 - 25 00 73 00 2e 00 2a 00  o.r.y. .%.s...*.
    00000000015efeec  4e 00 6f 00 74 00 20 00 - 65 00 6e 00 6f 00 75 00  N.o.t. .e.n.o.u.
    00000000015efefc  67 00 68 00 20 00 6d 00 - 65 00 6d 00 6f 00 72 00  g.h. .m.e.m.o.r.
    00000000015eff0c  79 00 20 00 74 00 6f 00 - 44 bf f5 81 24 dc dc f2  y. .t.o.D...$...
    00000000015eff1c  b2 c2 4d 80 ba c2 4d 80 - 14 bf f5 81 a8 bd f5 81  ..M...M.........
    00000000015eff2c  dc bd f5 81 80 ff 5e 01 - 99 66 e7 77 4c ff 5e 01  ......^..f.wL.^.
    00000000015eff3c  a9 66 e7 77 ed 10 90 7c - 40 91 10 00 b0 f7 0e 00  .f.w...|@.......
    00000000015eff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xb80 <----*

    eax=77e76bf0 ebx=00000000 ecx=015efaac edx=7c809740 esi=00108888 edi=00000100
    eip=7c90eb94 esp=0162fe1c ebp=0162ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0162ff80 77e76c22 0162ffa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    0162ff88 77e76a3b 00108888 00000004 015efb58 RPCRT4!I_RpcBCacheFree+0x5ea
    0162ffa8 77e76c0a 000a77d0 0162ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0162ffb4 7c80b683 00108f68 00000004 015efb58 RPCRT4!I_RpcBCacheFree+0x5d2
    0162ffec 00000000 77e76bf0 00108f68 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000162fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 62 01  ...|.g.w....p.b.
    000000000162fe2c  00 00 00 00 00 a7 10 00 - 54 ff 62 01 08 00 00 00  ........T.b.....
    000000000162fe3c  50 04 d1 81 50 04 d1 81 - 38 4b ba f2 8c 39 4e 80  P...P...8K...9N.
    000000000162fe4c  c0 04 d1 81 02 0b 19 82 - 00 00 00 00 54 4b ba f2  ............TK..
    000000000162fe5c  b5 46 4e 80 00 00 00 00 - ce 39 4e 80 08 90 ff 81  .FN......9N.....
    000000000162fe6c  98 0b 19 82 98 0b 19 82 - 68 4b ba f2 8b 66 89 f8  ........hK...f..
    000000000162fe7c  fc 0b 19 82 00 00 00 00 - 00 00 00 00 7c 4b ba f2  ............|K..
    000000000162fe8c  1a a4 6a f6 f8 0b 19 82 - 00 00 00 00 00 00 00 00  ..j.............
    000000000162fe9c  28 3b f0 81 a6 8b 59 f8 - 28 3b f0 81 98 0b 19 82  (;....Y.(;......
    000000000162feac  00 00 00 00 10 a9 01 82 - 60 ad 01 82 b0 ac 1c 82  ........`.......
    000000000162febc  c4 4b ba f2 9a 51 3b f8 - c0 44 1f 82 98 0b 19 82  .K...Q;..D......
    000000000162fecc  a9 51 3b f8 40 a9 01 82 - 10 a9 01 82 00 00 00 00  .Q;.@...........
    000000000162fedc  b0 ac 1c 82 00 00 00 00 - dc 4b ba f2 49 59 3b f8  .........K..IY;.
    000000000162feec  6c 59 3b f8 dc 4b ba f2 - 00 00 00 00 51 c4 c7 f7  lY;..K......Q...
    000000000162fefc  f8 4b ba f2 5d 39 c8 f7 - 00 9c c8 f7 a0 32 21 82  .K..]9.......2!.
    000000000162ff0c  58 f2 ec 81 d0 23 0e 82 - e4 05 13 82 24 4c ba f2  X....#......$L..
    000000000162ff1c  b2 c2 4d 80 ba c2 4d 80 - b4 05 13 82 48 04 13 82  ..M...M.....H...
    000000000162ff2c  7c 04 13 82 80 ff 62 01 - 99 66 e7 77 4c ff 62 01  |.....b..f.wL.b.
    000000000162ff3c  a9 66 e7 77 ed 10 90 7c - 80 8d 10 00 68 8f 10 00  .f.w...|....h...
    000000000162ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

     

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     


    Application exception occurred:
            App: C:\WINDOWS\system32\WgaTray.exe (pid=2580)
            When: 4/4/2007 @ 05:05:28.046
            Exception number: c0000005 (access violation)

    *----> System Information <----*
            Computer Name: HOME
            User Name: helene
            Terminal Session Id: 0
            Number of Processors: 1
            Processor Type: x86 Family 6 Model 8 Stepping 1
            Windows Version: 5.1
            Current Build: 2600
            Service Pack: 2
            Current Type: Uniprocessor Free
            Registered Organization: home
            Registered Owner: Helene McKenzie

    *----> Task List <----*
       0 System Process
       4 System
     460 smss.exe
     516 csrss.exe
     540 winlogon.exe
     584 services.exe
     596 lsass.exe
     752 svchost.exe
     800 svchost.exe
     868 svchost.exe
     888 InCDsrv.exe
    1072 svchost.exe
    1192 svchost.exe
    1324 spoolsv.exe
    1504 Explorer.EXE
    1628 InCD.exe
    1640 avgcc.exe
    1652 Error 0xD0000022
    1664 jusched.exe
    1676 HPWuSchd2.exe
    1728 RUNDLL32.EXE
    1736 RunDll32.exe
    1744 avgas.exe
    1760 ctfmon.exe
    1792 reader_sl.exe
    1808 QuickDCF.exe
    1820 hpqtra08.exe
    1852 soffice.exe
    1860 soffice.BIN
    1936 Error 0xD0000022
    1952 avgamsvr.exe
    1968 avgupsvc.exe
    1992 avgemc.exe
     168 Error 0xD0000022
     232 nvsvc32.exe
     412 hpqSTE08.exe
     492 HPZipm12.exe
     836 svchost.exe
    2424 alg.exe
    2580 WgaTray.exe
    2616 wmiprvse.exe
    2808 svchost.exe
    2956 hprblog.exe
    2992 wuauclt.exe
    3052 wuauclt.exe
    3088 drwtsn32.exe

    *----> Module List <----*
    (0000000000400000 - 0000000000409000: C:\WINDOWS\system32\Normaliz.dll
    (0000000001000000 - 0000000001052000: C:\WINDOWS\system32\WgaTray.exe
    (0000000001290000 - 00000000013f9000: C:\WINDOWS\system32\legitcheckcontrol.dll
    (000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
    (0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
    (000000004d4f0000 - 000000004d548000: C:\WINDOWS\system32\WINHTTP.dll
    (000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
    (000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\netapi32.dll
    (000000006e850000 - 000000006e895000: C:\WINDOWS\system32\iertutil.dll
    (0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
    (0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\ws2_32.dll
    (00000000722b0000 - 00000000722b5000: C:\WINDOWS\system32\SensApi.dll
    (0000000074720000 - 000000007476b000: C:\WINDOWS\system32\MSCTF.dll
    (0000000074980000 - 0000000074a8e000: C:\WINDOWS\system32\msxml3.dll
    (0000000074ed0000 - 0000000074ede000: C:\WINDOWS\system32\wbem\wbemsvc.dll
    (0000000074ef0000 - 0000000074ef8000: C:\WINDOWS\system32\wbem\wbemprox.dll
    (0000000075290000 - 00000000752c7000: C:\WINDOWS\system32\wbem\wbemcomn.dll
    (0000000075690000 - 0000000075706000: C:\WINDOWS\system32\wbem\fastprox.dll
    (0000000075e60000 - 0000000075e73000: C:\WINDOWS\system32\cryptnet.dll
    (0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
    (0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP60.dll
    (0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL
    (00000000767a0000 - 00000000767b3000: C:\WINDOWS\system32\NTDSAPI.dll
    (00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\userenv.dll
    (0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WinTrust.dll
    (0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
    (0000000076f20000 - 0000000076f47000: C:\WINDOWS\system32\DNSAPI.dll
    (0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
    (0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
    (0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
    (0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
    (00000000771b0000 - 000000007727f000: C:\WINDOWS\system32\WININET.dll
    (00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll
    (00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
    (0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
    (0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
    (0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
    (0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
    (0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
    (0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
    (0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
    (0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
    (0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
    (0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll
    (0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
    (0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\secur32.dll
    (000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
    (000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
    (000000007c9c0000 - 000000007d1d5000: C:\WINDOWS\system32\SHELL32.dll

    *----> State Dump for Thread Id 0xa18 <----*

    eax=00000616 ebx=00000000 ecx=6f16d46f edx=7b1a618f esi=b54cda56 edi=03d8d30c
    eip=01650bbf esp=0006e95c ebp=0006e9ac iopl=0         nv up ei pl nz ac po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216

    function: <nosymbols>
            01650b9d 5d               pop     ebp
            01650b9e e88145e8f7       call    f94d5124
            01650ba3 20b9608145e8     and     [ecx+0xe8458160],bh
            01650ba9 c2587e           ret     0x7e58
            01650bac 3d8b7de8c7       cmp     eax,0xc7e87d8b
            01650bb1 45               inc     ebp
            01650bb2 d420             aam     ???
            01650bb4 0000             add     [eax],al
            01650bb6 00897de88bfa     add     [ecx+0xfa8be87d],cl
            01650bbc c1ef05           shr     edi,0x5
    FAULT ->01650bbf 8bda             mov     ebx,edx
            01650bc1 c1e304           shl     ebx,0x4
            01650bc4 33fb             xor     edi,ebx
            01650bc6 ff4dd4           dec     dword ptr [ebp-0x2c]
            01650bc9 8bde             mov     ebx,esi
            01650bcb c1eb0b           shr     ebx,0xb
            01650bce 83e303           and     ebx,0x3
            01650bd1 8b5c9dec         mov     ebx,[ebp+ebx*4-0x14]
            01650bd5 03de             add     ebx,esi
            01650bd7 2b75e8           sub     esi,[ebp-0x18]
            01650bda 03fa             add     edi,edx

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\legitcheckcontrol.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\OLEAUT32.dll -
    *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\WgaTray.exe
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
    ChildEBP RetAddr  Args to Child             
    0006e9ac 01640b6c 0006e9c0 01292ec4 00000000 0x1650bbf
    0006ebcc 012c0781 0006f198 01292ec4 00000000 0x1640b6c
    0006efe8 012b86b4 0006f01c 00000104 01292ec4 legitcheckcontrol+0x30781
    0006f124 012b9341 009d9168 00000003 014037fc legitcheckcontrol+0x286b4
    0006f150 012aadf4 00000001 00000001 00000000 legitcheckcontrol+0x29341
    0006fad8 771273d0 014037f0 0006fb38 0006fbf8 legitcheckcontrol+0x1adf4
    0006faf4 771279e0 014037f0 0000001c 00000004 OLEAUT32!DispCallFunc+0xc3
    0006fb84 012abac0 000c4ccc 014037f0 00000000 OLEAUT32!DispCallFunc+0x6d3
    0006fbb0 01009999 014037f0 00000001 01002df0 legitcheckcontrol+0x1bac0
    0006fc48 0100aea8 0006fc74 0006fc88 0006fc90 WgaTray+0x9999
    0006feb4 0100bd0b 01043020 02fac500 01043024 WgaTray+0xaea8
    0006ff10 0100dc03 01000000 00000000 0002061a WgaTray+0xbd0b
    0006ffa8 0103004b 00db2748 018af944 7ffdf000 WgaTray+0xdc03
    0006ffc0 7c816fd7 00db2748 018af944 7ffdf000 WgaTray+0x3004b
    0006fff0 00000000 0102ffd4 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

