tux23
14th August 2004, 15:12
Somehow i do not manage to install the new divX codec...
It stops as it should copy the files.
I'm using Win 2k
Here's the Dr. Watson Protocoll (maybe someone can help me)
______________________________________________________________________
Anwendungsausnahme aufgetreten:
Anwendung: (pid=952)
Wann: 14.08.2004 @ 15:52:48.968
Ausnahmenummer: c0000005 (Zugriffsverletzung)
*----> Systeminformationen <----*
Computername: ERDE
Benutzername: tux2000
Prozessoranzahl: 1
Prozessortyp: x86 Family 6 Model 10 Stepping 0
Windows 2000-Version: 5.0
Aktuelles Build: 2195
Service Pack: 4
Aktueller Typ: Uniprocessor Free
Firma:
Besitzer: tux2000
*----> Taskliste <----*
0 Idle.exe
8 System.exe
192 SMSS.exe
216 CSRSS.exe
236 WINLOGON.exe
264 SERVICES.exe
276 LSASS.exe
448 svchost.exe
488 spoolsv.exe
520 svchost.exe
552 nvsvc32.exe
588 regsvc.exe
624 mstask.exe
744 slee401.exe
756 SMAgent.exe
840 explorer.exe
876 WinMgmt.exe
940 getright.exe
972 getright.exe
1088 winamp.exe
1100 scardsvr.exe
1288 IEXPLORE.exe
1124 hh.exe
952 DivX Pro 5.2 XP.exe
1408 DRWTSN32.exe
0 _Total.exe
[...not important...]
Statusabbild für Threadkennung 0x4cc
eax=74f84008 ebx=10005fe0 ecx=00000001 edx=00000000 esi=77889153 edi=0012e62c
eip=7788915e esp=0012e618 ebp=0012e634 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:00ba84ff=25252578
7788915c cd2e int 2e
7788915e c20800 ret 0x8
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012E634 77E8AC79 00000019 00000000 100026CF 00000019 ntdll!ZwDelayExecution
0012F410 10002DEB 00000000 001710E8 00000000 00000000 kernel32!Sleep
0012F5EC 00401F8A 10000000 004B8800 004020B2 00000251 !<nosymbols>
0012F7B8 00401F8A 00144EEC 005B1800 004020B2 00000635 !<nosymbols>
0012F984 00401F8A 00144290 00594400 004020B2 000005C0 !<nosymbols>
0012FB50 00401F8A 00146638 00139E1C 00404A00 00000713 !<nosymbols>
00420D20 322E3520 69725420 49206C61 6174736E 74616C6C !<nosymbols>
58766944 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
0012e618 a5 ac e8 77 00 00 00 00 - 2c e6 12 00 00 00 00 00 ...w....,.......
0012e628 94 55 e8 77 70 2f fc ff - ff ff ff ff 10 f4 12 00 .U.wp/..........
0012e638 79 ac e8 77 19 00 00 00 - 00 00 00 00 cf 26 00 10 y..w.........&..
0012e648 19 00 00 00 30 a4 40 00 - d1 2d 00 10 00 00 00 00 ....0.@..-......
0012e658 01 01 02 02 57 69 6e 53 - 6f 63 6b 20 32 2e 30 00 ....WinSock 2.0.
0012e668 b4 e8 12 00 00 00 13 00 - 78 01 13 00 60 b9 16 00 ........x...`...
0012e678 03 03 00 00 80 c7 8c 77 - 40 06 13 00 35 32 f4 77 .......w@...52.w
0012e688 b8 03 01 74 50 ec 12 00 - b8 03 01 74 c5 56 f4 77 ...tP......t.V.w
0012e698 01 00 00 00 50 ec 12 00 - 80 ee 12 00 e8 ed 12 00 ....P...........
0012e6a8 4e 4b 54 45 4e 20 52 45 - 78 01 13 00 60 b9 16 00 NKTEN REx...`...
0012e6b8 4c 46 53 2e 0d 0a 0d 0a - 40 06 13 00 4e 49 43 48 LFS.....@...NICH
0012e6c8 54 49 47 4b 45 49 54 3a - 20 57 65 6e 60 b9 16 00 TIGKEIT: Wen`...
