WindowsXP64 - Outlook Express crashes

I am using Outlook Express (6.0, SP1) as my news agent on a machine running
Windows XP 64bit OS (2003 SP1). It regularly crashes during synchronization
with the news.microsoft.com server. Generally when I click on the
synchronize button after first starting OE, it will crash when it gets to
polling for watched messages. I will send an error report and restart the
program, synchronize again, and it will crash, again. I will send an error
message, restart the program, and it will crash or run.

The experience has been that after two or three crashes, it will run.

I don't know if the problem is the OS or something else. When running on
WinXP Pro I didn't have the problem, though, so the OS is my first guess.

Thoughts or suggestions?

TIA

Charles Kenyon

 

Have a look here:
http://www.insideoe.com/problems/errors.htm#crash

 

Thanks, Bruce. And welcome to our little part of the world (even if only by
way of the OP dual posting. )

 

And welcome to mine. Hope the link helped the OP.

Bruce

 

Hello to you too Charlie, quiet here atm

 

Well, if you want to hear the screams, come on over to 64bit and explain why
spell checking doesn't work in OE.

 

Canned reply, Charlie.

OE 6 does not come with its own spell check. You need Word or an MS Office
program. The spell checker in the basic Works 4 through 6 will work with OE.
Older and newer versions do not. If you have Works Suite, that includes MS
Word and a spell checker that does work with OE. If you have such a program,
see:

Spell Checking does not work in OE:
http://mvps.org/PracticallyNerded/OE/OE_Spell check.htm

Or:
http://www.michaelstevenstech.com/spellcheck.htm

And: An error occurred while the spelling was being checked or: Spell Check
was halted:
http://support.microsoft.com/?kbid=224176

 

Yeah, we have one too, but it's different:

Outlook Express is a 64-bit program, and it doesn't have a spell checker of
its own. Instead, it is designed to take advantage of Microsoft Office's
spell checker. Unfortunately, MS Office is a 32-bit program and the spell
checking module is a 32-bit Dynamic Link Library (DLL). A 64-bit program can
not call a 32-bit DLL. (And, of course, a 32-bit program can't call a 64-bit
DLL.) The fix for this will require a 64-bit version of Office, I suspect.

Note: There have been some workarounds proposed to make this work, but
Microsoft has _very_ specifically said that they are a bad idea and that
they risk data corruption.

 

Well, that's out of my league. I've always used a free spell check download
myself.

Bruce

 

The best workaround so far is to copy and paste the text into a word
processor installed on your computer and run the grammar check and you are
good to go.

 

Thank you. It didn't help. None of the .dbx files is read only. I tried
compacting all folders, and that took about a minute to complete. Next
attempt at synchronization crashed.

I can start OE and open any newsgroup. The headers update and if I use Tools

The crashes seem to occur during a Synchronize All when watched messages are
being checked.

Charles Kenyon

--
Charles Kenyon

Word New User FAQ & Web Directory: http://addbalance.com/word

Intermediate User's Guide to Microsoft Word (supplemented version of
Microsoft's Legal Users' Guide) http://addbalance.com/usersguide

See also the MVP FAQ: http://word.mvps.org/FAQs/ which is awesome!
--------- --------- --------- --------- --------- ---------
This message is posted to a newsgroup. Please post replies
and questions to the newsgroup so that others can learn
from my ignorance and your wisdom.

 

The only other thing that comes to mind is a damaged identity. File |
Identity | Add New Identity. Create a new one and test it. If all is well,
you can import your messages from the old identity and delete it.

I never use the Sync option myself, so if this doesn't work, we will have to
get a suggestion from someone else.

 

If it's any consolation I had exactly the same problem, gave up trying to
solve it and I just don't watch messages any more

Peter Lawton

 

Additional information.

Once I get it to synchronize during a Windows session without crashing, it
won't crash again until the computer is restarted.
--
Charles Kenyon

Word New User FAQ & Web Directory: http://addbalance.com/word

Intermediate User's Guide to Microsoft Word (supplemented version of
Microsoft's Legal Users' Guide) http://addbalance.com/usersguide

See also the MVP FAQ: http://word.mvps.org/FAQs/ which is awesome!
--------- --------- --------- --------- --------- ---------
This message is posted to a newsgroup. Please post replies
and questions to the newsgroup so that others can learn
from my ignorance and your wisdom.

 

Mine just crashes in the background while I am working on other tasks. I
don't know whether it is during an update or just sitting there with
something else crashing it.
Since you are posted at my previous post, maybe you could send your current
crash file to Darrell who gave permission for me to send mine, but since I
rarely use it for work any more due to the many problems and lack of desired
programs, I don't have a recent file to send. Look at Darrell's postings in
that string for the file to send.

 

Watched messages are still a problem. Don't do it.

 

Details? E.g. capture the Error Signature
or even better extract the Stack Back Trace
for the failing thread (e.g. from drwtsn32.log
or do you have a drwtsn64.log now? <eg>)

FWIW I am not familiar with your version (e.g. to know
how much maintenance would be integrated with it)
but one intermittent problem which used to happen
in OE6sp1 was a crash in shlwapi.dll which seemed
to be related somehow to use of the troubleshooting log
(especially when a connection failed or the user hang up
the link.) Disabling the troubleshooting log was the
temporary "fix" for that one.


HTH

Robert Aldwinckle
---

 

The log from drwtsn32.log for the last crash is below.
It notes "*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\USER32.dll -
function: USER32!GetWindowLongPtrW"

Charles Kenyon


Application exception occurred:
App: C:\Program Files\Outlook Express\msimn.exe (pid=1348)
When: 1/28/2006 @ 19:03:31.453
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: CHARLES-LTX7IBG
User Name: Charles Kenyon
Terminal Session Id: 0
Number of Processors: 1
Processor Type: AMD64 Family 15 Model 4 Stepping 10
Windows Version: 5.2
Current Build: 3790
Service Pack: 1
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Charles Kenyon

*----> Task List <----*
0 System Process
4 System
184 smss.exe
332 csrss.exe
656 winlogon.exe
720 services.exe
732 lsass.exe
936 svchost.exe
1008 svchost.exe
188 svchost.exe
252 svchost.exe
412 svchost.exe
676 spoolsv.exe
464 Explorer.EXE
1172 NVMixerTray.exe
1196 RUNDLL32.EXE
1204 TeaTimer.exe
1212 ctfmon.exe
1376 ctfmon.exe
1388 avgcc.exe
1396 GoogleDesktop.exe
1408 GoogleDesktopIndex.exe
1440 DVDTray.exe
1476 PDVDServ.exe
1540 WinterWalltoy.exe
1604 jusched.exe
1668 avgamsvr.exe
1692 realsched.exe
1700 avgupsvc.exe
1708 GoogleDesktopCrawl.exe
1748 avgrssvc.exe
1840 avgemc.exe
1992 svchost.exe
408 LSSrvc.exe
516 svchost.exe
2372 wmiprvse.exe
3020 alg.exe
2968 GoogleDesktopOE.exe
1984 FIREFOX.EXE
1972 OUTLOOK.EXE
1348 msimn.exe
1636 dwwin.exe
1800 drwtsn32.exe

