1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Reboot from a bugcheck

Discussion in 'Windows XP' started by nubyan, 2007/11/13.

  1. 2007/11/13
    nubyan

    nubyan Inactive Thread Starter

    Joined:
    2007/11/13
    Messages:
    2
    Likes Received:
    0
    In the last month my computer started to restart at least once a day.
    here is the event viewer log

    The computer has rebooted from a bugcheck. The bugcheck was: 0x1000008e (0xc0000005, 0xbf80adca, 0xed554a38, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini111307-01.dmp.

    And here is the dump
    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffff0, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804f089e, address which referenced memory

    Debugging Details:
    ------------------




    READ_ADDRESS: fffffff0

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!CcFindBcb+33
    804f089e 668138fd02 cmp word ptr [eax],2FDh

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: Opera.exe

    LAST_CONTROL_TRANSFER: from 804f0b61 to 804f089e

    STACK_TEXT:
    ee13cfd8 804f0b61 85379a88 ee13d0a4 ee13d008 nt!CcFindBcb+0x33
    ee13d064 8057a5a7 85374178 ee13d0a4 00001000 nt!CcPinFileData+0xd8
    ee13d0d8 f7689017 85374178 ee13d108 00001000 nt!CcPinMappedData+0xf4
    ee13d0f8 f76944a8 86665ef0 e31ed918 00084000 Ntfs!NtfsPinMappedData+0x4f
    ee13d170 f76943af 86665ef0 e31ed918 ee13d2b4 Ntfs!InsertSimpleAllocation+0x62
    ee13d1c8 f7694319 86665ef0 e31ed918 ee13d2b4 Ntfs!AddToIndex+0x124
    ee13d2e8 f7693797 86665ef0 e31ed918 e20bdc60 Ntfs!NtfsAddIndexEntry+0xbf
    ee13d36c f7693826 86665ef0 e31ed918 e4b2bcc8 Ntfs!NtfsAddNameToParent+0x1b6
    ee13d3b4 f7694b17 86665ef0 00000001 e31ed918 Ntfs!NtfsAddLink+0x77
    ee13d5b0 f7687c37 86665ef0 85281888 852819f4 Ntfs!NtfsCreateNewFile+0x87a
    ee13d804 f7684f64 86665ef0 85281888 ee13d85c Ntfs!NtfsCommonCreate+0x12ce
    ee13d8e4 804e3d77 86786020 85281888 8676cac0 Ntfs!NtfsFsdCreate+0x1ec
    ee13d8f4 f770890e 85281a3c 867e4518 85281888 nt!IopfCallDriver+0x31
    ee13d940 804e3d77 8676cac0 00000005 85281a60 sr!SrCreate+0x1e8
    ee13d950 edb7ee9e 4290012d 00000000 00000005 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ee13d97c edb84c14 85281888 ee13da2c 85281888 naiavf5x+0x1e9e
    ee13d9f0 edb8511d 85281888 85281a3c 853cb7c0 naiavf5x+0x7c14
    ee13da38 edb7f950 00000000 85281898 864eac08 naiavf5x+0x811d
    ee13da4c 804e3d77 861986f0 85281888 85281888 naiavf5x+0x2950
    ee13da5c 80570f9c 867264d0 86162b7c ee13dc04 nt!IopfCallDriver+0x31
    ee13db3c 8056386c 867264e8 00000000 86162ad8 nt!IopParseDevice+0xa58
    ee13dbc4 80567c63 00000000 ee13dc04 00000040 nt!ObpLookupObjectName+0x56a
    ee13dc18 80571477 00000000 00000000 00000001 nt!ObOpenObjectByName+0xeb
    ee13dc94 80571546 0012f2a0 40100080 0012f240 nt!IopCreateFile+0x407
    ee13dcf0 8057167c 0012f2a0 40100080 0012f240 nt!IoCreateFile+0x8e
    ee13dd30 804df06b 0012f2a0 40100080 0012f240 nt!NtCreateFile+0x30
    ee13dd30 7c90eb94 0012f2a0 40100080 0012f240 nt!KiFastCallEntry+0xf8
    0012f298 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    naiavf5x+1e9e
    edb7ee9e ?? ???