0012e6d8 78 01 13 00 60 b9 16 00 - 78 01 13 00 60 b9 16 00 x...`...x...`...
0012e6e8 78 01 13 00 60 b9 16 00 - 78 01 13 00 58 b9 16 00 x...`...x...X...
0012e6f8 61 67 73 20 1a 5f e1 77 - 01 00 00 00 01 00 00 00 ags ._.w........
0012e708 5e 00 00 00 19 c7 28 77 - 01 00 00 00 01 00 00 00 ^.....(w........
0012e718 dd c5 28 77 01 00 00 00 - 01 00 00 00 01 00 00 00 ..(w............
0012e728 70 b3 16 00 d4 00 00 00 - f8 af 16 00 01 00 00 00 p...............
0012e738 e0 e7 12 00 d7 c8 8c 77 - 00 00 13 00 f8 af 16 00 .......w........
0012e748 b0 e7 12 00 25 c9 8c 77 - e0 07 00 00 d0 8c 17 00 ....%..w........
Statusabbild für Threadkennung 0x468
eax=00000000 ebx=00000000 ecx=0015c50c edx=00000000 esi=0040b468 edi=00000000
eip=77894091 esp=008dfea0 ebp=008dff10 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:01359d87=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:00a79ee6=45
77894097 3a5101 cmp dl,[ecx+0x1] ds:00bd63f2=51
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00a79ee6=0ca12745
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
008DFF10 778922F8 0040B400 00401B65 0040B468 00000000 ntdll!ZwWaitForSingleObject
77E8AC6E 03E80824 C2000000 8B550004 565151EC 0875FF57 ntdll!RtlImageDirectoryEntryToData
74FF006A 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
008dfea0 87 23 89 77 68 00 00 00 - 00 00 00 00 00 00 00 00 .#.wh...........
008dfeb0 68 b4 40 00 40 b4 40 00 - 00 00 00 00 00 00 00 00 h.@.@.@.........
008dfec0 00 00 00 00 68 b4 40 00 - 40 b4 40 00 00 00 00 00 ....h.@.@.@.....
008dfed0 d6 aa e7 77 00 00 00 00 - 00 00 00 00 d6 aa e7 77 ...w...........w
008dfee0 00 00 00 00 00 00 00 00 - 10 27 00 00 00 00 00 00 .........'......
008dfef0 d6 aa e7 77 00 00 00 00 - 00 00 00 00 10 27 00 00 ...w.........'..
008dff00 00 00 00 00 c3 23 89 77 - 68 00 00 00 00 00 00 00 .....#.wh.......
008dff10 6e ac e8 77 f8 22 89 77 - 00 b4 40 00 65 1b 40 00 n..w.".w..@.e.@.
008dff20 68 b4 40 00 00 00 00 00 - fc c4 15 00 54 ff 8d 00 h.@.........T...
008dff30 09 00 00 00 e2 13 40 00 - 40 b4 40 00 00 46 42 d3 ......@.@.@..FB.
008dff40 5b 18 40 00 e8 c4 15 00 - 99 00 00 00 f8 11 16 00 [.@.............
008dff50 ad 45 03 00 8c ff 8d 00 - a4 11 40 00 fc c4 15 00 .E........@.....
008dff60 00 00 80 00 40 b4 40 00 - 03 00 00 00 cc 00 00 00 ....@.@.........
008dff70 41 01 00 00 f8 01 00 00 - 2c 00 00 00 01 00 00 00 A.......,.......
008dff80 c9 ff 8d 00 00 00 00 00 - fd 37 af 00 b4 ff 8d 00 .........7......
008dff90 bc 1c 40 00 00 00 00 00 - 44 00 00 00 5c fb 12 00 ..@.....D...\...
008dffa0 40 b4 40 00 98 34 41 00 - 00 00 00 00 02 00 00 00 @.@..4A.........
008dffb0 03 00 00 00 ec ff 8d 00 - 7c 98 e7 77 e8 c4 15 00 ........|..w....
008dffc0 44 00 00 00 5c fb 12 00 - 40 b4 40 00 00 d0 fd 7f D...\...@.@.....
008dffd0 03 00 00 00 c0 ff 8d 00 - 03 00 00 00 ff ff ff ff ................