    *----> Raw Stack Dump <----*
    000000000006e95c  98 f1 06 00 04 01 00 00 - 00 00 00 00 28 0a 00 00  ............(...
    000000000006e96c  02 00 00 00 30 48 40 01 - 01 00 00 00 00 00 00 00  ....0H@.........
    000000000006e97c  05 00 00 00 06 00 00 00 - 04 04 00 00 00 00 66 01  ..............f.
    000000000006e98c  08 04 00 00 6d 11 00 00 - b9 79 37 9e 12 98 ef 6b  ....m....y7....k
    000000000006e99c  12 c5 cc e4 98 42 71 08 - 96 ee d2 3e 16 3b 06 00  .....Bq....>.;..
    000000000006e9ac  cc eb 06 00 6c 0b 64 01 - c0 e9 06 00 c4 2e 29 01  ....l.d.......).
    000000000006e9bc  00 00 00 00 43 3a 5c 57 - 49 4e 44 4f 57 53 5c 73  ....C:\WINDOWS\s
    000000000006e9cc  79 73 74 65 6d 33 32 5c - 4f 45 4d 42 49 4f 53 2e  ystem32\OEMBIOS.
    000000000006e9dc  44 41 54 00 00 00 00 00 - 00 00 00 00 00 00 00 00  DAT.............
    000000000006e9ec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006e9fc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea2c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea3c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea4c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea5c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea6c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea7c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea8c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa1c <----*

    eax=00000000 ebx=003efed0 ecx=003eff7c edx=00000000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=003efea8 ebp=003eff44 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    003eff44 77df9b26 00000002 003eff6c 00000000 ntdll!KiFastSystemCallRet
    003effb4 7c80b683 00000000 7c9140bb 00000000 ADVAPI32!RegDeleteKeyW+0x2a2
    003effec 00000000 77df9981 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000003efea8  ab e9 90 7c e2 94 80 7c - 02 00 00 00 d0 fe 3e 00  ...|...|......>.
    00000000003efeb8  01 00 00 00 01 00 00 00 - 04 ff 3e 00 e0 2e 82 00  ..........>.....
    00000000003efec8  40 65 e4 77 00 10 00 00 - 5c 00 00 00 68 00 00 00  @e.w....\...h...
    00000000003efed8  c0 fe 3e 00 ec 4b 4d f3 - dc ff 3e 00 a8 9a 83 7c  ..>..KM...>....|
    00000000003efee8  b0 0a 81 7c 00 10 00 00 - 14 00 00 00 01 00 00 00  ...|............
    00000000003efef8  00 00 00 00 00 00 00 00 - 10 00 00 00 00 a2 2f 4d  ............../M
    00000000003eff08  ff ff ff ff 00 10 00 00 - 00 f0 fd 7f 00 d0 fd 7f  ................
    00000000003eff18  dc ff 3e 00 04 ff 3e 00 - d0 fe 3e 00 06 00 00 00  ..>...>...>.....
    00000000003eff28  02 00 00 00 c4 fe 3e 00 - 06 00 00 00 dc ff 3e 00  ......>.......>.
    00000000003eff38  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 b4 ff 3e 00  ...|...|......>.
    00000000003eff48  26 9b df 77 02 00 00 00 - 6c ff 3e 00 00 00 00 00  &..w....l.>.....
    00000000003eff58  e0 93 04 00 01 00 00 00 - bb 40 91 7c 00 00 00 00  .........@.|....
    00000000003eff68  00 00 00 00 5c 00 00 00 - 68 00 00 00 00 10 00 00  ....\...h.......
    00000000003eff78  e0 2e 82 00 00 00 00 00 - 00 10 00 00 e8 3e 82 00  .............>..
    00000000003eff88  a0 66 e4 77 28 00 00 00 - 80 66 e4 77 00 10 00 00  .f.w(....f.w....
    00000000003eff98  00 00 00 00 a0 66 e4 77 - e0 2e 82 00 80 66 e4 77  .....f.w.....f.w
    00000000003effa8  e5 03 00 00 00 10 00 00 - e8 3e 82 00 ec ff 3e 00  .........>....>.
    00000000003effb8  83 b6 80 7c 00 00 00 00 - bb 40 91 7c 00 00 00 00  ...|.....@.|....
    00000000003effc8  00 00 00 00 00 d0 fd 7f - 00 46 3c 82 c0 ff 3e 00  .........F<...>.
    00000000003effd8  00 4e 1b 82 ff ff ff ff - a8 9a 83 7c 90 b6 80 7c  .N.........|...|

    *----> State Dump for Thread Id 0xa24 <----*

    eax=000000c0 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
    eip=7c90eb94 esp=010dfcec ebp=010dffb4 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    010dffb4 7c80b683 00000000 00090000 00000000 ntdll!KiFastSystemCallRet
    010dffec 00000000 7c929fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000010dfcec  ab e9 90 7c d5 a0 92 7c - 14 00 00 00 30 fd 0d 01  ...|...|....0...
    00000000010dfcfc  01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 09 00  ................
    00000000010dfd0c  00 00 00 00 00 00 00 00 - 08 e5 97 7c 08 e5 97 7c  ...........|...|
    00000000010dfd1c  c4 01 00 00 24 0a 00 00 - 14 00 00 00 14 00 00 00  ....$...........
    00000000010dfd2c  13 00 00 00 bc 01 00 00 - 44 00 00 00 00 02 00 00  ........D.......
    00000000010dfd3c  10 02 00 00 2c 02 00 00 - 38 02 00 00 44 02 00 00  ....,...8...D...
    00000000010dfd4c  74 02 00 00 78 02 00 00 - 80 02 00 00 8c 02 00 00  t...x...........
    00000000010dfd5c  94 02 00 00 a0 02 00 00 - ac 02 00 00 b8 02 00 00  ................
    00000000010dfd6c  c0 02 00 00 cc 02 00 00 - d8 02 00 00 e4 02 00 00  ................
    00000000010dfd7c  ec 02 00 00 2c 04 00 00 - 38 04 00 00 44 04 00 00  ....,...8...D...
    00000000010dfd8c  50 04 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  P...............
    00000000010dfd9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdac  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdcc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfddc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdfc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa28 <----*

    eax=00000000 ebx=0111fef4 ecx=7ffdf000 edx=7ffda000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=0111fecc ebp=0111ff68 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\userenv.dll -
    ChildEBP RetAddr  Args to Child             
    0111ff68 7c80a075 00000003 76a60310 00000000 ntdll!KiFastSystemCallRet
    0111ff84 769c888d 00000003 76a60310 00000000 kernel32!WaitForMultipleObjects+0x18
    0111ffb4 7c80b683 00000000 00000000 00000000 userenv!UnregisterGPNotification+0x15c
    0111ffec 00000000 769c8831 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000111fecc  ab e9 90 7c e2 94 80 7c - 03 00 00 00 f4 fe 11 01  ...|...|........
    000000000111fedc  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111feec  b8 03 a6 76 47 9b 80 7c - 14 02 00 00 18 02 00 00  ...vG..|........
    000000000111fefc  1c 02 00 00 5c fe 11 01 - 6c ff 11 01 6c ff 11 01  ....\...l...l...
    000000000111ff0c  18 ee 90 7c 70 05 91 7c - 14 00 00 00 01 00 00 00  ...|p..|........
    000000000111ff1c  00 00 00 00 00 00 00 00 - 10 00 00 00 f6 1b 80 7c  ...............|
    000000000111ff2c  00 00 00 00 00 00 00 00 - 00 f0 fd 7f 00 a0 fd 7f  ................
    000000000111ff3c  48 f8 0b 00 00 00 00 00 - f4 fe 11 01 00 00 00 00  H...............
    000000000111ff4c  03 00 00 00 e8 fe 11 01 - 00 00 00 00 dc ff 11 01  ................
    000000000111ff5c  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 84 ff 11 01  ...|...|........
    000000000111ff6c  75 a0 80 7c 03 00 00 00 - 10 03 a6 76 00 00 00 00  u..|.......v....
    000000000111ff7c  ff ff ff ff 00 00 00 00 - b4 ff 11 01 8d 88 9c 76  ...............v
    000000000111ff8c  03 00 00 00 10 03 a6 76 - 00 00 00 00 ff ff ff ff  .......v........
    000000000111ff9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 9c 76  ...............v
    000000000111ffac  03 00 00 00 00 00 00 00 - ec ff 11 01 83 b6 80 7c  ...............|
    000000000111ffbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111ffcc  00 a0 fd 7f 00 46 3c 82 - c0 ff 11 01 30 7a 18 82  .....F<.....0z..
    000000000111ffdc  ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00  .......|...|....
    000000000111ffec  00 00 00 00 00 00 00 00 - 31 88 9c 76 00 00 00 00  ........1..v....
    000000000111fffc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa2c <----*

    eax=77e76bf0 ebx=00000000 ecx=00000009 edx=7c910732 esi=00102460 edi=00000000
    eip=7c90eb94 esp=0157fe1c ebp=0157ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0157ff80 77e76c22 0157ffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    0157ff88 77e76a3b 00102460 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5ea
    0157ffa8 77e76c0a 000a77d0 0157ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0157ffb4 7c80b683 000ba3a0 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5d2
    0157ffec 00000000 77e76bf0 000ba3a0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000157fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 57 01  ...|.g.w....p.W.
    000000000157fe2c  00 00 00 00 30 96 10 00 - 54 ff 57 01 5d c3 8b c0  ....0...T.W.]...
    000000000157fe3c  55 8b ec 33 c0 55 68 ac - c7 42 00 64 ff 30 64 89  U..3.Uh..B.d.0d.
    000000000157fe4c  20 ff 05 5c 38 69 00 75 - 7d a1 68 36 69 00 e8 a9   ..\8i.u}.h6i...
    000000000157fe5c  19 ff ff a1 50 38 69 00 - 8b 10 ff 52 14 e8 ce f5  ....P8i....R....
    000000000157fe6c  ff ff 33 d2 33 c0 e8 ad - 7b ff ff b8 6c 38 69 00  ..3.3...{...l8i.
    000000000157fe7c  e8 97 5e fe ff e8 de b4 - fd ff 8d 80 0c 00 00 00  ..^.............
    000000000157fe8c  e8 87 5e fe ff b8 64 38 - 69 00 e8 7d 5e fe ff b8  ..^...d8i..}^...
    000000000157fe9c  50 38 69 00 e8 9b ad fd - ff b8 84 bd 42 00 e8 29  P8i.........B..)
    000000000157feac  ac fd ff b8 4c b5 66 00 - e8 5f 5e fe ff e8 6a d4  ....L.f.._^...j.
    000000000157febc  ff ff b8 68 38 69 00 e8 - 50 5e fe ff b8 50 38 69  ...h8i..P^...P8i
    000000000157fecc  00 e8 6e ad fd ff 33 c0 - 5a 59 59 64 89 10 68 b3  ..n...3.ZYYd..h.
    000000000157fedc  c7 42 00 c3 e9 93 83 fd - ff eb f8 5d c3 8d 40 00  .B.........]..@.
    000000000157feec  55 8b ec 33 c0 55 68 41 - c8 42 00 64 ff 30 64 89  U..3.UhA.B.d.0d.
    000000000157fefc  20 83 2d 5c 38 69 00 01 - 73 61 e8 e5 d3 ff ff b8   .-\8i..sa......
    000000000157ff0c  ff ff ff ff 46 02 00 00 - 2c 87 e0 81 24 7c 0d f3  ....F...,...$|..
    000000000157ff1c  b2 c2 4d 80 ba c2 4d 80 - fc 86 e0 81 90 85 e0 81  ..M...M.........
    000000000157ff2c  c4 85 e0 81 80 ff 57 01 - 99 66 e7 77 4c ff 57 01  ......W..f.wL.W.
    000000000157ff3c  a9 66 e7 77 ed 10 90 7c - 70 75 10 00 a0 a3 0b 00  .f.w...|pu......
    000000000157ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xa30 <----*