    SYMBOL_STACK_INDEX: f

    SYMBOL_NAME: naiavf5x+1e9e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: naiavf5x

    IMAGE_NAME: naiavf5x.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

    FAILURE_BUCKET_ID: 0xA_naiavf5x+1e9e

    BUCKET_ID: 0xA_naiavf5x+1e9e

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffff0, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804f089e, address which referenced memory

    Debugging Details:
    ------------------




    READ_ADDRESS: fffffff0

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!CcFindBcb+33
    804f089e 668138fd02 cmp word ptr [eax],2FDh

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: Opera.exe

    LAST_CONTROL_TRANSFER: from 804f0b61 to 804f089e

    STACK_TEXT:
    ee13cfd8 804f0b61 85379a88 ee13d0a4 ee13d008 nt!CcFindBcb+0x33
    ee13d064 8057a5a7 85374178 ee13d0a4 00001000 nt!CcPinFileData+0xd8
    ee13d0d8 f7689017 85374178 ee13d108 00001000 nt!CcPinMappedData+0xf4
    ee13d0f8 f76944a8 86665ef0 e31ed918 00084000 Ntfs!NtfsPinMappedData+0x4f
    ee13d170 f76943af 86665ef0 e31ed918 ee13d2b4 Ntfs!InsertSimpleAllocation+0x62
    ee13d1c8 f7694319 86665ef0 e31ed918 ee13d2b4 Ntfs!AddToIndex+0x124
    ee13d2e8 f7693797 86665ef0 e31ed918 e20bdc60 Ntfs!NtfsAddIndexEntry+0xbf
    ee13d36c f7693826 86665ef0 e31ed918 e4b2bcc8 Ntfs!NtfsAddNameToParent+0x1b6
    ee13d3b4 f7694b17 86665ef0 00000001 e31ed918 Ntfs!NtfsAddLink+0x77
    ee13d5b0 f7687c37 86665ef0 85281888 852819f4 Ntfs!NtfsCreateNewFile+0x87a
    ee13d804 f7684f64 86665ef0 85281888 ee13d85c Ntfs!NtfsCommonCreate+0x12ce
    ee13d8e4 804e3d77 86786020 85281888 8676cac0 Ntfs!NtfsFsdCreate+0x1ec
    ee13d8f4 f770890e 85281a3c 867e4518 85281888 nt!IopfCallDriver+0x31
    ee13d940 804e3d77 8676cac0 00000005 85281a60 sr!SrCreate+0x1e8
    ee13d950 edb7ee9e 4290012d 00000000 00000005 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ee13d97c edb84c14 85281888 ee13da2c 85281888 naiavf5x+0x1e9e
    ee13d9f0 edb8511d 85281888 85281a3c 853cb7c0 naiavf5x+0x7c14
    ee13da38 edb7f950 00000000 85281898 864eac08 naiavf5x+0x811d
    ee13da4c 804e3d77 861986f0 85281888 85281888 naiavf5x+0x2950
    ee13da5c 80570f9c 867264d0 86162b7c ee13dc04 nt!IopfCallDriver+0x31
    ee13db3c 8056386c 867264e8 00000000 86162ad8 nt!IopParseDevice+0xa58
    ee13dbc4 80567c63 00000000 ee13dc04 00000040 nt!ObpLookupObjectName+0x56a
    ee13dc18 80571477 00000000 00000000 00000001 nt!ObOpenObjectByName+0xeb
    ee13dc94 80571546 0012f2a0 40100080 0012f240 nt!IopCreateFile+0x407
    ee13dcf0 8057167c 0012f2a0 40100080 0012f240 nt!IoCreateFile+0x8e
    ee13dd30 804df06b 0012f2a0 40100080 0012f240 nt!NtCreateFile+0x30
    ee13dd30 7c90eb94 0012f2a0 40100080 0012f240 nt!KiFastCallEntry+0xf8
    0012f298 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    naiavf5x+1e9e
    edb7ee9e ?? ???