Statusabbild für Threadkennung 0x334
eax=01188b60 ebx=00000000 ecx=778833b9 edx=00000000 esi=013bff74 edi=77e05780
eip=77e02f5c esp=013bff2c ebp=013bff4c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: TranslateMessageEx
77e02f3a 0f8540d80200 jne UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr [esp+0x8] ss:01e39e13=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,[esp+0x4] ss:01e39e13=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
013BFF4C 01188C2A 013BFF74 000801CA 00000000 00000000 user32!TranslateMessageEx
013BFFEC 00000000 00000000 00000000 00000000 00000000 <nosymbols>
Statusabbild für Threadkennung 0x3c4
eax=00020000 ebx=00000004 ecx=00000000 edx=00000000 esi=77893233 edi=00000004
eip=7789323e esp=01adfd24 ebp=01adfd70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:02559c0b=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01ADFD70 77E8ABFB 01ADFD48 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
01ADFFB4 77E7987C 00000005 000B000A 793502A7 00177DB8 kernel32!WaitForMultipleObjects
01ADFFEC 00000000 778221FE 00177DB8 00000000 000000C8 kernel32!SetThreadExecutionState
*----> Raw Stack Dump <----*
01adfd24 d7 bd e7 77 04 00 00 00 - 48 fd ad 01 01 00 00 00 ...w....H.......
01adfd34 00 00 00 00 00 00 00 00 - 01 00 00 00 b8 7d 17 00 .............}..
01adfd44 01 00 00 00 f4 00 00 00 - f8 00 00 00 08 01 00 00 ................
01adfd54 6c 01 00 00 c4 00 00 00 - d8 90 42 e1 48 05 69 f9 l.........B.H.i.
01adfd64 04 01 00 00 11 00 00 00 - 02 00 00 00 b4 ff ad 01 ................
01adfd74 fb ab e8 77 48 fd ad 01 - 01 00 00 00 00 00 00 00 ...wH...........
01adfd84 00 00 00 00 00 00 00 00 - b2 22 82 77 04 00 00 00 .........".w....
01adfd94 b0 fe ad 01 00 00 00 00 - ff ff ff ff b8 7d 17 00 .............}..
01adfda4 a7 02 35 79 0a 00 0b 00 - e8 91 f9 e2 ec 91 f9 e2 ..5y............
01adfdb4 c0 d7 db f9 00 00 00 00 - 01 00 00 00 38 00 00 00 ............8...
01adfdc4 23 00 00 00 23 00 00 00 - 0a 00 0b 00 a7 02 35 79 #...#.........5y
01adfdd4 b8 7d 17 00 68 02 35 79 - 4c 00 00 00 fe 21 82 77 .}..h.5yL....!.w
01adfde4 f8 9b fd 7f 24 98 e7 77 - 1b 00 00 00 00 02 00 00 ....$..w........
01adfdf4 fc ff ad 01 23 00 00 00 - f3 55 45 80 80 5b 2c ba ....#....UE..[,.
01adfe04 68 17 9a f9 68 17 9a f9 - 40 00 00 00 24 5b 2c ba h...h...@...$[,.
01adfe14 80 fd 44 80 00 38 7a f9 - 00 00 00 00 00 00 00 00 ..D..8z.........
01adfe24 88 4f 99 f9 b2 34 49 80 - 88 4f 99 f9 c8 00 00 00 .O...4I..O......
01adfe34 60 11 dc f9 03 00 10 00 - 68 17 9a f9 60 11 dc f9 `.......h...`...
01adfe44 80 17 9a f9 68 17 9a f9 - 6c 17 9a f9 c0 d7 db f9 ....h...l.......
01adfe54 40 5d 2c ba 01 00 00 00 - e0 38 7a f9 01 00 00 00 @],......8z.....