    eax=774fe429 ebx=00007530 ecx=7ffdf000 edx=00000000 esi=00000000 edi=015bff50
    eip=7c90eb94 esp=015bff20 ebp=015bff78 iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
    ChildEBP RetAddr  Args to Child             
    015bff78 7c802451 0000ea60 00000000 015bffb4 ntdll!KiFastSystemCallRet
    015bff88 774fe31d 0000ea60 0010ece0 774fe3dc kernel32!Sleep+0xf
    015bffb4 7c80b683 0010ece0 7c910945 7c91094e ole32!StringFromGUID2+0x51b
    015bffec 00000000 774fe429 0010ece0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015bff20  5c d8 90 7c ed 23 80 7c - 00 00 00 00 50 ff 5b 01  \..|.#.|....P.[.
    00000000015bff30  40 25 80 7c f8 6d 60 77 - 30 75 00 00 14 00 00 00  @%.|.m`w0u......
    00000000015bff40  01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00  ................
    00000000015bff50  00 ba 3c dc ff ff ff ff - 2c ff 5b 01 50 ff 5b 01  ..<.....,.[.P.[.
    00000000015bff60  30 ff 5b 01 2c ff 5b 01 - dc ff 5b 01 a8 9a 83 7c  0.[.,.[...[....|
    00000000015bff70  58 24 80 7c 00 00 00 00 - 88 ff 5b 01 51 24 80 7c  X$.|......[.Q$.|
    00000000015bff80  60 ea 00 00 00 00 00 00 - b4 ff 5b 01 1d e3 4f 77  `.........[...Ow
    00000000015bff90  60 ea 00 00 e0 ec 10 00 - dc e3 4f 77 00 00 00 00  `.........Ow....
    00000000015bffa0  45 09 91 7c e0 ec 10 00 - 00 00 4e 77 44 e4 4f 77  E..|......NwD.Ow
    00000000015bffb0  4e 09 91 7c ec ff 5b 01 - 83 b6 80 7c e0 ec 10 00  N..|..[....|....
    00000000015bffc0  45 09 91 7c 4e 09 91 7c - e0 ec 10 00 00 80 fd 7f  E..|N..|........
    00000000015bffd0  00 46 3c 82 c0 ff 5b 01 - 10 83 18 82 ff ff ff ff  .F<...[.........
    00000000015bffe0  a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00  ...|...|........
    00000000015bfff0  00 00 00 00 29 e4 4f 77 - e0 ec 10 00 00 00 00 00  ....).Ow........
    00000000015c0000  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0010  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0020  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0030  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0040  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0050  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa34 <----*

    eax=77e76bf0 ebx=00000000 ecx=0157faac edx=7c809740 esi=00102460 edi=00102504
    eip=7c90eb94 esp=015ffe1c ebp=015fff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    015fff80 77e76c22 015fffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    015fff88 77e76a3b 00102460 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    015fffa8 77e76c0a 000a77d0 015fffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    015fffb4 7c80b683 000ef7b0 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    015fffec 00000000 77e76bf0 000ef7b0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015ffe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 5f 01  ...|.g.w....p._.
    00000000015ffe2c  00 00 00 00 00 a7 10 00 - 54 ff 5f 01 51 ff 52 28  ........T._.Q.R(
    00000000015ffe3c  6a 01 8b ce e8 49 41 00 - 00 8b 46 2c 8b 7d 10 3b  j....IA...F,.}.;
    00000000015ffe4c  fb c6 40 49 01 74 22 8b - 4e 2c 83 c1 18 8b 41 04  ..@I.t".N,....A.
    00000000015ffe5c  3b c3 74 05 8b 40 04 eb - 02 33 c0 50 57 ff 15 f4  ;.t..@...3.PW...
    00000000015ffe6c  90 96 00 8b 07 57 ff 50 - 04 8d 45 08 8b ce 50 e8  .....W.P..E...P.
    00000000015ffe7c  5a 42 00 00 8b 4e 2c 8b - 00 83 c1 34 8b 11 89 01  ZB...N,....4....
    00000000015ffe8c  3b d3 74 06 8b 02 52 ff - 50 08 8b 46 2c 8b ce ff  ;.t...R.P..F,...
    00000000015ffe9c  70 34 e8 19 17 00 00 89 - 45 08 8b 46 2c 8b 48 38  p4......E..F,.H8
    00000000015ffeac  3b cb 75 59 6a 08 e8 c7 - 16 2e 00 8b f8 59 3b fb  ;.uYj........Y;.
    00000000015ffebc  74 10 8b cf ff 15 34 92 - 96 00 c7 07 cc a9 a3 00  t.....4.........
    00000000015ffecc  eb 02 33 ff 8b 46 2c 89 - 78 38 8b 46 2c 39 58 38  ..3..F,.x8.F,9X8
    00000000015ffedc  75 30 53 8b ce e8 a8 40 - 00 00 a1 4c 70 b4 00 83  u0S....@...Lp...
    00000000015ffeec  78 04 04 7c 0c 68 90 8f - b0 00 ff 15 70 7c 96 00  x..|.h......p|..
    00000000015ffefc  59 6a 01 68 05 40 00 80 - e9 b4 fe ff ff 8b 01 ff  Yj.h.@..........
    00000000015fff0c  50 04 8b 46 1c 8b 3d cc - 5c 57 e3 81 24 bc 0e f3  P..F..=.\W..$...
    00000000015fff1c  b2 c2 4d 80 ba c2 4d 80 - 2c 57 e3 81 c0 55 e3 81  ..M...M.,W...U..
    00000000015fff2c  f4 55 e3 81 80 ff 5f 01 - 99 66 e7 77 4c ff 5f 01  .U...._..f.wL._.
    00000000015fff3c  a9 66 e7 77 ed 10 90 7c - b0 77 10 00 b0 f7 0e 00  .f.w...|.w......
    00000000015fff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xa88 <----*

    eax=77e76bf0 ebx=00000000 ecx=0157faac edx=7c809740 esi=00102460 edi=00102504
    eip=7c90eb94 esp=0163fe1c ebp=0163ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0163ff80 77e76c22 0163ffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    0163ff88 77e76a3b 00102460 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    0163ffa8 77e76c0a 000a77d0 0163ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0163ffb4 7c80b683 0011a308 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    0163ffec 00000000 77e76bf0 0011a308 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000163fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 63 01  ...|.g.w....p.c.
    000000000163fe2c  00 00 00 00 d0 a4 11 00 - 54 ff 63 01 02 00 00 00  ........T.c.....
    000000000163fe3c  a4 bb 0d f3 00 5a 0b 82 - 02 00 00 00 f8 7b 3c 82  .....Z.......{<.
    000000000163fe4c  a8 ac 56 80 f8 7b 3c 82 - 18 5a 0b 82 00 5a 0b 82  ..V..{<..Z...Z..
    000000000163fe5c  56 0a 00 00 55 0a 00 00 - e4 bb 0d f3 00 00 00 00  V...U...........
    000000000163fe6c  0e 00 00 00 94 02 00 00 - 00 00 00 00 38 43 56 80  ............8CV.
    000000000163fe7c  90 f7 90 e1 98 69 e2 81 - 98 bb 0d f3 e3 6e 56 80  .....i.......nV.
    000000000163fe8c  90 f7 90 e1 a0 02 00 00 - f8 7b 3c 82 90 f7 90 e1  .........{<.....
    000000000163fe9c  00 5a 0b 82 a0 02 00 00 - 00 00 00 00 9c f7 90 e1  .Z..............
    000000000163feac  40 c5 a7 e1 01 5a 0b 82 - b4 bb 0d f3 0a 70 56 80  @....Z.......pV.
    000000000163febc  90 f7 90 e1 40 c5 a7 e1 - f8 7b 3c 82 03 00 1f 00  ....@....{<.....
    000000000163fecc  00 5a 0b 82 a0 02 00 00 - fc bb 0d f3 eb aa 56 80  .Z............V.
    000000000163fedc  90 f7 90 e1 00 00 00 00 - 28 32 01 82 00 00 00 00  ........(2......
    000000000163feec  00 5a 0b 82 cc 6b e2 81 - 0a 00 00 00 01 00 00 00  .Z...k..........
    000000000163fefc  48 d5 e5 81 28 58 eb 81 - 02 00 00 00 00 5a 0b 82  H...(X.......Z..
    000000000163ff0c  03 00 1f 00 00 5a 0b 82 - 3c 7c 1a 82 24 bc 0d f3  .....Z..<|..$...
    000000000163ff1c  b2 c2 4d 80 ba c2 4d 80 - 0c 7c 1a 82 a0 7a 1a 82  ..M...M..|...z..
    000000000163ff2c  d4 7a 1a 82 80 ff 63 01 - 99 66 e7 77 4c ff 63 01  .z....c..f.wL.c.
    000000000163ff3c  a9 66 e7 77 ed 10 90 7c - e0 a2 11 00 08 a3 11 00  .f.w...|........
    000000000163ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    Wednesday, April 4, 2007 3:14 AM
  • bump
    Wednesday, April 11, 2007 12:06 PM
  • Thanks for the reminder Girlfreddy,

    My Devs are still looking into this.

     

    Darin

    Thursday, April 12, 2007 8:43 PM

All replies

  • Hi girlfreddy,

     

      Would you post the Dr. Watson output?

     

    Thank you,

    Darin Smith

    WGA Forum Program Manager

    --------------------------------------------------------
    All Users: Please go to http://forums.microsoft.com/Genuine/ShowPost.aspx?PostID=1255325&SiteID=25 before posting a question.

    --------------------------------------------------------

     

     

    Wednesday, April 4, 2007 1:00 AM
  • Here it is. There was only one crash listed. (I added the next crash from Tuesday morning so there's two now.)

     


    Microsoft (R) DrWtsn32
    Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.