    SYMBOL_STACK_INDEX: f

    SYMBOL_NAME: naiavf5x+1e9e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: naiavf5x

    IMAGE_NAME: naiavf5x.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

    FAILURE_BUCKET_ID: 0xA_naiavf5x+1e9e

    BUCKET_ID: 0xA_naiavf5x+1e9e

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffff0, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804f089e, address which referenced memory

    Debugging Details:
    ------------------




    READ_ADDRESS: fffffff0

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!CcFindBcb+33
    804f089e 668138fd02 cmp word ptr [eax],2FDh

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: Opera.exe

    LAST_CONTROL_TRANSFER: from 804f0b61 to 804f089e

    STACK_TEXT:
    ee13cfd8 804f0b61 85379a88 ee13d0a4 ee13d008 nt!CcFindBcb+0x33
    ee13d064 8057a5a7 85374178 ee13d0a4 00001000 nt!CcPinFileData+0xd8
    ee13d0d8 f7689017 85374178 ee13d108 00001000 nt!CcPinMappedData+0xf4
    ee13d0f8 f76944a8 86665ef0 e31ed918 00084000 Ntfs!NtfsPinMappedData+0x4f
    ee13d170 f76943af 86665ef0 e31ed918 ee13d2b4 Ntfs!InsertSimpleAllocation+0x62
    ee13d1c8 f7694319 86665ef0 e31ed918 ee13d2b4 Ntfs!AddToIndex+0x124
    ee13d2e8 f7693797 86665ef0 e31ed918 e20bdc60 Ntfs!NtfsAddIndexEntry+0xbf
    ee13d36c f7693826 86665ef0 e31ed918 e4b2bcc8 Ntfs!NtfsAddNameToParent+0x1b6
    ee13d3b4 f7694b17 86665ef0 00000001 e31ed918 Ntfs!NtfsAddLink+0x77
    ee13d5b0 f7687c37 86665ef0 85281888 852819f4 Ntfs!NtfsCreateNewFile+0x87a
    ee13d804 f7684f64 86665ef0 85281888 ee13d85c Ntfs!NtfsCommonCreate+0x12ce
    ee13d8e4 804e3d77 86786020 85281888 8676cac0 Ntfs!NtfsFsdCreate+0x1ec
    ee13d8f4 f770890e 85281a3c 867e4518 85281888 nt!IopfCallDriver+0x31
    ee13d940 804e3d77 8676cac0 00000005 85281a60 sr!SrCreate+0x1e8
    ee13d950 edb7ee9e 4290012d 00000000 00000005 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ee13d97c edb84c14 85281888 ee13da2c 85281888 naiavf5x+0x1e9e
    ee13d9f0 edb8511d 85281888 85281a3c 853cb7c0 naiavf5x+0x7c14
    ee13da38 edb7f950 00000000 85281898 864eac08 naiavf5x+0x811d
    ee13da4c 804e3d77 861986f0 85281888 85281888 naiavf5x+0x2950
    ee13da5c 80570f9c 867264d0 86162b7c ee13dc04 nt!IopfCallDriver+0x31
    ee13db3c 8056386c 867264e8 00000000 86162ad8 nt!IopParseDevice+0xa58
    ee13dbc4 80567c63 00000000 ee13dc04 00000040 nt!ObpLookupObjectName+0x56a
    ee13dc18 80571477 00000000 00000000 00000001 nt!ObOpenObjectByName+0xeb
    ee13dc94 80571546 0012f2a0 40100080 0012f240 nt!IopCreateFile+0x407
    ee13dcf0 8057167c 0012f2a0 40100080 0012f240 nt!IoCreateFile+0x8e
    ee13dd30 804df06b 0012f2a0 40100080 0012f240 nt!NtCreateFile+0x30
    ee13dd30 7c90eb94 0012f2a0 40100080 0012f240 nt!KiFastCallEntry+0xf8
    0012f298 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    naiavf5x+1e9e
    edb7ee9e ?? ???

    SYMBOL_STACK_INDEX: f

    SYMBOL_NAME: naiavf5x+1e9e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: naiavf5x

    IMAGE_NAME: naiavf5x.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

    FAILURE_BUCKET_ID: 0xA_naiavf5x+1e9e

    BUCKET_ID: 0xA_naiavf5x+1e9e

    Followup: MachineOwner
     
  2. 2007/11/13
    Arie

    Arie Administrator Administrator Staff

    Joined:
    2001/12/27
    Messages:
    15,174
    Likes Received:
    412
    Arie,
    #2

  3. to hide this advert.