Statusabbild für Threadkennung 0x41c
eax=01af2e30 ebx=77e8278d ecx=0012e0d4 edx=00000000 esi=00000094 edi=77e7fe7a
eip=7788beb2 esp=01c2ff5c ebp=01c2ff84 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:026a9e43=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01C2FF84 01AF2E6D 00000094 01C2FFBC 01C2FFB4 01C2FFB0 ntdll!NtRemoveIoCompletion
77E8C468 57565351 0018A164 7D8B0000 30408B08 0FF4FF83 !<nosymbols>
51EC8B55 00000000 00000000 00000000 00000000 00000000 <nosymbols>
Statusabbild für Threadkennung 0x300
eax=c0000000 ebx=01b0a8f1 ecx=000701c8 edx=00000000 esi=01d2fed4 edi=00cf0000
eip=01188b20 esp=01d2fda8 ebp=01d2fdc4 iopl=0 nv up ei pl nz na po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000207
Funktion: <nosymbols>
01188b16 ???
01188b17 ???
01188b18 ???
01188b19 ???
01188b1a ???
01188b1b ???
01188b1c ???
01188b1d ???
01188b1e ???
01188b1f ???
FEHLER ->01188b20 ???
01188b21 ???
01188b22 ???
01188b23 ???
01188b24 ???
01188b25 ???
01188b26 ???
01188b27 ???
01188b28 ???
01188b29 ???
01188b2a ???
01188b2b ???
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01D2FDA4 77E02CA8 000701C8 00000024 00000000 01D2FE24 <nosymbols>
01D2FDC4 77E04764 01188B20 000701C8 00000024 00000000 user32!GetSysColor
01D2FDE0 77E16C3D 004ED120 00000024 00000000 01D2FE24 user32!SetWindowTextW
01D2FE08 778A15EF 01D2FE18 0000003C 004ED120 00000024 user32!wvsprintfW
01D2FEFC 77E17036 80000000 01B0AB00 01B0A8F1 01D2FEE8 ntdll!KiUserCallbackDispatcher
01D2FF38 01AF8C02 00000000 01B0AB00 01B0A8F1 00CF0000 user32!CreateWindowExA
01D2FFEC 00000000 00000000 00000000 00000000 00000000 !<nosymbols>
Statusabbild für Threadkennung 0x418
eax=74f92b28 ebx=001342a0 ecx=74fad67d edx=00000000 esi=77889153 edi=74fad554
eip=7788915e esp=01e2fe90 ebp=01e2ffb4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:028a9d77=????????
7788915c cd2e int 2e
7788915e c20800 ret 0x8
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01E2FFB4 77E7987C 001342A0 74FAD554 74FAD6DB 001342A0 ntdll!ZwDelayExecution
01E2FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState
Statusabbild für Threadkennung 0x59c
eax=00000001 ebx=01f2f3ac ecx=001713dc edx=00000000 esi=00165150 edi=7788a1e0
eip=7788917a esp=01f2f390 ebp=01f2f4b8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtRequestWaitReplyPort
7788916f b8b0000000 mov eax,0xb0
77889174 8d542404 lea edx,[esp+0x4] ss:029a9277=????????
77889178 cd2e int 2e
7788917a c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01F2F4B8 77D3D565 0018E008 779786C8 00000000 00000001 ntdll!NtRequestWaitReplyPort
01F2F514 77D3CDEA 00000000 01F2F5A4 00000000 779786C8 rpcrt4!TowerConstruct
01F2F570 77D3C706 01F2F5A4 779786C8 00000000 00000000 rpcrt4!TowerConstruct
01F2F59C 77D319E3 01F2F7B0 00000000 7797884C 01F2F7FC rpcrt4!TowerConstruct
01F2F5B4 77D319F4 01F2F7B0 00000000 77D5B202 01F2F7B0 rpcrt4!I_RpcGetBufferWithObject
01F2F9A8 77979130 77978710 7797883C 01F2F9C0 77978E79 rpcrt4!I_RpcGetBuffer
01F2FA18 77978F64 00179598 00000001 00000010 00000000 dnsapi!DnsQuery_A
01F2FA44 7783246A 001759B8 00000001 00000010 00000000 dnsapi!DnsQuery_A
01F2FCCC 74FA3047 0018E560 001759B8 01F2FD40 0018E198 rnr20!<nosymbols>
77889103 8B000000 83042454 0F00147A 011E5085 42FF9000 ws2_32!WSALookupServiceNextW
180D8B64 00000000 00000000 00000000 00000000 00000000 <nosymbols>
(Tut mir leid wegen der Umformatierung Strg+C Strg+V könnte helfen)
Danke
It stops as it should copy the files.