     

    Application exception occurred:
            App: C:\WINDOWS\system32\WgaTray.exe (pid=2788)
            When: 4/3/2007 @ 22:00:34.906
            Exception number: c0000005 (access violation)

    *----> System Information <----*
            Computer Name: HOME
            User Name: helene
            Terminal Session Id: 0
            Number of Processors: 1
            Processor Type: x86 Family 6 Model 8 Stepping 1
            Windows Version: 5.1
            Current Build: 2600
            Service Pack: 2
            Current Type: Uniprocessor Free
            Registered Organization: home
            Registered Owner: Helene McKenzie

    *----> Task List <----*
       0 System Process
       4 System
     456 smss.exe
     528 csrss.exe
     552 winlogon.exe
     596 services.exe
     608 lsass.exe
     760 svchost.exe
     820 svchost.exe
     884 svchost.exe
     912 InCDsrv.exe
    1060 svchost.exe
    1088 svchost.exe
    1344 spoolsv.exe
    1528 Explorer.EXE
    1692 Error 0xD0000022
    1712 avgamsvr.exe
    1724 InCD.exe
    1752 avgcc.exe
    1796 Error 0xD0000022
    1812 avgupsvc.exe
    1848 jusched.exe
    1872 avgemc.exe
    1880 HPWuSchd2.exe
    1924 Error 0xD0000022
    1944 RUNDLL32.EXE
    1972 RunDll32.exe
    1992 avgas.exe
    2028 ctfmon.exe
     144 nvsvc32.exe
     208 HPZipm12.exe
     244 svchost.exe
     348 reader_sl.exe
     308 QuickDCF.exe
     492 hpqtra08.exe
     572 soffice.exe
     752 soffice.BIN
    2116 hpqSTE08.exe
    2456 alg.exe
    2780 firefox.exe
    2788 WgaTray.exe
    2832 svchost.exe
    2984 wmiprvse.exe
    3120 dwwin.exe
    3136 wuauclt.exe
    3284 wuauclt.exe
    3344 drwtsn32.exe

    *----> Module List <----*
    (0000000000400000 - 0000000000409000: C:\WINDOWS\system32\Normaliz.dll
    (0000000001000000 - 0000000001052000: C:\WINDOWS\system32\WgaTray.exe
    (0000000001280000 - 00000000013e9000: C:\WINDOWS\system32\legitcheckcontrol.dll
    (000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
    (0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
    (000000004d4f0000 - 000000004d548000: C:\WINDOWS\system32\WINHTTP.dll
    (000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
    (000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\netapi32.dll
    (000000006e850000 - 000000006e895000: C:\WINDOWS\system32\iertutil.dll
    (0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
    (0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\ws2_32.dll
    (00000000722b0000 - 00000000722b5000: C:\WINDOWS\system32\SensApi.dll
    (0000000074720000 - 000000007476b000: C:\WINDOWS\system32\MSCTF.dll
    (0000000074980000 - 0000000074a8e000: C:\WINDOWS\system32\msxml3.dll
    (0000000074ed0000 - 0000000074ede000: C:\WINDOWS\system32\wbem\wbemsvc.dll
    (0000000074ef0000 - 0000000074ef8000: C:\WINDOWS\system32\wbem\wbemprox.dll
    (0000000075290000 - 00000000752c7000: C:\WINDOWS\system32\wbem\wbemcomn.dll
    (0000000075690000 - 0000000075706000: C:\WINDOWS\system32\wbem\fastprox.dll
    (0000000075e60000 - 0000000075e73000: C:\WINDOWS\system32\cryptnet.dll
    (0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
    (0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP60.dll
    (0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL
    (00000000767a0000 - 00000000767b3000: C:\WINDOWS\system32\NTDSAPI.dll
    (00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\userenv.dll
    (0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WinTrust.dll
    (0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
    (0000000076f20000 - 0000000076f47000: C:\WINDOWS\system32\DNSAPI.dll
    (0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
    (0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
    (0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
    (0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
    (00000000771b0000 - 000000007727f000: C:\WINDOWS\system32\WININET.dll
    (00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll
    (00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
    (0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
    (0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
    (0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
    (0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
    (0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
    (0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
    (0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
    (0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
    (0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
    (0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll
    (0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
    (0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\secur32.dll
    (000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
    (000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
    (000000007c9c0000 - 000000007d1d5000: C:\WINDOWS\system32\SHELL32.dll

    *----> State Dump for Thread Id 0xae8 <----*

    eax=000007de ebx=4c7455e0 ecx=d713e26d edx=54c7455e esi=8ff34781 edi=4ed26fca
    eip=01640380 esp=0006e95c ebp=0006e9ac iopl=0         nv up ei pl nz na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

    function: <nosymbols>
            01640363 3d8b7de8c7       cmp     eax,0xc7e87d8b
            01640368 45               inc     ebp
            01640369 d420             aam     ???
            0164036b 0000             add     [eax],al
            0164036d 00897de88bfa     add     [ecx+0xfa8be87d],cl
            01640373 c1ef05           shr     edi,0x5
            01640376 8bda             mov     ebx,edx
            01640378 c1e304           shl     ebx,0x4
            0164037b 33fb             xor     edi,ebx
            0164037d ff4dd4           dec     dword ptr [ebp-0x2c]
    FAULT ->01640380 8bde             mov     ebx,esi
            01640382 c1eb0b           shr     ebx,0xb
            01640385 83e303           and     ebx,0x3
            01640388 8b5c9dec         mov     ebx,[ebp+ebx*4-0x14]
            0164038c 03de             add     ebx,esi
            0164038e 2b75e8           sub     esi,[ebp-0x18]
            01640391 03fa             add     edi,edx
            01640393 33fb             xor     edi,ebx
            01640395 2bcf             sub     ecx,edi
            01640397 8bf9             mov     edi,ecx
            01640399 c1ef05           shr     edi,0x5

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\legitcheckcontrol.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\OLEAUT32.dll -
    *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\WgaTray.exe
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
    ChildEBP RetAddr  Args to Child             
    0006e9ac 01630aa9 0006e9c0 01282ec4 00000000 0x1640380
    0006ebcc 012b0781 0006f198 01282ec4 00000000 0x1630aa9
    0006efe8 012a86b4 0006f01c 00000104 01282ec4 legitcheckcontrol+0x30781
    0006f124 012a9341 009d9168 00000003 013f37fc legitcheckcontrol+0x286b4
    0006f150 0129adf4 00000001 00000001 00000000 legitcheckcontrol+0x29341
    0006fad8 771273d0 013f37f0 0006fb38 0006fbf8 legitcheckcontrol+0x1adf4
    0006faf4 771279e0 013f37f0 0000001c 00000004 OLEAUT32!DispCallFunc+0xc3
    0006fb84 0129bac0 000c2eec 013f37f0 00000000 OLEAUT32!DispCallFunc+0x6d3
    0006fbb0 01009999 013f37f0 00000001 01002df0 legitcheckcontrol+0x1bac0
    0006fc48 0100aea8 0006fc74 0006fc88 0006fc90 WgaTray+0x9999
    0006feb4 0100bd0b 01043020 02fac500 01043024 WgaTray+0xaea8
    0006ff10 0100dc03 01000000 00000000 0002061a WgaTray+0xbd0b
    0006ffa8 0103004b 00de6c38 016ef944 7ffdf000 WgaTray+0xdc03
    0006ffc0 7c816fd7 00de6c38 016ef944 7ffdf000 WgaTray+0x3004b
    0006fff0 00000000 0102ffd4 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

    *----> Raw Stack Dump <----*
    000000000006e95c  98 f1 06 00 04 01 00 00 - 00 00 00 00 28 0a 00 00  ............(...
    000000000006e96c  02 00 00 00 30 48 3f 01 - 01 00 00 00 00 00 00 00  ....0H?.........
    000000000006e97c  05 00 00 00 08 00 00 00 - 04 04 00 00 00 00 65 01  ..............e.
    000000000006e98c  08 04 00 00 6d 11 00 00 - b9 79 37 9e 12 98 ef 6b  ....m....y7....k
    000000000006e99c  12 c5 cc e4 98 42 71 08 - 96 ee d2 3e e1 3d 06 00  .....Bq....>.=..
    000000000006e9ac  cc eb 06 00 a9 0a 63 01 - c0 e9 06 00 c4 2e 28 01  ......c.......(.
    000000000006e9bc  00 00 00 00 43 3a 5c 57 - 49 4e 44 4f 57 53 5c 73  ....C:\WINDOWS\s
    000000000006e9cc  79 73 74 65 6d 33 32 5c - 4f 45 4d 42 49 4f 53 2e  ystem32\OEMBIOS.
    000000000006e9dc  44 41 54 00 00 00 00 00 - 00 00 00 00 00 00 00 00  DAT.............
    000000000006e9ec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006e9fc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea2c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea3c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea4c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea5c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea6c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea7c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea8c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb5c <----*

    eax=00000000 ebx=003efed0 ecx=003eff7c edx=00000000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=003efea8 ebp=003eff44 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    003eff44 77df9b26 00000002 003eff6c 00000000 ntdll!KiFastSystemCallRet
    003effb4 7c80b683 00000000 7c9140bb 00000000 ADVAPI32!RegDeleteKeyW+0x2a2
    003effec 00000000 77df9981 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000003efea8  ab e9 90 7c e2 94 80 7c - 02 00 00 00 d0 fe 3e 00  ...|...|......>.
    00000000003efeb8  01 00 00 00 01 00 00 00 - 04 ff 3e 00 e0 2e 82 00  ..........>.....
    00000000003efec8  40 65 e4 77 00 10 00 00 - 5c 00 00 00 68 00 00 00  @e.w....\...h...
    00000000003efed8  c0 fe 3e 00 ec 7b fe f2 - dc ff 3e 00 a8 9a 83 7c  ..>..{....>....|
    00000000003efee8  b0 0a 81 7c 00 10 00 00 - 14 00 00 00 01 00 00 00  ...|............
    00000000003efef8  00 00 00 00 00 00 00 00 - 10 00 00 00 00 a2 2f 4d  ............../M
    00000000003eff08  ff ff ff ff 00 10 00 00 - 00 f0 fd 7f 00 d0 fd 7f  ................
    00000000003eff18  dc ff 3e 00 04 ff 3e 00 - d0 fe 3e 00 06 00 00 00  ..>...>...>.....
    00000000003eff28  02 00 00 00 c4 fe 3e 00 - 06 00 00 00 dc ff 3e 00  ......>.......>.
    00000000003eff38  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 b4 ff 3e 00  ...|...|......>.
    00000000003eff48  26 9b df 77 02 00 00 00 - 6c ff 3e 00 00 00 00 00  &..w....l.>.....
    00000000003eff58  e0 93 04 00 01 00 00 00 - bb 40 91 7c 00 00 00 00  .........@.|....
    00000000003eff68  00 00 00 00 5c 00 00 00 - 68 00 00 00 00 10 00 00  ....\...h.......
    00000000003eff78  e0 2e 82 00 00 00 00 00 - 00 10 00 00 e8 3e 82 00  .............>..
    00000000003eff88  a0 66 e4 77 28 00 00 00 - 80 66 e4 77 00 10 00 00  .f.w(....f.w....
    00000000003eff98  00 00 00 00 a0 66 e4 77 - e0 2e 82 00 80 66 e4 77  .....f.w.....f.w
    00000000003effa8  e5 03 00 00 00 10 00 00 - e8 3e 82 00 ec ff 3e 00  .........>....>.
    00000000003effb8  83 b6 80 7c 00 00 00 00 - bb 40 91 7c 00 00 00 00  ...|.....@.|....
    00000000003effc8  00 00 00 00 00 d0 fd 7f - 00 46 3c 82 c0 ff 3e 00  .........F<...>.
    00000000003effd8  e0 9a d6 81 ff ff ff ff - a8 9a 83 7c 90 b6 80 7c  ...........|...|