  4. 2007/11/14
    nubyan

    nubyan Inactive Thread Starter

    Joined:
    2007/11/13
    Messages:
    2
    Likes Received:
    0
    Here it is. Hope it helps.:) Its from user.dmp

    Opened log file 'c:\debuglog.txt'

    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
    User Mini Dump File: Only registers, stack and portions of memory are available

    Comment: 'Dr. Watson generated MiniDump'
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    Debug session time: Wed Nov 14 08:34:04.000 2007 (GMT-8)
    System Uptime: not available
    Process Uptime: 0 days 0:34:00.000
    ...............................................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (6cc.a08): Access violation - code c0000005 (first/second chance not available)
    eax=00000000 ebx=000000cc ecx=0701d748 edx=00000008 esi=0701d748 edi=10432b80
    eip=300745bf esp=0012e540 ebp=0012e550 iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for NPSWF32.dll -
    NPSWF32+0x745bf:
    300745bf 8b7014 mov esi,dword ptr [eax+14h] ds:0023:00000014=????????
    0:000> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Exception Analysis *
    * *
    *******************************************************************************

    *** ERROR: Symbol file could not be found. Defaulted to export symbols for Opera.dll -
    *** WARNING: Unable to verify checksum for Opera.exe
    *** ERROR: Module load completed but symbols could not be loaded for Opera.exe
    *** WARNING: Unable to verify checksum for mclsp.dll
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for mclsp.dll -
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: kernel32!pNlsUserInfo ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: kernel32!pNlsUserInfo ***
    *** ***
    *************************************************************************

    FAULTING_IP:
    NPSWF32+745bf
    300745bf 8b7014 mov esi,dword ptr [eax+14h]

    EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
    .exr 0xffffffffffffffff
    ExceptionAddress: 300745bf (NPSWF32+0x000745bf)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000014
    Attempt to read from address 00000014