I'm using Win 2k
Here's the Dr. Watson Protocoll (maybe someone can help me)
______________________________________________________________________
Anwendungsausnahme aufgetreten:
Anwendung: (pid=952)
Wann: 14.08.2004 @ 15:52:48.968
Ausnahmenummer: c0000005 (Zugriffsverletzung)
*----> Systeminformationen <----*
Computername: ERDE
Benutzername: tux2000
Prozessoranzahl: 1
Prozessortyp: x86 Family 6 Model 10 Stepping 0
Windows 2000-Version: 5.0
Aktuelles Build: 2195
Service Pack: 4
Aktueller Typ: Uniprocessor Free
Firma:
Besitzer: tux2000
*----> Taskliste <----*
0 Idle.exe
8 System.exe
192 SMSS.exe
216 CSRSS.exe
236 WINLOGON.exe
264 SERVICES.exe
276 LSASS.exe
448 svchost.exe
488 spoolsv.exe
520 svchost.exe
552 nvsvc32.exe
588 regsvc.exe
624 mstask.exe
744 slee401.exe
756 SMAgent.exe
840 explorer.exe
876 WinMgmt.exe
940 getright.exe
972 getright.exe
1088 winamp.exe
1100 scardsvr.exe
1288 IEXPLORE.exe
1124 hh.exe
952 DivX Pro 5.2 XP.exe
1408 DRWTSN32.exe
0 _Total.exe
[...not important...]
Statusabbild für Threadkennung 0x4cc
eax=74f84008 ebx=10005fe0 ecx=00000001 edx=00000000 esi=77889153 edi=0012e62c
eip=7788915e esp=0012e618 ebp=0012e634 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:00ba84ff=25252578
7788915c cd2e int 2e
7788915e c20800 ret 0x8
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012E634 77E8AC79 00000019 00000000 100026CF 00000019 ntdll!ZwDelayExecution
0012F410 10002DEB 00000000 001710E8 00000000 00000000 kernel32!Sleep
0012F5EC 00401F8A 10000000 004B8800 004020B2 00000251 !<nosymbols>
0012F7B8 00401F8A 00144EEC 005B1800 004020B2 00000635 !<nosymbols>
0012F984 00401F8A 00144290 00594400 004020B2 000005C0 !<nosymbols>
0012FB50 00401F8A 00146638 00139E1C 00404A00 00000713 !<nosymbols>
00420D20 322E3520 69725420 49206C61 6174736E 74616C6C !<nosymbols>
58766944 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
0012e618 a5 ac e8 77 00 00 00 00 - 2c e6 12 00 00 00 00 00 ...w....,.......
0012e628 94 55 e8 77 70 2f fc ff - ff ff ff ff 10 f4 12 00 .U.wp/..........
0012e638 79 ac e8 77 19 00 00 00 - 00 00 00 00 cf 26 00 10 y..w.........&..
0012e648 19 00 00 00 30 a4 40 00 - d1 2d 00 10 00 00 00 00 ....0.@..-......
0012e658 01 01 02 02 57 69 6e 53 - 6f 63 6b 20 32 2e 30 00 ....WinSock 2.0.
0012e668 b4 e8 12 00 00 00 13 00 - 78 01 13 00 60 b9 16 00 ........x...`...
0012e678 03 03 00 00 80 c7 8c 77 - 40 06 13 00 35 32 f4 77 .......w@...52.w
0012e688 b8 03 01 74 50 ec 12 00 - b8 03 01 74 c5 56 f4 77 ...tP......t.V.w
0012e698 01 00 00 00 50 ec 12 00 - 80 ee 12 00 e8 ed 12 00 ....P...........
0012e6a8 4e 4b 54 45 4e 20 52 45 - 78 01 13 00 60 b9 16 00 NKTEN REx...`...
0012e6b8 4c 46 53 2e 0d 0a 0d 0a - 40 06 13 00 4e 49 43 48 LFS.....@...NICH
0012e6c8 54 49 47 4b 45 49 54 3a - 20 57 65 6e 60 b9 16 00 TIGKEIT: Wen`...