*----> Module List <----*
0000000001c30000 - 0000000001db7000:
C:\WINDOWS\WinSxS\AMD64_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.1830_x-ww_ACED72AF\comctl32.dll
00000000021e0000 - 0000000002436000: C:\WINDOWS\system32\SHDOCVW.DLL
0000000002550000 - 000000000267a000: C:\WINDOWS\system32\WININET.dll
0000000002890000 - 000000000296d000: C:\WINDOWS\system32\CLBCatQ.DLL
0000000002ec0000 - 0000000002fcc000: C:\WINDOWS\system32\urlmon.dll
0000000078c30000 - 0000000078d3c000: C:\WINDOWS\system32\USER32.dll
0000000078d40000 - 0000000078eb2000: C:\WINDOWS\system32\kernel32.dll
0000000078ec0000 - 0000000078ff9000: C:\WINDOWS\system32\ntdll.dll
0000000100000000 - 0000000100014000: C:\Program Files\Outlook
Express\msimn.exe
000007ff5c210000 - 000007ff5c4d7000: C:\WINDOWS\system32\xpsp2res.dll
000007ff5c900000 - 000007ff5c9c9000: C:\WINDOWS\system32\ws03res.dll
000007ff62c10000 - 000007ff62c20000: C:\WINDOWS\system32\PSTOREC.DLL
000007ff65fc0000 - 000007ff66221000: C:\Program Files\Outlook
Express\msoeres.dll
000007ff66230000 - 000007ff6628e000: C:\WINDOWS\system32\MSOEACCT.dll
000007ff66290000 - 000007ff664a6000: C:\Program Files\Outlook
Express\MSOE.DLL
000007ff66970000 - 000007ff66977000: C:\WINDOWS\system32\msidntld.dll
000007ff66980000 - 000007ff66994000: C:\WINDOWS\system32\msident.dll
000007ff6acb0000 - 000007ff6acbf000: C:\WINDOWS\system32\inetres.dll
000007ff6d1f0000 - 000007ff6d281000: C:\WINDOWS\system32\hnetcfg.dll
000007ff70c70000 - 000007ff70cc6000: C:\WINDOWS\system32\dxtrans.dll
000007ff70cf0000 - 000007ff70d7d000: C:\WINDOWS\system32\dxtmsft.dll
000007ff71db0000 - 000007ff71dd5000: C:\Program Files\Common
Files\System\directdb.dll
000007ff72430000 - 000007ff72442000: C:\WINDOWS\system32\ddrawex.dll
000007ff76c90000 - 000007ff76ca3000: C:\WINDOWS\system32\acctres.dll
000007ff76fa0000 - 000007ff76fab000: C:\WINDOWS\System32\wshtcpip.dll
000007ff76fe0000 - 000007ff7705c000: C:\WINDOWS\System32\mswsock.dll
000007ff77060000 - 000007ff770df000: C:\WINDOWS\system32\uxtheme.dll
000007ff770f0000 - 000007ff770fa000: C:\WINDOWS\system32\WSOCK32.DLL
000007ff77140000 - 000007ff7714c000: C:\WINDOWS\system32\WS2HELP.dll
000007ff77150000 - 000007ff77180000: C:\WINDOWS\system32\WS2_32.dll
000007ff771b0000 - 000007ff77248000: C:\WINDOWS\system32\NETAPI32.dll
000007ff79190000 - 000007ff79202000: C:\WINDOWS\system32\DDRAW.dll
000007ff793e0000 - 000007ff793e8000: C:\WINDOWS\system32\DCIMAN32.dll
000007ff7a170000 - 000007ff7a1cd000: C:\WINDOWS\system32\msls31.dll
000007ff7a1d0000 - 000007ff7a233000: C:\WINDOWS\system32\msimtf.dll
000007ff7a240000 - 000007ff7a2df000: C:\WINDOWS\system32\MSCTF.dll
000007ff7a2f0000 - 000007ff7a39f000: C:\WINDOWS\system32\mlang.dll
000007ff7a580000 - 000007ff7ab2f000: C:\WINDOWS\system32\mshtml.dll
000007ff7ac70000 - 000007ff7ad56000: C:\WINDOWS\system32\mshtmled.dll
000007ff7ada0000 - 000007ff7add1000: C:\WINDOWS\system32\MSOERT2.dll
000007ff7ade0000 - 000007ff7af01000: C:\WINDOWS\system32\INETCOMM.dll
000007ff7bb60000 - 000007ff7bc14000: C:\WINDOWS\system32\CRYPTUI.dll
000007ff7c720000 - 000007ff7c817000: C:\WINDOWS\system32\jscript.dll
000007ff7ca80000 - 000007ff7cc6d000: C:\WINDOWS\system32\SXS.DLL
000007ff7cf80000 - 000007ff7d016000: C:\WINDOWS\system32\shdoclc.dll
000007ff7d150000 - 000007ff7d17a000: C:\WINDOWS\system32\MSASN1.dll
000007ff7d180000 - 000007ff7d2df000: C:\WINDOWS\system32\CRYPT32.dll
000007ff7d320000 - 000007ff7d359000: C:\WINDOWS\system32\IMM32.DLL
000007ff7e040000 - 000007ff7e05c000: C:\WINDOWS\system32\ATL.DLL
000007ff7e210000 - 000007ff7e25e000: C:\WINDOWS\system32\WINTRUST.dll
000007ff7e2a0000 - 000007ff7e2b3000: C:\WINDOWS\system32\imagehlp.dll
000007ff7e720000 - 000007ff7e76e000: C:\WINDOWS\system32\DNSAPI.dll
000007ff7e780000 - 000007ff7e7e6000: C:\WINDOWS\system32\WLDAP32.dll
000007ff7e7f0000 - 000007ff7e812000: C:\WINDOWS\system32\Secur32.dll
000007ff7e820000 - 000007ff7e82b000: C:\WINDOWS\System32\winrnr.dll
000007ff7e830000 - 000007ff7e837000: C:\WINDOWS\system32\rasadhlp.dll
000007ff7e920000 - 000007ff7e9e6000: C:\WINDOWS\system32\COMRes.dll
000007ff7e9f0000 - 000007ff7eb04000: C:\WINDOWS\system32\OLEAUT32.dll
000007ff7ece0000 - 000007ff7ef52000: C:\WINDOWS\system32\ole32.dll
000007ff7ef60000 - 000007ff7effb000: C:\WINDOWS\system32\SHLWAPI.dll
000007ff7f190000 - 000007ff7fb96000: C:\WINDOWS\system32\SHELL32.dll
000007ff7fbf0000 - 000007ff7fbfb000: C:\WINDOWS\system32\VERSION.dll
000007ff7fc00000 - 000007ff7fc86000: C:\WINDOWS\system32\msvcrt.dll
000007ff7fc90000 - 000007ff7fd29000: C:\WINDOWS\system32\GDI32.dll
000007ff7fd30000 - 000007ff7fed9000: C:\WINDOWS\system32\RPCRT4.dll
000007ff7fee0000 - 000007ff7ffe5000: C:\WINDOWS\system32\ADVAPI32.dll