    DEFAULT_BUCKET_ID: APPLICATION_FAULT

    PROCESS_NAME: Opera.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

    READ_ADDRESS: 00000014

    BUGCHECK_STR: ACCESS_VIOLATION

    LAST_CONTROL_TRANSFER: from 3007824c to 300745bf

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    0012e550 3007824c 10432b80 00000000 00000001 NPSWF32+0x745bf
    0012e598 30078229 10432b80 07014fd4 07014fc0 NPSWF32+0x7824c
    0012e608 3005cea8 10a0c445 00000012 00000000 NPSWF32+0x78229
    0012e644 3005fcbd 10a050a0 109b0000 109b0000 NPSWF32+0x5cea8
    0012e9ac 30084771 00000001 0012ea34 0012ea10 NPSWF32+0x5fcbd
    0012e9bc 30010d23 10df79e0 00000000 00000002 NPSWF32+0x84771
    0012ea10 3008d29c 10aead98 10df79e6 139fdc86 NPSWF32+0x10d23
    0012eaa8 3005fd9a 10aead98 10a050a0 100cd545 NPSWF32+0x8d29c
    0012ee2c 30084771 00000001 109b0000 0012f14c NPSWF32+0x5fd9a
    0012ee3c 3005d636 10896240 1085fe50 140675c5 NPSWF32+0x84771
    0012f154 3000afb3 138c6026 00000058 00000058 NPSWF32+0x5d636
    0012f1b0 3008e757 1085fe50 00000000 0012f23c NPSWF32+0xafb3
    0012f1c0 30094a41 00000000 00020672 109b0000 NPSWF32+0x8e757
    0012f23c 300a6ac0 007157d0 00010768 109b0000 NPSWF32+0x94a41
    0012f33c 77d4e010 00020654 00000401 00000001 NPSWF32!NP_Shutdown+0x31b9
    0012f354 77d48bb1 77da0068 00000401 0012f3a0 user32!RealDefWindowProcA+0x47
    0012f3c0 77d48709 00010768 00000401 00000001 user32!_EndUserApiHook+0x11
    0012f3ec 77d487eb 300a6d97 00010768 00000401 user32!InternalCallWinProc+0x28
    0012f454 77d489a5 00000000 300a6d97 00010768 user32!UserCallWinProcCheckWow+0x150
    0012f4b4 77d489e8 00d73520 00000000 0012f4d4 user32!DispatchMessageWorker+0x306
    0012f4c4 67e4ed7b 00d73520 00973118 0012f4fc user32!DispatchMessageW+0xf
    0012f4d4 67ab7502 000000c9 00973118 00d73520 Opera_679c0000!AFileDialog::SubclassedDialogProc_MSWin+0x55a8
    0012f4fc 67ab69f0 000000c9 00973118 00d73520 Opera_679c0000+0xf7502
    0012f568 67ab760d 000000c9 00973118 00d73520 Opera_679c0000+0xf69f0
    0012f5a8 77d48709 000c0228 00000400 00000000 Opera_679c0000+0xf760d
    0012f5d4 77d487eb 67e61829 000c0228 00000400 user32!InternalCallWinProc+0x28
    0012f63c 77d489a5 00000000 67e61829 000c0228 user32!UserCallWinProcCheckWow+0x150
    0012f69c 77d489e8 0012f6c4 00000000 0012f6e0 user32!DispatchMessageWorker+0x306
    0012f6ac 67e618fb 0012f6c4 67f892a4 77d6f3c6 user32!DispatchMessageW+0xf
    0012f6e0 67e50382 00000000 00000000 0040306c Opera_679c0000!EnumWndProc+0xb879
    0012fc04 67e5143c 679c0000 00000000 00152311 Opera_679c0000!AFileDialog::SubclassedDialogProc_MSWin+0x6baf
    0012ff60 0040127b 00400000 00000000 00152311 Opera_679c0000!OpStart+0x1b
    0012ffc0 7c816d4f 00000000 00000000 7ffd6000 Opera+0x127b
    0012fff0 00000000 00416001 00000000 00000000 kernel32!BaseProcessStart+0x23


    STACK_COMMAND: ~0s; .ecxr ; kb

    FAULTING_THREAD: 00000a08

    FOLLOWUP_IP:
    NPSWF32+745bf
    300745bf 8b7014 mov esi,dword ptr [eax+14h]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: NPSWF32+745bf