0012e6d8 78 01 13 00 60 b9 16 00 - 78 01 13 00 60 b9 16 00 x...`...x...`...
0012e6e8 78 01 13 00 60 b9 16 00 - 78 01 13 00 58 b9 16 00 x...`...x...X...
0012e6f8 61 67 73 20 1a 5f e1 77 - 01 00 00 00 01 00 00 00 ags ._.w........
0012e708 5e 00 00 00 19 c7 28 77 - 01 00 00 00 01 00 00 00 ^.....(w........
0012e718 dd c5 28 77 01 00 00 00 - 01 00 00 00 01 00 00 00 ..(w............
0012e728 70 b3 16 00 d4 00 00 00 - f8 af 16 00 01 00 00 00 p...............
0012e738 e0 e7 12 00 d7 c8 8c 77 - 00 00 13 00 f8 af 16 00 .......w........
0012e748 b0 e7 12 00 25 c9 8c 77 - e0 07 00 00 d0 8c 17 00 ....%..w........
Statusabbild für Threadkennung 0x468
eax=00000000 ebx=00000000 ecx=0015c50c edx=00000000 esi=0040b468 edi=00000000
eip=77894091 esp=008dfea0 ebp=008dff10 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:01359d87=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:00a79ee6=45
77894097 3a5101 cmp dl,[ecx+0x1] ds:00bd63f2=51
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00a79ee6=0ca12745
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
008DFF10 778922F8 0040B400 00401B65 0040B468 00000000 ntdll!ZwWaitForSingleObject
77E8AC6E 03E80824 C2000000 8B550004 565151EC 0875FF57 ntdll!RtlImageDirectoryEntryToData
74FF006A 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
008dfea0 87 23 89 77 68 00 00 00 - 00 00 00 00 00 00 00 00 .#.wh...........
008dfeb0 68 b4 40 00 40 b4 40 00 - 00 00 00 00 00 00 00 00 h.@.@.@.........
008dfec0 00 00 00 00 68 b4 40 00 - 40 b4 40 00 00 00 00 00 ....h.@.@.@.....
008dfed0 d6 aa e7 77 00 00 00 00 - 00 00 00 00 d6 aa e7 77 ...w...........w
008dfee0 00 00 00 00 00 00 00 00 - 10 27 00 00 00 00 00 00 .........'......
008dfef0 d6 aa e7 77 00 00 00 00 - 00 00 00 00 10 27 00 00 ...w.........'..
008dff00 00 00 00 00 c3 23 89 77 - 68 00 00 00 00 00 00 00 .....#.wh.......
008dff10 6e ac e8 77 f8 22 89 77 - 00 b4 40 00 65 1b 40 00 n..w.".w..@.e.@.
008dff20 68 b4 40 00 00 00 00 00 - fc c4 15 00 54 ff 8d 00 h.@.........T...
008dff30 09 00 00 00 e2 13 40 00 - 40 b4 40 00 00 46 42 d3 ......@.@.@..FB.
008dff40 5b 18 40 00 e8 c4 15 00 - 99 00 00 00 f8 11 16 00 [.@.............
008dff50 ad 45 03 00 8c ff 8d 00 - a4 11 40 00 fc c4 15 00 .E........@.....
008dff60 00 00 80 00 40 b4 40 00 - 03 00 00 00 cc 00 00 00 ....@.@.........
008dff70 41 01 00 00 f8 01 00 00 - 2c 00 00 00 01 00 00 00 A.......,.......
008dff80 c9 ff 8d 00 00 00 00 00 - fd 37 af 00 b4 ff 8d 00 .........7......
008dff90 bc 1c 40 00 00 00 00 00 - 44 00 00 00 5c fb 12 00 ..@.....D...\...
008dffa0 40 b4 40 00 98 34 41 00 - 00 00 00 00 02 00 00 00 @.@..4A.........
008dffb0 03 00 00 00 ec ff 8d 00 - 7c 98 e7 77 e8 c4 15 00 ........|..w....
008dffc0 44 00 00 00 5c fb 12 00 - 40 b4 40 00 00 d0 fd 7f D...\...@.@.....
008dffd0 03 00 00 00 c0 ff 8d 00 - 03 00 00 00 ff ff ff ff ................