*----> State Dump for Thread Id 0x35c <----*

rax=00000000000616a4 rbx=00000000000afd50 rcx=0000000001010057
rdx=0000000000000039 rsi=0000000000000000 rdi=000000000203dfc0
rip=0000000078c53d2a rsp=00000000000afca8 rbp=0000000000000001
r8=00000000000084e0 r9=0000000000000000 r10=0000000000000000
r11=0000000002c3a1cc r12=000000000000003f r13=00000000000e82f0
r14=0000000000000000 r15=0000000100001e18
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000244

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\USER32.dll -
function: USER32!GetWindowLongPtrW
00000000`78c53d19 90 nop
00000000`78c53d1a 90 nop
00000000`78c53d1b 90 nop
00000000`78c53d1c 90 nop
00000000`78c53d1d 90 nop
00000000`78c53d1e 90 nop
00000000`78c53d1f 90 nop
00000000`78c53d20 4c8bd1 mov r10,rcx
00000000`78c53d23 b806100000 mov eax,0x1006
00000000`78c53d28 0f05 syscall
00000000`78c53d2a c3 ret
00000000`78c53d2b 90 nop
00000000`78c53d2c 90 nop
00000000`78c53d2d 90 nop
00000000`78c53d2e 90 nop
00000000`78c53d2f 90 nop
00000000`78c53d30 90 nop
00000000`78c53d31 90 nop
00000000`78c53d32 90 nop
00000000`78c53d33 90 nop
00000000`78c53d34 90 nop

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Outlook Express\MSOE.DLL -
*** ERROR: Module load completed but symbols could not be loaded for
C:\Program Files\Outlook Express\msimn.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`000afca8 00000000`78c53d66 : 00000000`00000000 00000000`0203dfc0
00000001`00001e18 00000000`00000000 : USER32!GetWindowLongPtrW+0x11a
00000000`000afcb0 000007ff`6631c07d : 00000000`0203dfc0 00000000`00000000
00000000`0203dfc0 00000000`0000003f : USER32!GetMessageW+0x26
00000000`000afce0 00000001`00003003 : 00000000`00000000 000007ff`66318bd0
00000000`00020806 00000001`00000000 : MSOE!CoStartOutlookExpress+0x34ad
00000000`000afda0 00000001`0000317e : 00000000`78d40000 00000000`00020806
00000000`78d56e40 00000001`00000000 : msimn+0x3003
00000000`000afe60 00000001`000035c1 : 00000000`00000000 00000000`00000000
00000000`00000000 00000001`00000000 : msimn+0x317e
00000000`000afeb0 00000000`78d5965c : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : msimn+0x35c1
00000000`000aff80 00000000`00000000 : 00000001`00003390 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseProcessStart+0x2c

*----> Raw Stack Dump <----*
00000000000afca8 66 3d c5 78 00 00 00 00 - 00 00 00 00 00 00 00 00
f=.x............
00000000000afcb8 c0 df 03 02 00 00 00 00 - 18 1e 00 00 01 00 00 00
.................
00000000000afcc8 00 00 00 00 00 00 00 00 - c0 df 03 02 00 00 00 00
.................
00000000000afcd8 7d c0 31 66 ff 07 00 00 - c0 df 03 02 00 00 00
0 }.1f............
00000000000afce8 00 00 00 00 00 00 00 00 - c0 df 03 02 00 00 00 00
.................
00000000000afcf8 3f 00 00 00 00 00 00 00 - 00 00 29 66 ff 07 00 00
?.........)f....
00000000000afd08 be a9 ef 78 00 00 00 00 - 00 00 00 00 00 00 00 00
....x............
00000000000afd18 00 00 00 00 ff 07 00 00 - 00 00 00 00 00 00 00 00
.................
00000000000afd28 60 65 0d 00 00 00 00 00 - 01 00 12 00 00 00 00 00
`e..............
00000000000afd38 68 d2 fd ff ff 07 00 00 - 00 00 00 00 01 00 00 00
h...............
00000000000afd48 f0 82 0e 00 00 00 00 00 - f8 03 01 00 00 00 00 00
.................
00000000000afd58 0f 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000000afd68 00 00 00 00 00 00 00 00 - 8d e0 0d 00 ca 01 00 00
.................
00000000000afd78 61 01 00 00 df fa ff ff - 01 00 00 00 00 00 00 00
a...............
00000000000afd88 00 00 29 66 ff 07 00 00 - 38 00 00 00 00 00 00 00
...)f....8.......
00000000000afd98 03 30 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00
..0..............
00000000000afda8 d0 8b 31 66 ff 07 00 00 - 06 08 02 00 00 00 00 00
...1f............
00000000000afdb8 00 00 00 00 01 00 00 00 - 00 00 d4 78 00 00 00 00
............x....
00000000000afdc8 be a9 ef 78 00 00 00 00 - 24 00 00 00 00 00 00 00
....x....$.......
00000000000afdd8 00 00 00 00 00 00 00 00 - 63 d8 ef 78 00 00 00 00
.........c..x....

*----> State Dump for Thread Id 0x4e4 <----*

rax=0000000000190ff0 rbx=0000000002061c68 rcx=00000001fffffffe
rdx=0000000000000014 rsi=0000000002061c60 rdi=0000000002b3d780
rip=000007ff6642dfc4 rsp=0000000002b3d6d0 rbp=0000000000000000
r8=0000000002b3d6f8 r9=0000000000000000 r10=0000000000000000
r11=00000000001bdc60 r12=0000000002b3d780 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00010210

function: MSOE!Ordinal17
000007ff`6642dfa1 10413b adc [rcx+0x3b],al
000007ff`6642dfa4 6c insb
000007ff`6642dfa5 2440 and al,0x40
000007ff`6642dfa7 72a7 jb MSOE!Ordinal17+0xec1f0
(000007ff6642df50)
000007ff`6642dfa9 418b4c2440 mov ecx,[r12+0x40]
000007ff`6642dfae 498b442448 mov rax,[r12+0x48]
000007ff`6642dfb3 448b8e4c030000 mov r9d,[rsi+0x34c]
000007ff`6642dfba ffc9 dec ecx
000007ff`6642dfbc ba14000000 mov edx,0x14
000007ff`6642dfc1 4803c9 add rcx,rcx
FAULT ->000007ff`6642dfc4 448b04c8 mov r8d,[rax+rcx*8]
ds:00000010`00190fe0=????????
000007ff`6642dfc8 488b8e70020000 mov rcx,[rsi+0x270]
000007ff`6642dfcf 488d8664060000 lea rax,[rsi+0x664]
000007ff`6642dfd6 442b8680080000 sub r8d,[rsi+0x880]
000007ff`6642dfdd 4889442420 mov [rsp+0x20],rax
000007ff`6642dfe2 44898648030000 mov [rsi+0x348],r8d
000007ff`6642dfe9 4c8b11 mov r10,[rcx]
000007ff`6642dfec 41ff5220 call qword ptr [r10+0x20]
000007ff`6642dff0 4c8b642430 mov r12,[rsp+0x30]
000007ff`6642dff5 488b7c2458 mov rdi,[rsp+0x58]
000007ff`6642dffa 488b742450 mov rsi,[rsp+0x50]