    *----> State Dump for Thread Id 0xb64 <----*

    eax=000000c0 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
    eip=7c90eb94 esp=010dfcec ebp=010dffb4 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    010dffb4 7c80b683 00000000 00090000 00000000 ntdll!KiFastSystemCallRet
    010dffec 00000000 7c929fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000010dfcec  ab e9 90 7c d5 a0 92 7c - 14 00 00 00 30 fd 0d 01  ...|...|....0...
    00000000010dfcfc  01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 09 00  ................
    00000000010dfd0c  00 00 00 00 00 00 00 00 - 08 e5 97 7c 08 e5 97 7c  ...........|...|
    00000000010dfd1c  c4 01 00 00 64 0b 00 00 - 14 00 00 00 14 00 00 00  ....d...........
    00000000010dfd2c  13 00 00 00 bc 01 00 00 - 44 00 00 00 00 02 00 00  ........D.......
    00000000010dfd3c  10 02 00 00 2c 02 00 00 - 38 02 00 00 44 02 00 00  ....,...8...D...
    00000000010dfd4c  74 02 00 00 78 02 00 00 - 80 02 00 00 8c 02 00 00  t...x...........
    00000000010dfd5c  94 02 00 00 a0 02 00 00 - ac 02 00 00 b8 02 00 00  ................
    00000000010dfd6c  c0 02 00 00 cc 02 00 00 - d8 02 00 00 e4 02 00 00  ................
    00000000010dfd7c  ec 02 00 00 2c 04 00 00 - 38 04 00 00 44 04 00 00  ....,...8...D...
    00000000010dfd8c  50 04 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  P...............
    00000000010dfd9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdac  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdcc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfddc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdfc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb68 <----*

    eax=769c8831 ebx=0111fef4 ecx=0006f1cc edx=0006f480 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=0111fecc ebp=0111ff68 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\userenv.dll -
    ChildEBP RetAddr  Args to Child             
    0111ff68 7c80a075 00000003 76a60310 00000000 ntdll!KiFastSystemCallRet
    0111ff84 769c888d 00000003 76a60310 00000000 kernel32!WaitForMultipleObjects+0x18
    0111ffb4 7c80b683 00000000 00000000 00000000 userenv!UnregisterGPNotification+0x15c
    0111ffec 00000000 769c8831 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000111fecc  ab e9 90 7c e2 94 80 7c - 03 00 00 00 f4 fe 11 01  ...|...|........
    000000000111fedc  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111feec  b8 03 a6 76 47 9b 80 7c - 14 02 00 00 18 02 00 00  ...vG..|........
    000000000111fefc  1c 02 00 00 5c fe 11 01 - 6c ff 11 01 6c ff 11 01  ....\...l...l...
    000000000111ff0c  18 ee 90 7c 70 05 91 7c - 14 00 00 00 01 00 00 00  ...|p..|........
    000000000111ff1c  00 00 00 00 00 00 00 00 - 10 00 00 00 f6 1b 80 7c  ...............|
    000000000111ff2c  00 00 00 00 00 00 00 00 - 00 f0 fd 7f 00 a0 fd 7f  ................
    000000000111ff3c  48 f8 0b 00 00 00 00 00 - f4 fe 11 01 00 00 00 00  H...............
    000000000111ff4c  03 00 00 00 e8 fe 11 01 - 00 00 00 00 dc ff 11 01  ................
    000000000111ff5c  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 84 ff 11 01  ...|...|........
    000000000111ff6c  75 a0 80 7c 03 00 00 00 - 10 03 a6 76 00 00 00 00  u..|.......v....
    000000000111ff7c  ff ff ff ff 00 00 00 00 - b4 ff 11 01 8d 88 9c 76  ...............v
    000000000111ff8c  03 00 00 00 10 03 a6 76 - 00 00 00 00 ff ff ff ff  .......v........
    000000000111ff9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 9c 76  ...............v
    000000000111ffac  03 00 00 00 00 00 00 00 - ec ff 11 01 83 b6 80 7c  ...............|
    000000000111ffbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111ffcc  00 a0 fd 7f 00 46 3c 82 - c0 ff 11 01 18 f6 e1 81  .....F<.........
    000000000111ffdc  ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00  .......|...|....
    000000000111ffec  00 00 00 00 00 00 00 00 - 31 88 9c 76 00 00 00 00  ........1..v....
    000000000111fffc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb6c <----*

    eax=77e76bf0 ebx=00000000 ecx=00000009 edx=7c910732 esi=00108888 edi=00000100
    eip=7c90eb94 esp=0156fe1c ebp=0156ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0156ff80 77e76c22 0156ffa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    0156ff88 77e76a3b 00108888 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5ea
    0156ffa8 77e76c0a 000a77d0 0156ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0156ffb4 7c80b683 000ba3a0 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5d2
    0156ffec 00000000 77e76bf0 000ba3a0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000156fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 56 01  ...|.g.w....p.V.
    000000000156fe2c  00 00 00 00 70 b9 10 00 - 54 ff 56 01 c2 4e b1 3b  ....p...T.V..N.;
    000000000156fe3c  7d cb 1c 3c 25 ca 5e 3c - 66 9f c7 3b 32 c7 f2 3b  }..<%.^<f..;2..;
    000000000156fe4c  5f 26 0a 3c 25 94 be 3b - 8c 2c 19 3c 77 4e b3 3b  _&.<%..;.,.<wN.;
    000000000156fe5c  52 f2 ea 3b 79 23 f3 3b - ef 3c 71 3b 7f 83 f6 3b  R..;y#.;.<q;...;
    000000000156fe6c  7c 0f 97 3b 7e a7 c9 3b - 1f 6a 5b 3b cc 43 a6 3b  |..;~..;.j[;.C.;
    000000000156fe7c  56 0d c2 3b bf 29 ac 3b - 76 6b 99 3b b7 2a 09 3b  V..;.).;vk.;.*.;
    000000000156fe8c  00 00 00 00 98 a6 88 3c - 02 4b 2e 3c 7f 31 37 3f  .......<.K.<.17?
    000000000156fe9c  e6 04 ed 3c 6e 4d 3a 3c - a4 17 35 3c 6a fa ec 3b  ...<nM:<..5<j..;
    000000000156feac  59 fc 26 3c 93 1e 86 3b - ea 76 76 3c 76 8b 40 3c  Y.&<...;.vv<v.@<
    000000000156febc  f1 64 b7 3c 19 ca 09 3c - b2 f2 4b 3c 11 e0 f4 3b  .d.<...<..K<...;
    000000000156fecc  50 89 6b 3b 46 ee e9 3b - 57 ed 9a 3c e7 53 c7 3b  P.k;F..;W..<.S.;
    000000000156fedc  5e 66 58 3b d1 5c 27 3c - 20 08 10 3c 93 8a c6 3c  ^fX;.\'< ..<...<
    000000000156feec  0c 21 67 3c 3e 25 67 3c - ea cd 28 3c 30 62 1f 3c  .!g<>%g<..(<0b.<
    000000000156fefc  88 0e 01 3c 71 3c 1f 3c - 1b 49 02 3c ea 42 ac 3c  ...<q<.<.I.<.B.<
    000000000156ff0c  f0 df bc 3b fe 0a 19 3c - b4 84 c1 81 24 cc a2 f2  ...;...<....$...
    000000000156ff1c  b2 c2 4d 80 ba c2 4d 80 - 84 84 c1 81 18 83 c1 81  ..M...M.........
    000000000156ff2c  4c 83 c1 81 80 ff 56 01 - 99 66 e7 77 4c ff 56 01  L.....V..f.wL.V.
    000000000156ff3c  a9 66 e7 77 ed 10 90 7c - 00 75 10 00 a0 a3 0b 00  .f.w...|.u......
    000000000156ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xb70 <----*

    eax=774fe429 ebx=00007530 ecx=7ffdf000 edx=00000000 esi=00000000 edi=015aff50
    eip=7c90eb94 esp=015aff20 ebp=015aff78 iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
    ChildEBP RetAddr  Args to Child             
    015aff78 7c802451 0000ea60 00000000 015affb4 ntdll!KiFastSystemCallRet
    015aff88 774fe31d 0000ea60 0010f4d8 774fe3dc kernel32!Sleep+0xf
    015affb4 7c80b683 0010f4d8 7c910945 7c91094e ole32!StringFromGUID2+0x51b
    015affec 00000000 774fe429 0010f4d8 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015aff20  5c d8 90 7c ed 23 80 7c - 00 00 00 00 50 ff 5a 01  \..|.#.|....P.Z.
    00000000015aff30  40 25 80 7c f8 6d 60 77 - 30 75 00 00 14 00 00 00  @%.|.m`w0u......
    00000000015aff40  01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00  ................
    00000000015aff50  00 ba 3c dc ff ff ff ff - 00 d1 4e 77 50 ff 5a 01  ..<.......NwP.Z.
    00000000015aff60  30 ff 5a 01 20 53 10 00 - dc ff 5a 01 a8 9a 83 7c  0.Z. S....Z....|
    00000000015aff70  58 24 80 7c 00 00 00 00 - 88 ff 5a 01 51 24 80 7c  X$.|......Z.Q$.|
    00000000015aff80  60 ea 00 00 00 00 00 00 - b4 ff 5a 01 1d e3 4f 77  `.........Z...Ow
    00000000015aff90  60 ea 00 00 d8 f4 10 00 - dc e3 4f 77 00 00 00 00  `.........Ow....
    00000000015affa0  45 09 91 7c d8 f4 10 00 - 00 00 4e 77 44 e4 4f 77  E..|......NwD.Ow
    00000000015affb0  4e 09 91 7c ec ff 5a 01 - 83 b6 80 7c d8 f4 10 00  N..|..Z....|....
    00000000015affc0  45 09 91 7c 4e 09 91 7c - d8 f4 10 00 00 80 fd 7f  E..|N..|........
    00000000015affd0  00 46 3c 82 c0 ff 5a 01 - b0 f0 16 82 ff ff ff ff  .F<...Z.........
    00000000015affe0  a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00  ...|...|........
    00000000015afff0  00 00 00 00 29 e4 4f 77 - d8 f4 10 00 00 00 00 00  ....).Ow........
    00000000015b0000  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0010  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0020  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0030  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0040  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015b0050  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xb78 <----*

    eax=77e76bf0 ebx=00000000 ecx=0156faac edx=7c809740 esi=00108888 edi=00000100
    eip=7c90eb94 esp=015efe1c ebp=015eff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    015eff80 77e76c22 015effa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    015eff88 77e76a3b 00108888 00000040 0156fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    015effa8 77e76c0a 000a77d0 015effec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    015effb4 7c80b683 000ef7b0 00000040 0156fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    015effec 00000000 77e76bf0 000ef7b0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015efe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 5e 01  ...|.g.w....p.^.
    00000000015efe2c  00 00 00 00 08 bd 10 00 - 54 ff 5e 01 6c 00 79 00  ........T.^.l.y.
    00000000015efe3c  20 00 63 00 72 00 65 00 - 61 00 74 00 65 00 64 00   .c.r.e.a.t.e.d.
    00000000015efe4c  2e 00 2c 00 45 00 72 00 - 72 00 6f 00 72 00 20 00  ..,.E.r.r.o.r. .
    00000000015efe5c  25 00 64 00 20 00 74 00 - 6f 00 20 00 63 00 6f 00  %.d. .t.o. .c.o.
    00000000015efe6c  70 00 79 00 20 00 74 00 - 68 00 65 00 20 00 64 00  p.y. .t.h.e. .d.
    00000000015efe7c  65 00 66 00 61 00 75 00 - 6c 00 74 00 20 00 74 00  e.f.a.u.l.t. .t.
    00000000015efe8c  65 00 6d 00 70 00 6c 00 - 61 00 74 00 65 00 20 00  e.m.p.l.a.t.e. .
    00000000015efe9c  74 00 6f 00 20 00 25 00 - 73 00 2e 00 20 00 45 00  t.o. .%.s... .E.
    00000000015efeac  72 00 72 00 6f 00 72 00 - 20 00 25 00 64 00 20 00  r.r.o.r. .%.d. .
    00000000015efebc  74 00 6f 00 20 00 63 00 - 72 00 65 00 61 00 74 00  t.o. .c.r.e.a.t.
    00000000015efecc  65 00 20 00 64 00 69 00 - 72 00 65 00 63 00 74 00  e. .d.i.r.e.c.t.
    00000000015efedc  6f 00 72 00 79 00 20 00 - 25 00 73 00 2e 00 2a 00  o.r.y. .%.s...*.
    00000000015efeec  4e 00 6f 00 74 00 20 00 - 65 00 6e 00 6f 00 75 00  N.o.t. .e.n.o.u.
    00000000015efefc  67 00 68 00 20 00 6d 00 - 65 00 6d 00 6f 00 72 00  g.h. .m.e.m.o.r.
    00000000015eff0c  79 00 20 00 74 00 6f 00 - 44 bf f5 81 24 dc dc f2  y. .t.o.D...$...
    00000000015eff1c  b2 c2 4d 80 ba c2 4d 80 - 14 bf f5 81 a8 bd f5 81  ..M...M.........
    00000000015eff2c  dc bd f5 81 80 ff 5e 01 - 99 66 e7 77 4c ff 5e 01  ......^..f.wL.^.
    00000000015eff3c  a9 66 e7 77 ed 10 90 7c - 40 91 10 00 b0 f7 0e 00  .f.w...|@.......
    00000000015eff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xb80 <----*