Statusabbild für Threadkennung 0x334
eax=01188b60 ebx=00000000 ecx=778833b9 edx=00000000 esi=013bff74 edi=77e05780
eip=77e02f5c esp=013bff2c ebp=013bff4c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: TranslateMessageEx
77e02f3a 0f8540d80200 jne UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr [esp+0x8] ss:01e39e13=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,[esp+0x4] ss:01e39e13=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
013BFF4C 01188C2A 013BFF74 000801CA 00000000 00000000 user32!TranslateMessageEx
013BFFEC 00000000 00000000 00000000 00000000 00000000 <nosymbols>
Statusabbild für Threadkennung 0x3c4
eax=00020000 ebx=00000004 ecx=00000000 edx=00000000 esi=77893233 edi=00000004
eip=7789323e esp=01adfd24 ebp=01adfd70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:02559c0b=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01ADFD70 77E8ABFB 01ADFD48 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
01ADFFB4 77E7987C 00000005 000B000A 793502A7 00177DB8 kernel32!WaitForMultipleObjects
01ADFFEC 00000000 778221FE 00177DB8 00000000 000000C8 kernel32!SetThreadExecutionState
*----> Raw Stack Dump <----*
01adfd24 d7 bd e7 77 04 00 00 00 - 48 fd ad 01 01 00 00 00 ...w....H.......
01adfd34 00 00 00 00 00 00 00 00 - 01 00 00 00 b8 7d 17 00 .............}..
01adfd44 01 00 00 00 f4 00 00 00 - f8 00 00 00 08 01 00 00 ................
01adfd54 6c 01 00 00 c4 00 00 00 - d8 90 42 e1 48 05 69 f9 l.........B.H.i.
01adfd64 04 01 00 00 11 00 00 00 - 02 00 00 00 b4 ff ad 01 ................
01adfd74 fb ab e8 77 48 fd ad 01 - 01 00 00 00 00 00 00 00 ...wH...........
01adfd84 00 00 00 00 00 00 00 00 - b2 22 82 77 04 00 00 00 .........".w....
01adfd94 b0 fe ad 01 00 00 00 00 - ff ff ff ff b8 7d 17 00 .............}..
01adfda4 a7 02 35 79 0a 00 0b 00 - e8 91 f9 e2 ec 91 f9 e2 ..5y............
01adfdb4 c0 d7 db f9 00 00 00 00 - 01 00 00 00 38 00 00 00 ............8...
01adfdc4 23 00 00 00 23 00 00 00 - 0a 00 0b 00 a7 02 35 79 #...#.........5y
01adfdd4 b8 7d 17 00 68 02 35 79 - 4c 00 00 00 fe 21 82 77 .}..h.5yL....!.w
01adfde4 f8 9b fd 7f 24 98 e7 77 - 1b 00 00 00 00 02 00 00 ....$..w........
01adfdf4 fc ff ad 01 23 00 00 00 - f3 55 45 80 80 5b 2c ba ....#....UE..[,.
01adfe04 68 17 9a f9 68 17 9a f9 - 40 00 00 00 24 5b 2c ba h...h...@...$[,.
01adfe14 80 fd 44 80 00 38 7a f9 - 00 00 00 00 00 00 00 00 ..D..8z.........
01adfe24 88 4f 99 f9 b2 34 49 80 - 88 4f 99 f9 c8 00 00 00 .O...4I..O......
01adfe34 60 11 dc f9 03 00 10 00 - 68 17 9a f9 60 11 dc f9 `.......h...`...
01adfe44 80 17 9a f9 68 17 9a f9 - 6c 17 9a f9 c0 d7 db f9 ....h...l.......
01adfe54 40 5d 2c ba 01 00 00 00 - e0 38 7a f9 01 00 00 00 @],......8z.....