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\INETCOMM.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`02b3d6d0 000007ff`66431350 : 00000000`02061c68 00000000`00000000
00000000`00000000 00000000`02b3d780 : MSOE!Ordinal17+0xec264
00000000`02b3d710 000007ff`7ae77786 : 00000000`001ab8a0 00000000`01f27b70
00000000`00190ff0 00000000`00000005 : MSOE!Ordinal17+0xef5f0
00000000`02b3d760 000007ff`7ae789fb : 00000000`01f27b70 00000000`001ab8a0
00000000`00190ff0 00000000`00000005 :
INETCOMM!MimeEditDocumentFromStream+0x2b526
00000000`02b3d800 000007ff`7ae7baec : 00000000`01f27b70 00000000`00000003
00000000`00000005 00000000`00000005 :
INETCOMM!MimeEditDocumentFromStream+0x2c79b
00000000`02b3d8e0 000007ff`7ae7bc63 : 00000000`02b3d920 00000000`01f27b80
00000000`01f27b80 00000000`00000005 :
INETCOMM!MimeEditDocumentFromStream+0x2f88c
00000000`02b3d910 000007ff`7aea52b3 : 00000000`01f27b80 00000000`01f230d0
00000000`00000000 00000000`00000005 :
INETCOMM!MimeEditDocumentFromStream+0x2fa03
00000000`02b3d940 000007ff`7aea540f : 00000000`00000021 00000000`01f230d0
00000000`01f230d0 00000000`00000000 :
INETCOMM!MimeEditDocumentFromStream+0x59053
00000000`02b3d9e0 000007ff`7aea5715 : 00000000`00000340 00000000`01f230d0
00000000`00000001 00000000`00000340 :
INETCOMM!MimeEditDocumentFromStream+0x591af
00000000`02b3fa20 000007ff`7aea3aca : 00000000`00000000 00000000`00190404
fffffadf`ecd58770 fffff800`00101070 :
INETCOMM!MimeEditDocumentFromStream+0x594b5
00000000`02b3fda0 00000000`78c53a4c : 00000000`00000001 00000000`00000000
00000000`00000401 00000000`00000000 :
INETCOMM!MimeEditDocumentFromStream+0x5786a
00000000`02b3fdd0 00000000`78c53eec : 00000000`000af9d8 000007ff`7aea3a60
00000000`00000000 00000000`02b3ff40 : USER32!GetSystemMetrics+0x24c
00000000`02b3fea0 000007ff`66379ff1 : 00000000`000af9d8 00000000`00000000
00000000`02041fc0 00000000`00000000 : USER32!GetMessageW+0x1ac
00000000`02b3ff10 00000000`78d6b66a : 00000000`02043fc0 00000000`00000000
00000000`000af9d8 000007ff`66379e70 : MSOE!Ordinal17+0x38291
00000000`02b3ff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
0000000002b3d6d0 00 00 00 00 00 00 00 00 - 70 7b f2 01 00 00 00 00
.........p{......
0000000002b3d6e0 00 00 0d 00 00 00 00 00 - 20 a6 18 00 00 00 00 00
......... .......
0000000002b3d6f0 1f a6 18 00 00 00 00 00 - 15 29 ea 7a ff 07 00 00
..........).z....
0000000002b3d700 01 00 00 00 00 00 00 00 - 50 13 43 66 ff 07 00 00
.........P.Cf....
0000000002b3d710 68 1c 06 02 00 00 00 00 - 00 00 00 00 00 00 00 00
h...............
0000000002b3d720 00 00 00 00 00 00 00 00 - 80 d7 b3 02 00 00 00 00
.................
0000000002b3d730 70 7b f2 01 00 00 00 00 - 78 7b f2 01 00 00 00 00
p{......x{......
0000000002b3d740 00 00 00 00 00 00 00 00 - 70 7b f2 01 00 00 00 00
.........p{......
0000000002b3d750 01 00 00 00 00 00 00 00 - 86 77 e7 7a ff 07 00 00
..........w.z....
0000000002b3d760 a0 b8 1a 00 00 00 00 00 - 70 7b f2 01 00 00 00 00
.........p{......
0000000002b3d770 f0 0f 19 00 00 00 00 00 - 05 00 00 00 00 00 00 00
.................
0000000002b3d780 13 00 00 00 01 00 00 00 - 01 00 00 00 00 00 00 00
.................
0000000002b3d790 00 00 00 00 00 00 00 00 - 60 dc 1b 00 00 00 00 00
.........`.......
0000000002b3d7a0 dd 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002b3d7b0 00 00 00 00 00 00 00 00 - 70 7b f2 01 00 00 00 00
.........p{......
0000000002b3d7c0 00 00 00 00 00 00 00 00 - f0 0f 19 00 00 00 00 00
.................
0000000002b3d7d0 f0 ef 59 03 00 00 00 00 - 00 00 00 00 00 00 00 00
...Y.............
0000000002b3d7e0 00 00 00 00 00 00 00 00 - 38 d8 b3 02 00 00 00 00
.........8.......
0000000002b3d7f0 70 7b f2 01 00 00 00 00 - fb 89 e7 7a ff 07 00 00
p{.........z....
0000000002b3d800 70 7b f2 01 00 00 00 00 - a0 b8 1a 00 00 00 00 00
p{..............

*----> State Dump for Thread Id 0x13c <----*

rax=0000000000000000 rbx=0000000002bfff40 rcx=000007ff71db18f8
rdx=000007ff71db4fb0 rsi=0000000000000000 rdi=0000000000002177
rip=0000000078c53d2a rsp=0000000002bffee8 rbp=0000000000000000
r8=0000000002bfff78 r9=0000000000000000 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000244

function: USER32!GetWindowLongPtrW
00000000`78c53d19 90 nop
00000000`78c53d1a 90 nop
00000000`78c53d1b 90 nop
00000000`78c53d1c 90 nop
00000000`78c53d1d 90 nop
00000000`78c53d1e 90 nop
00000000`78c53d1f 90 nop
00000000`78c53d20 4c8bd1 mov r10,rcx
00000000`78c53d23 b806100000 mov eax,0x1006
00000000`78c53d28 0f05 syscall
00000000`78c53d2a c3 ret
00000000`78c53d2b 90 nop
00000000`78c53d2c 90 nop
00000000`78c53d2d 90 nop
00000000`78c53d2e 90 nop
00000000`78c53d2f 90 nop
00000000`78c53d30 90 nop
00000000`78c53d31 90 nop
00000000`78c53d32 90 nop
00000000`78c53d33 90 nop
00000000`78c53d34 90 nop