    eax=77e76bf0 ebx=00000000 ecx=015efaac edx=7c809740 esi=00108888 edi=00000100
    eip=7c90eb94 esp=0162fe1c ebp=0162ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0162ff80 77e76c22 0162ffa8 77e76a3b 00108888 ntdll!KiFastSystemCallRet
    0162ff88 77e76a3b 00108888 00000004 015efb58 RPCRT4!I_RpcBCacheFree+0x5ea
    0162ffa8 77e76c0a 000a77d0 0162ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0162ffb4 7c80b683 00108f68 00000004 015efb58 RPCRT4!I_RpcBCacheFree+0x5d2
    0162ffec 00000000 77e76bf0 00108f68 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000162fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 62 01  ...|.g.w....p.b.
    000000000162fe2c  00 00 00 00 00 a7 10 00 - 54 ff 62 01 08 00 00 00  ........T.b.....
    000000000162fe3c  50 04 d1 81 50 04 d1 81 - 38 4b ba f2 8c 39 4e 80  P...P...8K...9N.
    000000000162fe4c  c0 04 d1 81 02 0b 19 82 - 00 00 00 00 54 4b ba f2  ............TK..
    000000000162fe5c  b5 46 4e 80 00 00 00 00 - ce 39 4e 80 08 90 ff 81  .FN......9N.....
    000000000162fe6c  98 0b 19 82 98 0b 19 82 - 68 4b ba f2 8b 66 89 f8  ........hK...f..
    000000000162fe7c  fc 0b 19 82 00 00 00 00 - 00 00 00 00 7c 4b ba f2  ............|K..
    000000000162fe8c  1a a4 6a f6 f8 0b 19 82 - 00 00 00 00 00 00 00 00  ..j.............
    000000000162fe9c  28 3b f0 81 a6 8b 59 f8 - 28 3b f0 81 98 0b 19 82  (;....Y.(;......
    000000000162feac  00 00 00 00 10 a9 01 82 - 60 ad 01 82 b0 ac 1c 82  ........`.......
    000000000162febc  c4 4b ba f2 9a 51 3b f8 - c0 44 1f 82 98 0b 19 82  .K...Q;..D......
    000000000162fecc  a9 51 3b f8 40 a9 01 82 - 10 a9 01 82 00 00 00 00  .Q;.@...........
    000000000162fedc  b0 ac 1c 82 00 00 00 00 - dc 4b ba f2 49 59 3b f8  .........K..IY;.
    000000000162feec  6c 59 3b f8 dc 4b ba f2 - 00 00 00 00 51 c4 c7 f7  lY;..K......Q...
    000000000162fefc  f8 4b ba f2 5d 39 c8 f7 - 00 9c c8 f7 a0 32 21 82  .K..]9.......2!.
    000000000162ff0c  58 f2 ec 81 d0 23 0e 82 - e4 05 13 82 24 4c ba f2  X....#......$L..
    000000000162ff1c  b2 c2 4d 80 ba c2 4d 80 - b4 05 13 82 48 04 13 82  ..M...M.....H...
    000000000162ff2c  7c 04 13 82 80 ff 62 01 - 99 66 e7 77 4c ff 62 01  |.....b..f.wL.b.
    000000000162ff3c  a9 66 e7 77 ed 10 90 7c - 80 8d 10 00 68 8f 10 00  .f.w...|....h...
    000000000162ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

     

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     


    Application exception occurred:
            App: C:\WINDOWS\system32\WgaTray.exe (pid=2580)
            When: 4/4/2007 @ 05:05:28.046
            Exception number: c0000005 (access violation)

    *----> System Information <----*
            Computer Name: HOME
            User Name: helene
            Terminal Session Id: 0
            Number of Processors: 1
            Processor Type: x86 Family 6 Model 8 Stepping 1
            Windows Version: 5.1
            Current Build: 2600
            Service Pack: 2
            Current Type: Uniprocessor Free
            Registered Organization: home
            Registered Owner: Helene McKenzie

    *----> Task List <----*
       0 System Process
       4 System
     460 smss.exe
     516 csrss.exe
     540 winlogon.exe
     584 services.exe
     596 lsass.exe
     752 svchost.exe
     800 svchost.exe
     868 svchost.exe
     888 InCDsrv.exe
    1072 svchost.exe
    1192 svchost.exe
    1324 spoolsv.exe
    1504 Explorer.EXE
    1628 InCD.exe
    1640 avgcc.exe
    1652 Error 0xD0000022
    1664 jusched.exe
    1676 HPWuSchd2.exe
    1728 RUNDLL32.EXE
    1736 RunDll32.exe
    1744 avgas.exe
    1760 ctfmon.exe
    1792 reader_sl.exe
    1808 QuickDCF.exe
    1820 hpqtra08.exe
    1852 soffice.exe
    1860 soffice.BIN
    1936 Error 0xD0000022
    1952 avgamsvr.exe
    1968 avgupsvc.exe
    1992 avgemc.exe
     168 Error 0xD0000022
     232 nvsvc32.exe
     412 hpqSTE08.exe
     492 HPZipm12.exe
     836 svchost.exe
    2424 alg.exe
    2580 WgaTray.exe
    2616 wmiprvse.exe
    2808 svchost.exe
    2956 hprblog.exe
    2992 wuauclt.exe
    3052 wuauclt.exe
    3088 drwtsn32.exe

    *----> Module List <----*
    (0000000000400000 - 0000000000409000: C:\WINDOWS\system32\Normaliz.dll
    (0000000001000000 - 0000000001052000: C:\WINDOWS\system32\WgaTray.exe
    (0000000001290000 - 00000000013f9000: C:\WINDOWS\system32\legitcheckcontrol.dll
    (000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
    (0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
    (000000004d4f0000 - 000000004d548000: C:\WINDOWS\system32\WINHTTP.dll
    (000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
    (000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\netapi32.dll
    (000000006e850000 - 000000006e895000: C:\WINDOWS\system32\iertutil.dll
    (0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
    (0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\ws2_32.dll
    (00000000722b0000 - 00000000722b5000: C:\WINDOWS\system32\SensApi.dll
    (0000000074720000 - 000000007476b000: C:\WINDOWS\system32\MSCTF.dll
    (0000000074980000 - 0000000074a8e000: C:\WINDOWS\system32\msxml3.dll
    (0000000074ed0000 - 0000000074ede000: C:\WINDOWS\system32\wbem\wbemsvc.dll
    (0000000074ef0000 - 0000000074ef8000: C:\WINDOWS\system32\wbem\wbemprox.dll
    (0000000075290000 - 00000000752c7000: C:\WINDOWS\system32\wbem\wbemcomn.dll
    (0000000075690000 - 0000000075706000: C:\WINDOWS\system32\wbem\fastprox.dll
    (0000000075e60000 - 0000000075e73000: C:\WINDOWS\system32\cryptnet.dll
    (0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
    (0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP60.dll
    (0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL
    (00000000767a0000 - 00000000767b3000: C:\WINDOWS\system32\NTDSAPI.dll
    (00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\userenv.dll
    (0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WinTrust.dll
    (0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
    (0000000076f20000 - 0000000076f47000: C:\WINDOWS\system32\DNSAPI.dll
    (0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
    (0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
    (0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
    (0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
    (00000000771b0000 - 000000007727f000: C:\WINDOWS\system32\WININET.dll
    (00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll
    (00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
    (0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
    (0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
    (0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
    (0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
    (0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
    (0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
    (0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
    (0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
    (0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
    (0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll
    (0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
    (0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\secur32.dll
    (000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
    (000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
    (000000007c9c0000 - 000000007d1d5000: C:\WINDOWS\system32\SHELL32.dll

    *----> State Dump for Thread Id 0xa18 <----*

    eax=00000616 ebx=00000000 ecx=6f16d46f edx=7b1a618f esi=b54cda56 edi=03d8d30c
    eip=01650bbf esp=0006e95c ebp=0006e9ac iopl=0         nv up ei pl nz ac po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216

    function: <nosymbols>
            01650b9d 5d               pop     ebp
            01650b9e e88145e8f7       call    f94d5124
            01650ba3 20b9608145e8     and     [ecx+0xe8458160],bh
            01650ba9 c2587e           ret     0x7e58
            01650bac 3d8b7de8c7       cmp     eax,0xc7e87d8b
            01650bb1 45               inc     ebp
            01650bb2 d420             aam     ???
            01650bb4 0000             add     [eax],al
            01650bb6 00897de88bfa     add     [ecx+0xfa8be87d],cl
            01650bbc c1ef05           shr     edi,0x5
    FAULT ->01650bbf 8bda             mov     ebx,edx
            01650bc1 c1e304           shl     ebx,0x4
            01650bc4 33fb             xor     edi,ebx
            01650bc6 ff4dd4           dec     dword ptr [ebp-0x2c]
            01650bc9 8bde             mov     ebx,esi
            01650bcb c1eb0b           shr     ebx,0xb
            01650bce 83e303           and     ebx,0x3
            01650bd1 8b5c9dec         mov     ebx,[ebp+ebx*4-0x14]
            01650bd5 03de             add     ebx,esi
            01650bd7 2b75e8           sub     esi,[ebp-0x18]
            01650bda 03fa             add     edi,edx

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\legitcheckcontrol.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\OLEAUT32.dll -
    *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\WgaTray.exe
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
    ChildEBP RetAddr  Args to Child             
    0006e9ac 01640b6c 0006e9c0 01292ec4 00000000 0x1650bbf
    0006ebcc 012c0781 0006f198 01292ec4 00000000 0x1640b6c
    0006efe8 012b86b4 0006f01c 00000104 01292ec4 legitcheckcontrol+0x30781
    0006f124 012b9341 009d9168 00000003 014037fc legitcheckcontrol+0x286b4
    0006f150 012aadf4 00000001 00000001 00000000 legitcheckcontrol+0x29341
    0006fad8 771273d0 014037f0 0006fb38 0006fbf8 legitcheckcontrol+0x1adf4
    0006faf4 771279e0 014037f0 0000001c 00000004 OLEAUT32!DispCallFunc+0xc3
    0006fb84 012abac0 000c4ccc 014037f0 00000000 OLEAUT32!DispCallFunc+0x6d3
    0006fbb0 01009999 014037f0 00000001 01002df0 legitcheckcontrol+0x1bac0
    0006fc48 0100aea8 0006fc74 0006fc88 0006fc90 WgaTray+0x9999
    0006feb4 0100bd0b 01043020 02fac500 01043024 WgaTray+0xaea8
    0006ff10 0100dc03 01000000 00000000 0002061a WgaTray+0xbd0b
    0006ffa8 0103004b 00db2748 018af944 7ffdf000 WgaTray+0xdc03
    0006ffc0 7c816fd7 00db2748 018af944 7ffdf000 WgaTray+0x3004b
    0006fff0 00000000 0102ffd4 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49