Statusabbild für Threadkennung 0x41c
eax=01af2e30 ebx=77e8278d ecx=0012e0d4 edx=00000000 esi=00000094 edi=77e7fe7a
eip=7788beb2 esp=01c2ff5c ebp=01c2ff84 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:026a9e43=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01C2FF84 01AF2E6D 00000094 01C2FFBC 01C2FFB4 01C2FFB0 ntdll!NtRemoveIoCompletion
77E8C468 57565351 0018A164 7D8B0000 30408B08 0FF4FF83 !<nosymbols>
51EC8B55 00000000 00000000 00000000 00000000 00000000 <nosymbols>
Statusabbild für Threadkennung 0x300
eax=c0000000 ebx=01b0a8f1 ecx=000701c8 edx=00000000 esi=01d2fed4 edi=00cf0000
eip=01188b20 esp=01d2fda8 ebp=01d2fdc4 iopl=0 nv up ei pl nz na po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000207
Funktion: <nosymbols>
01188b16 ???
01188b17 ???
01188b18 ???
01188b19 ???
01188b1a ???
01188b1b ???
01188b1c ???
01188b1d ???
01188b1e ???
01188b1f ???
FEHLER ->01188b20 ???
01188b21 ???
01188b22 ???
01188b23 ???
01188b24 ???
01188b25 ???
01188b26 ???
01188b27 ???
01188b28 ???
01188b29 ???
01188b2a ???
01188b2b ???
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01D2FDA4 77E02CA8 000701C8 00000024 00000000 01D2FE24 <nosymbols>
01D2FDC4 77E04764 01188B20 000701C8 00000024 00000000 user32!GetSysColor
01D2FDE0 77E16C3D 004ED120 00000024 00000000 01D2FE24 user32!SetWindowTextW
01D2FE08 778A15EF 01D2FE18 0000003C 004ED120 00000024 user32!wvsprintfW
01D2FEFC 77E17036 80000000 01B0AB00 01B0A8F1 01D2FEE8 ntdll!KiUserCallbackDispatcher
01D2FF38 01AF8C02 00000000 01B0AB00 01B0A8F1 00CF0000 user32!CreateWindowExA
01D2FFEC 00000000 00000000 00000000 00000000 00000000 !<nosymbols>
Statusabbild für Threadkennung 0x418
eax=74f92b28 ebx=001342a0 ecx=74fad67d edx=00000000 esi=77889153 edi=74fad554
eip=7788915e esp=01e2fe90 ebp=01e2ffb4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:028a9d77=????????
7788915c cd2e int 2e
7788915e c20800 ret 0x8
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01E2FFB4 77E7987C 001342A0 74FAD554 74FAD6DB 001342A0 ntdll!ZwDelayExecution
01E2FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState
Statusabbild für Threadkennung 0x59c
eax=00000001 ebx=01f2f3ac ecx=001713dc edx=00000000 esi=00165150 edi=7788a1e0
eip=7788917a esp=01f2f390 ebp=01f2f4b8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
Funktion: NtRequestWaitReplyPort
7788916f b8b0000000 mov eax,0xb0
77889174 8d542404 lea edx,[esp+0x4] ss:029a9277=????????
77889178 cd2e int 2e
7788917a c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01F2F4B8 77D3D565 0018E008 779786C8 00000000 00000001 ntdll!NtRequestWaitReplyPort
01F2F514 77D3CDEA 00000000 01F2F5A4 00000000 779786C8 rpcrt4!TowerConstruct
01F2F570 77D3C706 01F2F5A4 779786C8 00000000 00000000 rpcrt4!TowerConstruct
01F2F59C 77D319E3 01F2F7B0 00000000 7797884C 01F2F7FC rpcrt4!TowerConstruct
01F2F5B4 77D319F4 01F2F7B0 00000000 77D5B202 01F2F7B0 rpcrt4!I_RpcGetBufferWithObject
01F2F9A8 77979130 77978710 7797883C 01F2F9C0 77978E79 rpcrt4!I_RpcGetBuffer
01F2FA18 77978F64 00179598 00000001 00000010 00000000 dnsapi!DnsQuery_A
01F2FA44 7783246A 001759B8 00000001 00000010 00000000 dnsapi!DnsQuery_A
01F2FCCC 74FA3047 0018E560 001759B8 01F2FD40 0018E198 rnr20!<nosymbols>
77889103 8B000000 83042454 0F00147A 011E5085 42FF9000 ws2_32!WSALookupServiceNextW
180D8B64 00000000 00000000 00000000 00000000 00000000 <nosymbols>
(Tut mir leid wegen der Umformatierung Strg+C Strg+V könnte helfen)
Danke