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Common Files\System\directdb.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`02bffee8 00000000`78c37ee3 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : USER32!GetWindowLongPtrW+0x11a
00000000`02bffef0 000007ff`71db5259 : 00000000`000af130 00000000`000af130
00000000`00000000 00000000`00002177 : USER32!GetMessageA+0x43
00000000`02bfff20 00000000`78d6b66a : 00000000`78d6b630 00000000`00000000
00000000`000af130 000007ff`71db5180 : directdb!DllGetClassObject+0x1c79
00000000`02bfff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
0000000002bffee8 e3 7e c3 78 00 00 00 00 - 00 00 00 00 00 00 00 00
..~.x............
0000000002bffef8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfff08 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfff18 59 52 db 71 ff 07 00 00 - 30 f1 0a 00 00 00 00 00
YR.q....0.......
0000000002bfff28 30 f1 0a 00 00 00 00 00 - 00 00 00 00 00 00 00 00
0...............
0000000002bfff38 77 21 00 00 00 00 00 00 - a6 03 01 00 00 00 00 00
w!..............
0000000002bfff48 13 01 00 00 00 00 00 00 - 77 21 00 00 00 00 00 00
.........w!......
0000000002bfff58 00 00 00 00 00 00 00 00 - 5f f2 0d 00 1e 02 00 00
........._.......
0000000002bfff68 e9 01 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfff78 6a b6 d6 78 00 00 00 00 - 30 b6 d6 78 00 00 00 00
j..x....0..x....
0000000002bfff88 00 00 00 00 00 00 00 00 - 30 f1 0a 00 00 00 00 00
.........0.......
0000000002bfff98 80 51 db 71 ff 07 00 00 - 00 00 00 00 00 00 00 00
..Q.q............
0000000002bfffa8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfffb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfffc8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfffd8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bfffe8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000002bffff8 00 00 00 00 00 00 00 00 - 28 94 00 00 43 00 3a 00
.........(...C.:.
0000000002c00008 5c 00 44 00 6f 00 63 00 - 75 00 6d 00 65 00 6e 00
\.D.o.c.u.m.e.n.
0000000002c00018 74 00 73 00 20 00 61 00 - 6e 00 64 00 20 00 53 00 t.s.
..a.n.d. .S.

*----> State Dump for Thread Id 0x190 <----*

rax=0000000000000000 rbx=000000000336ff40 rcx=0000000078ed1c60
rdx=0000000000000000 rsi=0000000000000001 rdi=000000000336fe40
rip=0000000078ef181a rsp=000000000336fd98 rbp=00000000031f3ea0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=000000000336fde8 r13=0000000000000002
r14=0000000000000000 r15=0000000078fa40a0
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000244

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
function: ntdll!ZwWaitForMultipleObjects
00000000`78ef17fe 6690 nop
ntdll!NtQuerySystemTime:
00000000`78ef1800 e97b7cffff jmp ntdll!RtlUnicodeToOemN+0x180
(0000000078ee9480)
00000000`78ef1805 66666690 nop
00000000`78ef1809 66666690 nop
00000000`78ef180d 666690 nop
ntdll!ZwWaitForMultipleObjects:
00000000`78ef1810 4c8bd1 mov r10,rcx
00000000`78ef1813 b858000000 mov eax,0x58
00000000`78ef1818 0f05 syscall
00000000`78ef181a c3 ret
00000000`78ef181b 666690 nop
00000000`78ef181e 6690 nop
ntdll!NtSetInformationObject:
00000000`78ef1820 4c8bd1 mov r10,rcx
00000000`78ef1823 b859000000 mov eax,0x59
00000000`78ef1828 0f05 syscall
00000000`78ef182a c3 ret
00000000`78ef182b 666690 nop
00000000`78ef182e 6690 nop
ntdll!NtCancelIoFile:

*----> Stack Back Trace <----*
Child-SP RetAddr : Args to Child
: Call Site
00000000`0336fd98 00000000`78ed20f0 : 00000000`00000000 00000000`00000000
00000000`78fa40a0 00000000`00228144 : ntdll!ZwWaitForMultipleObjects+0xa
00000000`0336fda0 00000000`78ed21bc : 00000000`0336ff20 00000000`00228144
00000000`000003e5 00000000`031f3ea0 : ntdll!RtlApplyRXact+0x940
00000000`0336fec0 00000000`78d6b66a : 00000000`78d6b630 00000000`00000000
00000000`00000000 00000000`00000000 : ntdll!RtlApplyRXact+0xa0c
00000000`0336ff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
000000000336fd98 f0 20 ed 78 00 00 00 00 - 00 00 00 00 00 00 00 00 .
..x............
000000000336fda8 00 00 00 00 00 00 00 00 - a0 40 fa 78 00 00 00 00
[email protected]
000000000336fdb8 44 81 22 00 00 00 00 00 - e8 fd 36 03 00 00 00 00
D.".......6.....
000000000336fdc8 20 00 00 00 00 00 00 00 - a0 3e 1f 03 00 00 00 00
.........>......
000000000336fdd8 40 fe 36 03 00 00 00 00 - 02 00 00 00 00 00 00 00
@.6.............
000000000336fde8 00 a2 2f 4d ff ff ff ff - 48 00 00 00 00 00 00 00
.../M....H.......
000000000336fdf8 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000336fe08 00 00 00 00 00 00 00 00 - 30 00 00 00 00 00 00 00
.........0.......
000000000336fe18 ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff
.................
000000000336fe28 76 9c ec 78 00 00 00 00 - 00 00 00 00 00 00 00 00
v..x............
000000000336fe38 00 10 00 00 00 00 00 00 - 70 02 00 00 00 00 00 00
.........p.......
000000000336fe48 7c 02 00 00 00 00 00 00 - a0 3e 1f 03 00 00 00 00
|........>......
000000000336fe58 69 13 ed 78 00 00 00 00 - 08 00 00 c0 00 00 00 00
i..x............
000000000336fe68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000336fe78 a0 40 fa 78 00 00 00 00 - 80 40 fa 78 00 00 00 00
[email protected]@.x....
000000000336fe88 00 10 00 00 00 00 00 00 - 90 2e 1f 03 00 00 00 00
.................
000000000336fe98 00 10 00 00 00 00 00 00 - a0 3e 1f 03 00 00 00 00
..........>......
000000000336fea8 00 10 00 00 00 00 00 00 - a0 40 fa 78 00 00 00 00
[email protected]
000000000336feb8 bc 21 ed 78 00 00 00 00 - 20 ff 36 03 00 00 00 00
..!.x.... .6.....
000000000336fec8 44 81 22 00 00 00 00 00 - e5 03 00 00 00 00 00 00
D.".............