    *----> Raw Stack Dump <----*
    000000000006e95c  98 f1 06 00 04 01 00 00 - 00 00 00 00 28 0a 00 00  ............(...
    000000000006e96c  02 00 00 00 30 48 40 01 - 01 00 00 00 00 00 00 00  ....0H@.........
    000000000006e97c  05 00 00 00 06 00 00 00 - 04 04 00 00 00 00 66 01  ..............f.
    000000000006e98c  08 04 00 00 6d 11 00 00 - b9 79 37 9e 12 98 ef 6b  ....m....y7....k
    000000000006e99c  12 c5 cc e4 98 42 71 08 - 96 ee d2 3e 16 3b 06 00  .....Bq....>.;..
    000000000006e9ac  cc eb 06 00 6c 0b 64 01 - c0 e9 06 00 c4 2e 29 01  ....l.d.......).
    000000000006e9bc  00 00 00 00 43 3a 5c 57 - 49 4e 44 4f 57 53 5c 73  ....C:\WINDOWS\s
    000000000006e9cc  79 73 74 65 6d 33 32 5c - 4f 45 4d 42 49 4f 53 2e  ystem32\OEMBIOS.
    000000000006e9dc  44 41 54 00 00 00 00 00 - 00 00 00 00 00 00 00 00  DAT.............
    000000000006e9ec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006e9fc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea2c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea3c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea4c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea5c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea6c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea7c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000006ea8c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa1c <----*

    eax=00000000 ebx=003efed0 ecx=003eff7c edx=00000000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=003efea8 ebp=003eff44 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    003eff44 77df9b26 00000002 003eff6c 00000000 ntdll!KiFastSystemCallRet
    003effb4 7c80b683 00000000 7c9140bb 00000000 ADVAPI32!RegDeleteKeyW+0x2a2
    003effec 00000000 77df9981 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000003efea8  ab e9 90 7c e2 94 80 7c - 02 00 00 00 d0 fe 3e 00  ...|...|......>.
    00000000003efeb8  01 00 00 00 01 00 00 00 - 04 ff 3e 00 e0 2e 82 00  ..........>.....
    00000000003efec8  40 65 e4 77 00 10 00 00 - 5c 00 00 00 68 00 00 00  @e.w....\...h...
    00000000003efed8  c0 fe 3e 00 ec 4b 4d f3 - dc ff 3e 00 a8 9a 83 7c  ..>..KM...>....|
    00000000003efee8  b0 0a 81 7c 00 10 00 00 - 14 00 00 00 01 00 00 00  ...|............
    00000000003efef8  00 00 00 00 00 00 00 00 - 10 00 00 00 00 a2 2f 4d  ............../M
    00000000003eff08  ff ff ff ff 00 10 00 00 - 00 f0 fd 7f 00 d0 fd 7f  ................
    00000000003eff18  dc ff 3e 00 04 ff 3e 00 - d0 fe 3e 00 06 00 00 00  ..>...>...>.....
    00000000003eff28  02 00 00 00 c4 fe 3e 00 - 06 00 00 00 dc ff 3e 00  ......>.......>.
    00000000003eff38  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 b4 ff 3e 00  ...|...|......>.
    00000000003eff48  26 9b df 77 02 00 00 00 - 6c ff 3e 00 00 00 00 00  &..w....l.>.....
    00000000003eff58  e0 93 04 00 01 00 00 00 - bb 40 91 7c 00 00 00 00  .........@.|....
    00000000003eff68  00 00 00 00 5c 00 00 00 - 68 00 00 00 00 10 00 00  ....\...h.......
    00000000003eff78  e0 2e 82 00 00 00 00 00 - 00 10 00 00 e8 3e 82 00  .............>..
    00000000003eff88  a0 66 e4 77 28 00 00 00 - 80 66 e4 77 00 10 00 00  .f.w(....f.w....
    00000000003eff98  00 00 00 00 a0 66 e4 77 - e0 2e 82 00 80 66 e4 77  .....f.w.....f.w
    00000000003effa8  e5 03 00 00 00 10 00 00 - e8 3e 82 00 ec ff 3e 00  .........>....>.
    00000000003effb8  83 b6 80 7c 00 00 00 00 - bb 40 91 7c 00 00 00 00  ...|.....@.|....
    00000000003effc8  00 00 00 00 00 d0 fd 7f - 00 46 3c 82 c0 ff 3e 00  .........F<...>.
    00000000003effd8  00 4e 1b 82 ff ff ff ff - a8 9a 83 7c 90 b6 80 7c  .N.........|...|

    *----> State Dump for Thread Id 0xa24 <----*

    eax=000000c0 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
    eip=7c90eb94 esp=010dfcec ebp=010dffb4 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    010dffb4 7c80b683 00000000 00090000 00000000 ntdll!KiFastSystemCallRet
    010dffec 00000000 7c929fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000010dfcec  ab e9 90 7c d5 a0 92 7c - 14 00 00 00 30 fd 0d 01  ...|...|....0...
    00000000010dfcfc  01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 09 00  ................
    00000000010dfd0c  00 00 00 00 00 00 00 00 - 08 e5 97 7c 08 e5 97 7c  ...........|...|
    00000000010dfd1c  c4 01 00 00 24 0a 00 00 - 14 00 00 00 14 00 00 00  ....$...........
    00000000010dfd2c  13 00 00 00 bc 01 00 00 - 44 00 00 00 00 02 00 00  ........D.......
    00000000010dfd3c  10 02 00 00 2c 02 00 00 - 38 02 00 00 44 02 00 00  ....,...8...D...
    00000000010dfd4c  74 02 00 00 78 02 00 00 - 80 02 00 00 8c 02 00 00  t...x...........
    00000000010dfd5c  94 02 00 00 a0 02 00 00 - ac 02 00 00 b8 02 00 00  ................
    00000000010dfd6c  c0 02 00 00 cc 02 00 00 - d8 02 00 00 e4 02 00 00  ................
    00000000010dfd7c  ec 02 00 00 2c 04 00 00 - 38 04 00 00 44 04 00 00  ....,...8...D...
    00000000010dfd8c  50 04 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  P...............
    00000000010dfd9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdac  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdcc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfddc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdec  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfdfc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe0c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000010dfe1c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa28 <----*

    eax=00000000 ebx=0111fef4 ecx=7ffdf000 edx=7ffda000 esi=00000000 edi=7ffdf000
    eip=7c90eb94 esp=0111fecc ebp=0111ff68 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\userenv.dll -
    ChildEBP RetAddr  Args to Child             
    0111ff68 7c80a075 00000003 76a60310 00000000 ntdll!KiFastSystemCallRet
    0111ff84 769c888d 00000003 76a60310 00000000 kernel32!WaitForMultipleObjects+0x18
    0111ffb4 7c80b683 00000000 00000000 00000000 userenv!UnregisterGPNotification+0x15c
    0111ffec 00000000 769c8831 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000111fecc  ab e9 90 7c e2 94 80 7c - 03 00 00 00 f4 fe 11 01  ...|...|........
    000000000111fedc  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111feec  b8 03 a6 76 47 9b 80 7c - 14 02 00 00 18 02 00 00  ...vG..|........
    000000000111fefc  1c 02 00 00 5c fe 11 01 - 6c ff 11 01 6c ff 11 01  ....\...l...l...
    000000000111ff0c  18 ee 90 7c 70 05 91 7c - 14 00 00 00 01 00 00 00  ...|p..|........
    000000000111ff1c  00 00 00 00 00 00 00 00 - 10 00 00 00 f6 1b 80 7c  ...............|
    000000000111ff2c  00 00 00 00 00 00 00 00 - 00 f0 fd 7f 00 a0 fd 7f  ................
    000000000111ff3c  48 f8 0b 00 00 00 00 00 - f4 fe 11 01 00 00 00 00  H...............
    000000000111ff4c  03 00 00 00 e8 fe 11 01 - 00 00 00 00 dc ff 11 01  ................
    000000000111ff5c  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 84 ff 11 01  ...|...|........
    000000000111ff6c  75 a0 80 7c 03 00 00 00 - 10 03 a6 76 00 00 00 00  u..|.......v....
    000000000111ff7c  ff ff ff ff 00 00 00 00 - b4 ff 11 01 8d 88 9c 76  ...............v
    000000000111ff8c  03 00 00 00 10 03 a6 76 - 00 00 00 00 ff ff ff ff  .......v........
    000000000111ff9c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 9c 76  ...............v
    000000000111ffac  03 00 00 00 00 00 00 00 - ec ff 11 01 83 b6 80 7c  ...............|
    000000000111ffbc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    000000000111ffcc  00 a0 fd 7f 00 46 3c 82 - c0 ff 11 01 30 7a 18 82  .....F<.....0z..
    000000000111ffdc  ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00  .......|...|....
    000000000111ffec  00 00 00 00 00 00 00 00 - 31 88 9c 76 00 00 00 00  ........1..v....
    000000000111fffc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa2c <----*

    eax=77e76bf0 ebx=00000000 ecx=00000009 edx=7c910732 esi=00102460 edi=00000000
    eip=7c90eb94 esp=0157fe1c ebp=0157ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll -
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0157ff80 77e76c22 0157ffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    0157ff88 77e76a3b 00102460 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5ea
    0157ffa8 77e76c0a 000a77d0 0157ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0157ffb4 7c80b683 000ba3a0 00000000 0006dde4 RPCRT4!I_RpcBCacheFree+0x5d2
    0157ffec 00000000 77e76bf0 000ba3a0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000157fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 57 01  ...|.g.w....p.W.
    000000000157fe2c  00 00 00 00 30 96 10 00 - 54 ff 57 01 5d c3 8b c0  ....0...T.W.]...
    000000000157fe3c  55 8b ec 33 c0 55 68 ac - c7 42 00 64 ff 30 64 89  U..3.Uh..B.d.0d.
    000000000157fe4c  20 ff 05 5c 38 69 00 75 - 7d a1 68 36 69 00 e8 a9   ..\8i.u}.h6i...
    000000000157fe5c  19 ff ff a1 50 38 69 00 - 8b 10 ff 52 14 e8 ce f5  ....P8i....R....
    000000000157fe6c  ff ff 33 d2 33 c0 e8 ad - 7b ff ff b8 6c 38 69 00  ..3.3...{...l8i.
    000000000157fe7c  e8 97 5e fe ff e8 de b4 - fd ff 8d 80 0c 00 00 00  ..^.............
    000000000157fe8c  e8 87 5e fe ff b8 64 38 - 69 00 e8 7d 5e fe ff b8  ..^...d8i..}^...
    000000000157fe9c  50 38 69 00 e8 9b ad fd - ff b8 84 bd 42 00 e8 29  P8i.........B..)
    000000000157feac  ac fd ff b8 4c b5 66 00 - e8 5f 5e fe ff e8 6a d4  ....L.f.._^...j.
    000000000157febc  ff ff b8 68 38 69 00 e8 - 50 5e fe ff b8 50 38 69  ...h8i..P^...P8i
    000000000157fecc  00 e8 6e ad fd ff 33 c0 - 5a 59 59 64 89 10 68 b3  ..n...3.ZYYd..h.
    000000000157fedc  c7 42 00 c3 e9 93 83 fd - ff eb f8 5d c3 8d 40 00  .B.........]..@.
    000000000157feec  55 8b ec 33 c0 55 68 41 - c8 42 00 64 ff 30 64 89  U..3.UhA.B.d.0d.
    000000000157fefc  20 83 2d 5c 38 69 00 01 - 73 61 e8 e5 d3 ff ff b8   .-\8i..sa......
    000000000157ff0c  ff ff ff ff 46 02 00 00 - 2c 87 e0 81 24 7c 0d f3  ....F...,...$|..
    000000000157ff1c  b2 c2 4d 80 ba c2 4d 80 - fc 86 e0 81 90 85 e0 81  ..M...M.........
    000000000157ff2c  c4 85 e0 81 80 ff 57 01 - 99 66 e7 77 4c ff 57 01  ......W..f.wL.W.
    000000000157ff3c  a9 66 e7 77 ed 10 90 7c - 70 75 10 00 a0 a3 0b 00  .f.w...|pu......
    000000000157ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xa30 <----*