*----> State Dump for Thread Id 0x83c <----*

rax=0000000000000000 rbx=000000000018ddd0 rcx=000007ff7fd36050
rdx=0000000000186770 rsi=00000000ffffffff rdi=00000000001b8d70
rip=0000000078ef151a rsp=00000000033efb98 rbp=00000000033efde0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000186770 r13=000000007ffe0004
r14=000000000015a900 r15=00000000033efe18
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000244

function: ntdll!ZwReplyWaitReceivePortEx
00000000`78ef1500 4c8bd1 mov r10,rcx
00000000`78ef1503 b827000000 mov eax,0x27
00000000`78ef1508 0f05 syscall
00000000`78ef150a c3 ret
00000000`78ef150b 666690 nop
00000000`78ef150e 6690 nop
ntdll!ZwReplyWaitReceivePortEx:
00000000`78ef1510 4c8bd1 mov r10,rcx
00000000`78ef1513 b828000000 mov eax,0x28
00000000`78ef1518 0f05 syscall
00000000`78ef151a c3 ret
00000000`78ef151b 666690 nop
00000000`78ef151e 6690 nop
ntdll!ZwTerminateProcess:
00000000`78ef1520 4c8bd1 mov r10,rcx
00000000`78ef1523 b829000000 mov eax,0x29
00000000`78ef1528 0f05 syscall
00000000`78ef152a c3 ret
00000000`78ef152b 666690 nop
00000000`78ef152e 6690 nop
ntdll!ZwSetEventBoostPriority:

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\RPCRT4.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`033efb98 000007ff`7fd529fe : 00000000`0018ddd0 00000000`033efde0
00000000`ffffffff 00000000`00000000 : ntdll!ZwReplyWaitReceivePortEx+0xa
00000000`033efba0 000007ff`7fd363e9 : 00000000`0018ddd0 00000000`00186770
000007ff`7fd36050 00000000`00000000 : RPCRT4!NDRCContextMarshall+0x108e
00000000`033efeb0 000007ff`7fd4c0a9 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 :
RPCRT4!NdrFullPointerQueryPointer+0x37e9
00000000`033efee0 000007ff`7fd36071 : 00000000`00186770 00000000`00000000
00000000`00000000 000007ff`7fd36050 : RPCRT4!NdrSimpleStructMemorySize+0x299
00000000`033eff50 00000000`78d6b66a : 00000000`78d6b630 00000000`00000000
00000000`00000000 00000000`033effa8 :
RPCRT4!NdrFullPointerQueryPointer+0x3471
00000000`033eff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
00000000033efb98 fe 29 d5 7f ff 07 00 00 - d0 dd 18 00 00 00 00 00
..)..............
00000000033efba8 e0 fd 3e 03 00 00 00 00 - ff ff ff ff 00 00 00 00
...>.............
00000000033efbb8 00 00 00 00 00 00 00 00 - 18 fe 3e 03 00 00 00 00
...........>.....
00000000033efbc8 80 1f 00 00 ff ff 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efbd8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efbe8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efbf8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc08 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc18 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc28 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc38 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc48 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc78 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efc98 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efca8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efcb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
00000000033efcc8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................

*----> State Dump for Thread Id 0x878 <----*

rax=0000000000000000 rbx=000000000000ea60 rcx=000007ff7ed1ed80
rdx=0000000000198580 rsi=000000000346fe70 rdi=0000000000000000
rip=0000000078ef15aa rsp=000000000346fe48 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000200

function: ntdll!ZwDelayExecution
00000000`78ef1590 4c8bd1 mov r10,rcx
00000000`78ef1593 b830000000 mov eax,0x30
00000000`78ef1598 0f05 syscall
00000000`78ef159a c3 ret
00000000`78ef159b 666690 nop
00000000`78ef159e 6690 nop
ntdll!ZwDelayExecution:
00000000`78ef15a0 4c8bd1 mov r10,rcx
00000000`78ef15a3 b831000000 mov eax,0x31
00000000`78ef15a8 0f05 syscall
00000000`78ef15aa c3 ret
00000000`78ef15ab 666690 nop
00000000`78ef15ae 6690 nop
ntdll!NtQueryDirectoryFile:
00000000`78ef15b0 4c8bd1 mov r10,rcx
00000000`78ef15b3 b832000000 mov eax,0x32
00000000`78ef15b8 0f05 syscall
00000000`78ef15ba c3 ret
00000000`78ef15bb 666690 nop
00000000`78ef15be 6690 nop
ntdll!RtlGetNativeSystemInformation:

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ole32.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`0346fe48 00000000`78d70536 : 00000000`00154e3d 00000000`00000000
00000000`00000000 00000000`00154e38 : ntdll!ZwDelayExecution+0xa
00000000`0346fe50 000007ff`7ed38de0 : 00000000`00000000 00000000`00000000
00000000`00198580 00000000`00000000 : kernel32!SleepEx+0x96
00000000`0346fef0 000007ff`7ed1ec76 : 00000000`00140012 000007ff`00000000
00000000`000ddcc0 00000000`0346ff80 : ole32!CoTaskMemFree+0x5d0
00000000`0346ff20 000007ff`7ed1edf1 : 00000000`00198580 00000000`00198580
00000000`00198580 000007ff`7ece0000 : ole32!StringFromCLSID+0x1eb6
00000000`0346ff50 00000000`78d6b66a : 00000000`0017c420 00000000`00000000
00000000`00198580 000007ff`7ed1ed80 : ole32!StringFromCLSID+0x2031
00000000`0346ff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
000000000346fe48 36 05 d7 78 00 00 00 00 - 3d 4e 15 00 00 00 00 00
6..x....=N......
000000000346fe58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fe68 38 4e 15 00 00 00 00 00 - 00 ba 3c dc ff ff ff ff
8N........<.....
000000000346fe78 54 07 02 00 00 00 00 00 - 48 00 00 00 00 00 00 00
T.......H.......
000000000346fe88 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fe98 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fea8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346feb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fec8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fed8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000346fee8 e0 8d d3 7e ff 07 00 00 - 00 00 00 00 00 00 00 00
....~............
000000000346fef8 00 00 00 00 00 00 00 00 - 80 85 19 00 00 00 00 00
.................
000000000346ff08 00 00 00 00 00 00 00 00 - 80 85 19 00 00 00 00 00
.................
000000000346ff18 76 ec d1 7e ff 07 00 00 - 12 00 14 00 00 00 00 00
v..~............
000000000346ff28 00 00 00 00 ff 07 00 00 - c0 dc 0d 00 00 00 00 00
.................
000000000346ff38 80 ff 46 03 00 00 00 00 - 00 00 00 00 00 00 00 00
...F.............
000000000346ff48 f1 ed d1 7e ff 07 00 00 - 80 85 19 00 00 00 00 00
....~............
000000000346ff58 80 85 19 00 00 00 00 00 - 80 85 19 00 00 00 00 00
.................
000000000346ff68 00 00 ce 7e ff 07 00 00 - 00 00 00 00 00 00 00 00
....~............
000000000346ff78 6a b6 d6 78 00 00 00 00 - 20 c4 17 00 00 00 00 00
j..x.... .......

*----> State Dump for Thread Id 0x76c <----*

rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000204
rdx=000000000314ff38 rsi=000007ff76fe81f0 rdi=000007ff76fe0000
rip=0000000078ef12fa rsp=000000000314fef8 rbp=000007ff76ff7020
r8=000000000314ff30 r9=000000000314ff40 r10=0000000000000204
r11=0000000000000246 r12=000007ff76ff6f40 r13=000007ff770326d0
r14=000007ff77044950 r15=000007ff77033b20
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00000200

function: ntdll!NtRemoveIoCompletion
00000000`78ef12e0 4c8bd1 mov r10,rcx
00000000`78ef12e3 b805000000 mov eax,0x5
00000000`78ef12e8 0f05 syscall
00000000`78ef12ea c3 ret
00000000`78ef12eb 666690 nop
00000000`78ef12ee 6690 nop
ntdll!NtRemoveIoCompletion:
00000000`78ef12f0 4c8bd1 mov r10,rcx
00000000`78ef12f3 b806000000 mov eax,0x6
00000000`78ef12f8 0f05 syscall
00000000`78ef12fa c3 ret
00000000`78ef12fb 666690 nop
00000000`78ef12fe 6690 nop
ntdll!ZwReleaseSemaphore:
00000000`78ef1300 4c8bd1 mov r10,rcx
00000000`78ef1303 b807000000 mov eax,0x7
00000000`78ef1308 0f05 syscall
00000000`78ef130a c3 ret
00000000`78ef130b 666690 nop
00000000`78ef130e 6690 nop
ntdll!ZwReplyWaitReceivePort:

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\System32\mswsock.dll -
Child-SP RetAddr : Args to Child
: Call Site
00000000`0314fef8 000007ff`76fe518d : 00000000`00000000 000007ff`76ff7020
000007ff`76fe81f0 000007ff`76fe0000 : ntdll!NtRemoveIoCompletion+0xa
00000000`0314ff00 00000000`78d6b66a : 00000000`035d5d90 00000000`00000000
00000000`00000000 000007ff`76fe8340 : mswsock+0x518d
00000000`0314ff80 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadStart+0x3a

*----> Raw Stack Dump <----*
000000000314fef8 8d 51 fe 76 ff 07 00 00 - 00 00 00 00 00 00 00 00
..Q.v............
000000000314ff08 20 70 ff 76 ff 07 00 00 - f0 81 fe 76 ff 07 00 00
p.v.......v....
000000000314ff18 00 00 fe 76 ff 07 00 00 - 00 00 00 00 00 00 00 00
....v............
000000000314ff28 00 00 00 00 00 00 00 00 - 10 a1 1a 00 00 00 00 00
.................
000000000314ff38 20 70 ff 76 ff 07 00 00 - 00 00 00 00 00 00 00 00
p.v............
000000000314ff48 10 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ff58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ff68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ff78 6a b6 d6 78 00 00 00 00 - 90 5d 5d 03 00 00 00 00
j..x.....]].....
000000000314ff88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ff98 40 83 fe 76 ff 07 00 00 - 00 00 00 00 00 00 00 00
@..v............
000000000314ffa8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ffb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ffc8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ffd8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314ffe8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000314fff8 00 00 00 00 00 00 00 00 - 08 00 00 00 c0 60 00 00
..............`..
0000000003150008 00 00 00 00 ff ff ff ff - 00 40 00 00 01 00 00 00
[email protected]
0000000003150018 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000003150028 60 05 00 00 50 20 00 00 - d0 f1 c7 28 25 de d2 11 `...P
......(%...

 

Looks very much like mine (less the dump)

Application exception occurred:
App: D:\Program Files\Outlook Express\msimn.exe (pid=2376)
When: 12/16/2005 @ 18:44:49.812
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: JOHN-FNB5RZRU9
User Name: Freeafrog
Terminal Session Id: 0
Number of Processors: 1
Processor Type: AMD64 Family 15 Model 15 Stepping 0
Windows Version: 5.2
Current Build: 3790
Service Pack: 1
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: John Barnes
*----> Task List <----*
0 System Process
4 System
756 smss.exe
936 csrss.exe
960 winlogon.exe
1012 services.exe
156 lsass.exe
556 svchost.exe
780 svchost.exe
820 svchost.exe
912 svchost.exe
1176 svchost.exe
1444 brsvc01a.exe
1512 spoolsv.exe
1600 brss01a.exe
1984 Explorer.EXE
316 RUNDLL32.EXE
828 SOUNDMAN.EXE
904 aswUpdSv.exe
1044 ctfmon.exe
1064 msmsgs.exe
908 CTDetect.exe
1132 CTCMSGo.exe
1204 ctfmon.exe
1372 browseblast.exe
1380 ashServ.exe
1688 ashDisp.exe
1788 CTsvcCDA.EXE
1832 svchost.exe
1912 nvsvc64.exe
448 WkUFind.exe
684 getright.exe
584 jusched.exe
920 AdMunch.exe
900 AsusProb.exe
2040 getright.exe
1144 CTHELPER.EXE
1148 wkcalrem.exe
1300 MUPS.exe
1188 RoxMediaDB.exe
1384 DrgToDsc.exe
1496 RoxWatchTray.exe
1596 EDICT.EXE
632 RoxWatch.exe
2596 svchost.exe
1828 upsd.exe
2148 CPSHelpRunner.exe
1036 x10nets.exe
1748 ashMaiSv.exe
352 ashWebSv.exe
284 wmiprvse.exe
2412 alg.exe
2360 IEXPLORE.EXE
2472 IEXPLORE.EXE
1948 KeePass.exe
876 javaw.exe
2376 msimn.exe
1744 regedit.exe
2432 IEXPLORE.EXE
3064 IEXPLORE.EXE
3196 dwwin.exe
3476 drwtsn32.exe