    eax=774fe429 ebx=00007530 ecx=7ffdf000 edx=00000000 esi=00000000 edi=015bff50
    eip=7c90eb94 esp=015bff20 ebp=015bff78 iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll -
    ChildEBP RetAddr  Args to Child             
    015bff78 7c802451 0000ea60 00000000 015bffb4 ntdll!KiFastSystemCallRet
    015bff88 774fe31d 0000ea60 0010ece0 774fe3dc kernel32!Sleep+0xf
    015bffb4 7c80b683 0010ece0 7c910945 7c91094e ole32!StringFromGUID2+0x51b
    015bffec 00000000 774fe429 0010ece0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015bff20  5c d8 90 7c ed 23 80 7c - 00 00 00 00 50 ff 5b 01  \..|.#.|....P.[.
    00000000015bff30  40 25 80 7c f8 6d 60 77 - 30 75 00 00 14 00 00 00  @%.|.m`w0u......
    00000000015bff40  01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00  ................
    00000000015bff50  00 ba 3c dc ff ff ff ff - 2c ff 5b 01 50 ff 5b 01  ..<.....,.[.P.[.
    00000000015bff60  30 ff 5b 01 2c ff 5b 01 - dc ff 5b 01 a8 9a 83 7c  0.[.,.[...[....|
    00000000015bff70  58 24 80 7c 00 00 00 00 - 88 ff 5b 01 51 24 80 7c  X$.|......[.Q$.|
    00000000015bff80  60 ea 00 00 00 00 00 00 - b4 ff 5b 01 1d e3 4f 77  `.........[...Ow
    00000000015bff90  60 ea 00 00 e0 ec 10 00 - dc e3 4f 77 00 00 00 00  `.........Ow....
    00000000015bffa0  45 09 91 7c e0 ec 10 00 - 00 00 4e 77 44 e4 4f 77  E..|......NwD.Ow
    00000000015bffb0  4e 09 91 7c ec ff 5b 01 - 83 b6 80 7c e0 ec 10 00  N..|..[....|....
    00000000015bffc0  45 09 91 7c 4e 09 91 7c - e0 ec 10 00 00 80 fd 7f  E..|N..|........
    00000000015bffd0  00 46 3c 82 c0 ff 5b 01 - 10 83 18 82 ff ff ff ff  .F<...[.........
    00000000015bffe0  a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00  ...|...|........
    00000000015bfff0  00 00 00 00 29 e4 4f 77 - e0 ec 10 00 00 00 00 00  ....).Ow........
    00000000015c0000  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0010  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0020  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0030  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0040  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
    00000000015c0050  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

    *----> State Dump for Thread Id 0xa34 <----*

    eax=77e76bf0 ebx=00000000 ecx=0157faac edx=7c809740 esi=00102460 edi=00102504
    eip=7c90eb94 esp=015ffe1c ebp=015fff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    015fff80 77e76c22 015fffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    015fff88 77e76a3b 00102460 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    015fffa8 77e76c0a 000a77d0 015fffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    015fffb4 7c80b683 000ef7b0 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    015fffec 00000000 77e76bf0 000ef7b0 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    00000000015ffe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 5f 01  ...|.g.w....p._.
    00000000015ffe2c  00 00 00 00 00 a7 10 00 - 54 ff 5f 01 51 ff 52 28  ........T._.Q.R(
    00000000015ffe3c  6a 01 8b ce e8 49 41 00 - 00 8b 46 2c 8b 7d 10 3b  j....IA...F,.}.;
    00000000015ffe4c  fb c6 40 49 01 74 22 8b - 4e 2c 83 c1 18 8b 41 04  ..@I.t".N,....A.
    00000000015ffe5c  3b c3 74 05 8b 40 04 eb - 02 33 c0 50 57 ff 15 f4  ;.t..@...3.PW...
    00000000015ffe6c  90 96 00 8b 07 57 ff 50 - 04 8d 45 08 8b ce 50 e8  .....W.P..E...P.
    00000000015ffe7c  5a 42 00 00 8b 4e 2c 8b - 00 83 c1 34 8b 11 89 01  ZB...N,....4....
    00000000015ffe8c  3b d3 74 06 8b 02 52 ff - 50 08 8b 46 2c 8b ce ff  ;.t...R.P..F,...
    00000000015ffe9c  70 34 e8 19 17 00 00 89 - 45 08 8b 46 2c 8b 48 38  p4......E..F,.H8
    00000000015ffeac  3b cb 75 59 6a 08 e8 c7 - 16 2e 00 8b f8 59 3b fb  ;.uYj........Y;.
    00000000015ffebc  74 10 8b cf ff 15 34 92 - 96 00 c7 07 cc a9 a3 00  t.....4.........
    00000000015ffecc  eb 02 33 ff 8b 46 2c 89 - 78 38 8b 46 2c 39 58 38  ..3..F,.x8.F,9X8
    00000000015ffedc  75 30 53 8b ce e8 a8 40 - 00 00 a1 4c 70 b4 00 83  u0S....@...Lp...
    00000000015ffeec  78 04 04 7c 0c 68 90 8f - b0 00 ff 15 70 7c 96 00  x..|.h......p|..
    00000000015ffefc  59 6a 01 68 05 40 00 80 - e9 b4 fe ff ff 8b 01 ff  Yj.h.@..........
    00000000015fff0c  50 04 8b 46 1c 8b 3d cc - 5c 57 e3 81 24 bc 0e f3  P..F..=.\W..$...
    00000000015fff1c  b2 c2 4d 80 ba c2 4d 80 - 2c 57 e3 81 c0 55 e3 81  ..M...M.,W...U..
    00000000015fff2c  f4 55 e3 81 80 ff 5f 01 - 99 66 e7 77 4c ff 5f 01  .U...._..f.wL._.
    00000000015fff3c  a9 66 e7 77 ed 10 90 7c - b0 77 10 00 b0 f7 0e 00  .f.w...|.w......
    00000000015fff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    *----> State Dump for Thread Id 0xa88 <----*

    eax=77e76bf0 ebx=00000000 ecx=0157faac edx=7c809740 esi=00102460 edi=00102504
    eip=7c90eb94 esp=0163fe1c ebp=0163ff80 iopl=0         nv up ei pl zr na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

    function: ntdll!KiFastSystemCallRet
            7c90eb89 90               nop
            7c90eb8a 90               nop
            ntdll!KiFastSystemCall:
            7c90eb8b 8bd4             mov     edx,esp
            7c90eb8d 0f34             sysenter
            7c90eb8f 90               nop
            7c90eb90 90               nop
            7c90eb91 90               nop
            7c90eb92 90               nop
            7c90eb93 90               nop
            ntdll!KiFastSystemCallRet:
            7c90eb94 c3               ret
            7c90eb95 8da42400000000   lea     esp,[esp]
            7c90eb9c 8d642400         lea     esp,[esp]
            7c90eba0 90               nop
            7c90eba1 90               nop
            7c90eba2 90               nop
            7c90eba3 90               nop
            7c90eba4 90               nop
            ntdll!KiIntSystemCall:
            7c90eba5 8d542408         lea     edx,[esp+0x8]
            7c90eba9 cd2e             int     2e

    *----> Stack Back Trace <----*
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ChildEBP RetAddr  Args to Child             
    0163ff80 77e76c22 0163ffa8 77e76a3b 00102460 ntdll!KiFastSystemCallRet
    0163ff88 77e76a3b 00102460 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5ea
    0163ffa8 77e76c0a 000a77d0 0163ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x403
    0163ffb4 7c80b683 0011a308 00000040 0157fb58 RPCRT4!I_RpcBCacheFree+0x5d2
    0163ffec 00000000 77e76bf0 0011a308 00000000 kernel32!GetModuleFileNameA+0x1b4

    *----> Raw Stack Dump <----*
    000000000163fe1c  99 e3 90 7c 03 67 e7 77 - 9c 03 00 00 70 ff 63 01  ...|.g.w....p.c.
    000000000163fe2c  00 00 00 00 d0 a4 11 00 - 54 ff 63 01 02 00 00 00  ........T.c.....
    000000000163fe3c  a4 bb 0d f3 00 5a 0b 82 - 02 00 00 00 f8 7b 3c 82  .....Z.......{<.
    000000000163fe4c  a8 ac 56 80 f8 7b 3c 82 - 18 5a 0b 82 00 5a 0b 82  ..V..{<..Z...Z..
    000000000163fe5c  56 0a 00 00 55 0a 00 00 - e4 bb 0d f3 00 00 00 00  V...U...........
    000000000163fe6c  0e 00 00 00 94 02 00 00 - 00 00 00 00 38 43 56 80  ............8CV.
    000000000163fe7c  90 f7 90 e1 98 69 e2 81 - 98 bb 0d f3 e3 6e 56 80  .....i.......nV.
    000000000163fe8c  90 f7 90 e1 a0 02 00 00 - f8 7b 3c 82 90 f7 90 e1  .........{<.....
    000000000163fe9c  00 5a 0b 82 a0 02 00 00 - 00 00 00 00 9c f7 90 e1  .Z..............
    000000000163feac  40 c5 a7 e1 01 5a 0b 82 - b4 bb 0d f3 0a 70 56 80  @....Z.......pV.
    000000000163febc  90 f7 90 e1 40 c5 a7 e1 - f8 7b 3c 82 03 00 1f 00  ....@....{<.....
    000000000163fecc  00 5a 0b 82 a0 02 00 00 - fc bb 0d f3 eb aa 56 80  .Z............V.
    000000000163fedc  90 f7 90 e1 00 00 00 00 - 28 32 01 82 00 00 00 00  ........(2......
    000000000163feec  00 5a 0b 82 cc 6b e2 81 - 0a 00 00 00 01 00 00 00  .Z...k..........
    000000000163fefc  48 d5 e5 81 28 58 eb 81 - 02 00 00 00 00 5a 0b 82  H...(X.......Z..
    000000000163ff0c  03 00 1f 00 00 5a 0b 82 - 3c 7c 1a 82 24 bc 0d f3  .....Z..<|..$...
    000000000163ff1c  b2 c2 4d 80 ba c2 4d 80 - 0c 7c 1a 82 a0 7a 1a 82  ..M...M..|...z..
    000000000163ff2c  d4 7a 1a 82 80 ff 63 01 - 99 66 e7 77 4c ff 63 01  .z....c..f.wL.c.
    000000000163ff3c  a9 66 e7 77 ed 10 90 7c - e0 a2 11 00 08 a3 11 00  .f.w...|........
    000000000163ff4c  00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff  ../M.....]......

    Wednesday, April 4, 2007 3:14 AM
  • bump
    Wednesday, April 11, 2007 12:06 PM
  • Thanks for the reminder Girlfreddy,

    My Devs are still looking into this.

     

    Darin

    Thursday, April 12, 2007 8:43 PM
  • hi - i have the same problem with rebooting and IE freezing, same "stack unwind information could not be found" type error message but mine started only a couple weeks ago.  it was infrequent at first but it's happening more and more often now.  i'm also now getting "could not read memory at block [blahblah]" - am i correct in thinking my machine is going toward the light?

    Tuesday, January 1, 2008 2:38 PM