*----> Module List <----*
0000000001c30000 - 0000000001db7000:
D:\WINDOWS\WinSxS\AMD64_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.1830_x-ww_ACED72AF\comctl32.dll
00000000021e0000 - 0000000002432000: D:\WINDOWS\system32\SHDOCVW.DLL
0000000002550000 - 0000000002679000: D:\WINDOWS\system32\WININET.dll
00000000027b0000 - 000000000288d000: D:\WINDOWS\system32\CLBCatQ.DLL
000000000ffb0000 - 000000000ffee000: D:\WINDOWS\system32\rsaenh.dll
0000000078c30000 - 0000000078d3c000: D:\WINDOWS\system32\USER32.dll
0000000078d40000 - 0000000078eb2000: D:\WINDOWS\system32\kernel32.dll
0000000078ec0000 - 0000000078ff9000: D:\WINDOWS\system32\ntdll.dll
0000000100000000 - 0000000100014000: D:\Program Files\Outlook
Express\msimn.exe
000007ff5c210000 - 000007ff5c4d7000: D:\WINDOWS\system32\xpsp2res.dll
000007ff5c900000 - 000007ff5c9c9000: D:\WINDOWS\system32\ws03res.dll
000007ff5e2f0000 - 000007ff5e330000: D:\Program Files\Common
Files\System\wab32res.dll
000007ff5e340000 - 000007ff5e40d000: D:\Program Files\Common
Files\System\wab32.dll
000007ff62c10000 - 000007ff62c20000: D:\WINDOWS\system32\PSTOREC.DLL
000007ff65fc0000 - 000007ff66221000: D:\Program Files\Outlook
Express\msoeres.dll
000007ff66230000 - 000007ff6628e000: D:\WINDOWS\system32\MSOEACCT.dll
000007ff66290000 - 000007ff664a6000: D:\Program Files\Outlook
Express\MSOE.DLL
000007ff66970000 - 000007ff66977000: D:\WINDOWS\system32\msidntld.dll
000007ff66980000 - 000007ff66994000: D:\WINDOWS\system32\msident.dll
000007ff669c0000 - 000007ff669e9000: D:\Program Files\Messenger\msgsc64.dll
000007ff6acb0000 - 000007ff6acbf000: D:\WINDOWS\system32\inetres.dll
000007ff6d1f0000 - 000007ff6d281000: D:\WINDOWS\system32\hnetcfg.dll
000007ff71db0000 - 000007ff71dd5000: D:\Program Files\Common
Files\System\directdb.dll
000007ff76c90000 - 000007ff76ca3000: D:\WINDOWS\system32\acctres.dll
000007ff76fa0000 - 000007ff76fab000: D:\WINDOWS\System32\wshtcpip.dll
000007ff76fe0000 - 000007ff7705c000: D:\WINDOWS\system32\mswsock.dll
000007ff77060000 - 000007ff770df000: D:\WINDOWS\system32\uxtheme.dll
000007ff770f0000 - 000007ff770fa000: D:\WINDOWS\system32\wsock32.dll
000007ff77140000 - 000007ff7714c000: D:\WINDOWS\system32\WS2HELP.dll
000007ff77150000 - 000007ff77180000: D:\WINDOWS\system32\WS2_32.dll
000007ff771b0000 - 000007ff77248000: D:\WINDOWS\system32\NETAPI32.dll
000007ff77530000 - 000007ff77535000: D:\WINDOWS\system32\security.dll
000007ff78a20000 - 000007ff78c2e000: D:\WINDOWS\system32\msxml3.dll
000007ff79070000 - 000007ff7908e000: D:\WINDOWS\system32\digest.dll
000007ff7a170000 - 000007ff7a1cd000: D:\WINDOWS\system32\msls31.dll
000007ff7a1d0000 - 000007ff7a233000: D:\WINDOWS\system32\msimtf.dll
000007ff7a240000 - 000007ff7a2df000: D:\WINDOWS\system32\MSCTF.dll
000007ff7a2f0000 - 000007ff7a39f000: D:\WINDOWS\system32\mlang.dll
000007ff7a580000 - 000007ff7ab2f000: D:\WINDOWS\system32\mshtml.dll
000007ff7ac70000 - 000007ff7ad56000: D:\WINDOWS\system32\mshtmled.dll
000007ff7ada0000 - 000007ff7add1000: D:\WINDOWS\system32\MSOERT2.dll
000007ff7ade0000 - 000007ff7af01000: D:\WINDOWS\system32\INETCOMM.dll
000007ff7af10000 - 000007ff7b02e000: D:\WINDOWS\system32\RICHED20.DLL
000007ff7bb60000 - 000007ff7bc14000: D:\WINDOWS\system32\CRYPTUI.dll
000007ff7c4a0000 - 000007ff7c5a9000: D:\WINDOWS\system32\USERENV.dll
000007ff7ca80000 - 000007ff7cc6d000: D:\WINDOWS\system32\SXS.DLL
000007ff7cce0000 - 000007ff7ce6b000: D:\WINDOWS\system32\browseui.dll
000007ff7ce70000 - 000007ff7cf7c000: D:\WINDOWS\system32\urlmon.dll
000007ff7cf80000 - 000007ff7d016000: D:\WINDOWS\system32\shdoclc.dll
000007ff7d150000 - 000007ff7d17a000: D:\WINDOWS\system32\MSASN1.dll
000007ff7d180000 - 000007ff7d2df000: D:\WINDOWS\system32\CRYPT32.dll
000007ff7d320000 - 000007ff7d359000: D:\WINDOWS\system32\IMM32.DLL
000007ff7d5c0000 - 000007ff7da09000: D:\WINDOWS\system32\MSI.DLL
000007ff7e040000 - 000007ff7e05c000: D:\WINDOWS\system32\ATL.DLL
000007ff7e060000 - 000007ff7e0b0000: D:\WINDOWS\system32\WINMM.dll
000007ff7e1b0000 - 000007ff7e1c0000: D:\WINDOWS\system32\PSAPI.DLL
000007ff7e210000 - 000007ff7e25e000: D:\WINDOWS\system32\WINTRUST.dll
000007ff7e2a0000 - 000007ff7e2b3000: D:\WINDOWS\system32\imagehlp.dll
000007ff7e330000 - 000007ff7e374000: D:\WINDOWS\system32\msv1_0.dll
000007ff7e3c0000 - 000007ff7e3f0000: D:\WINDOWS\system32\iphlpapi.dll
000007ff7e610000 - 000007ff7e625000: D:\WINDOWS\system32\rtutils.dll
000007ff7e630000 - 000007ff7e64c000: D:\WINDOWS\system32\rasman.dll
000007ff7e650000 - 000007ff7e6a7000: D:\WINDOWS\system32\TAPI32.dll
000007ff7e6b0000 - 000007ff7e71b000: D:\WINDOWS\system32\RASAPI32.DLL
000007ff7e720000 - 000007ff7e76e000: D:\WINDOWS\system32\DNSAPI.dll
000007ff7e780000 - 000007ff7e7e6000: D:\WINDOWS\system32\WLDAP32.dll
000007ff7e7f0000 - 000007ff7e812000: D:\WINDOWS\system32\Secur32.dll
000007ff7e820000 - 000007ff7e82b000: D:\WINDOWS\System32\winrnr.dll
000007ff7e830000 - 000007ff7e837000: D:\WINDOWS\system32\rasadhlp.dll
000007ff7e920000 - 000007ff7e9e6000: D:\WINDOWS\system32\COMRes.dll
000007ff7e9f0000 - 000007ff7eb04000: D:\WINDOWS\system32\OLEAUT32.dll
000007ff7ece0000 - 000007ff7ef52000: D:\WINDOWS\system32\ole32.dll
000007ff7ef60000 - 000007ff7effb000: D:\WINDOWS\system32\SHLWAPI.dll
000007ff7f190000 - 000007ff7fb96000: D:\WINDOWS\system32\SHELL32.dll
000007ff7fbf0000 - 000007ff7fbfb000: D:\WINDOWS\system32\VERSION.dll
000007ff7fc00000 - 000007ff7fc86000: D:\WINDOWS\system32\msvcrt.dll
000007ff7fc90000 - 000007ff7fd29000: D:\WINDOWS\system32\GDI32.dll
000007ff7fd30000 - 000007ff7fed9000: D:\WINDOWS\system32\RPCRT4.dll
000007ff7fee0000 - 000007ff7ffe5000: D:\WINDOWS\system32\ADVAPI32.dll

 

John,

Unfortunately, it the dump which provides the essential information.
The best alternative to the dump is the Error Signature but that only
shows the crash location (e.g. module version and offset).
The Stack Back Trace shows the callers, which often are more
to blame for the crash than the crashing module itself.


FYI

Robert
---