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: NPSWF32

    IMAGE_NAME: NPSWF32.dll

    DEBUG_FLR_IMAGE_TIMESTAMP: 466db1d1

    BUCKET_ID: ACCESS_VIOLATION_NPSWF32+745bf

    FAILURE_BUCKET_ID: NPSWF32.dll!Unknown_c0000005_APPLICATION_FAULT

    Followup: MachineOwner
    ---------

    eax=00000000 ebx=000000cc ecx=0701d748 edx=00000008 esi=0701d748 edi=10432b80
    eip=300745bf esp=0012e540 ebp=0012e550 iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
    NPSWF32+0x745bf:
    300745bf 8b7014 mov esi,dword ptr [eax+14h] ds:0023:00000014=????????
    ChildEBP RetAddr Args to Child
    WARNING: Stack unwind information not available. Following frames may be wrong.
    0012e550 3007824c 10432b80 00000000 00000001 NPSWF32+0x745bf
    0012e598 30078229 10432b80 07014fd4 07014fc0 NPSWF32+0x7824c
    0012e608 3005cea8 10a0c445 00000012 00000000 NPSWF32+0x78229
    0012e644 3005fcbd 10a050a0 109b0000 109b0000 NPSWF32+0x5cea8
    0012e9ac 30084771 00000001 0012ea34 0012ea10 NPSWF32+0x5fcbd
    0012e9bc 30010d23 10df79e0 00000000 00000002 NPSWF32+0x84771
    0012ea10 3008d29c 10aead98 10df79e6 139fdc86 NPSWF32+0x10d23
    0012eaa8 3005fd9a 10aead98 10a050a0 100cd545 NPSWF32+0x8d29c
    0012ee2c 30084771 00000001 109b0000 0012f14c NPSWF32+0x5fd9a
    0012ee3c 3005d636 10896240 1085fe50 140675c5 NPSWF32+0x84771
    0012f154 3000afb3 138c6026 00000058 00000058 NPSWF32+0x5d636
    0012f1b0 3008e757 1085fe50 00000000 0012f23c NPSWF32+0xafb3
    0012f1c0 30094a41 00000000 00020672 109b0000 NPSWF32+0x8e757
    0012f23c 300a6ac0 007157d0 00010768 109b0000 NPSWF32+0x94a41
    0012f33c 77d4e010 00020654 00000401 00000001 NPSWF32!NP_Shutdown+0x31b9
    0012f354 77d48bb1 77da0068 00000401 0012f3a0 user32!RealDefWindowProcA+0x47 (FPO: [Non-Fpo])
    0012f3c0 77d48709 00010768 00000401 00000001 user32!_EndUserApiHook+0x11 (FPO: [Non-Fpo])
    0012f3ec 77d487eb 300a6d97 00010768 00000401 user32!InternalCallWinProc+0x28
    0012f454 77d489a5 00000000 300a6d97 00010768 user32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
    0012f4b4 77d489e8 00d73520 00000000 0012f4d4 user32!DispatchMessageWorker+0x306 (FPO: [Non-Fpo])
    start end module name
    00400000 00429000 Opera Opera.exe Mon Oct 15 03:12:20 2007 (47133D04)
    01960000 01979000 McVSSkt McVSSkt.Dll Mon Sep 26 18:12:51 2005 (43389C93)
    03790000 037b1000 mclsp mclsp.dll Wed Mar 01 08:34:01 2006 (4405CCF9)
    037c0000 038df000 sporder sporder.dll Fri Aug 02 00:00:31 1996 (3201A78F)
    039f0000 03a1d000 gdlsphlr gdlsphlr.dll Thu Mar 30 11:30:25 2006 (442C31D1)
    03a20000 03a37000 mcrtl32 mcrtl32.dll Wed Sep 28 14:04:45 2005 (433B056D)
    0ffd0000 0fff8000 rsaenh rsaenh.dll Tue Jul 06 19:17:12 2004 (40EB5D28)
    10000000 10026000 MSKOEPlg MSKOEPlg.dll Wed Aug 17 07:37:59 2005 (43034BC7)
    16080000 16099000 mdnsNSP mdnsNSP.dll Tue Feb 28 12:42:29 2006 (4404B5B5)
    30000000 302ca000 NPSWF32 NPSWF32.dll Mon Jun 11 13:34:25 2007 (466DB1D1)
    5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 00:56:43 2004 (411096BB)
    5b860000 5b8b4000 netapi32 netapi32.dll Wed Aug 04 00:56:28 2004 (411096AC)
    60300000 60307000 idle idle.dll Thu Aug 30 16:44:16 2007 (46D75650)
    662b0000 66308000 hnetcfg hnetcfg.dll Wed Aug 04 00:56:16 2004 (411096A0)
    679c0000 67ffc000 Opera_679c0000 Opera.dll Mon Oct 15 03:12:20 2007 (47133D04)
    71a50000 71a8f000 mswsock mswsock.dll Wed Aug 04 00:59:20 2004 (41109758)
    71a90000 71a98000 wshtcpip wshtcpip.dll Wed Aug 04 00:57:49 2004 (411096FD)
    71aa0000 71aa8000 ws2help ws2help.dll Wed Aug 04 00:57:39 2004 (411096F3)
    71ab0000 71ac7000 ws2_32 ws2_32.dll Wed Aug 04 00:57:38 2004 (411096F2)
    71ad0000 71ad9000 wsock32 wsock32.dll Wed Aug 04 00:57:51 2004 (411096FF)
    72d10000 72d18000 msacm32 msacm32.drv Fri Aug 17 22:33:30 2001 (3B7DFE2A)
    72d20000 72d29000 wdmaud wdmaud.drv Wed Aug 04 00:56:54 2004 (411096C6)
    74d90000 74dfb000 usp10 usp10.dll Wed Aug 04 00:56:42 2004 (411096BA)
    75cf0000 75d81000 mlang mlang.dll Wed Aug 04 00:56:29 2004 (411096AD)
    76380000 76385000 msimg32 msimg32.dll Wed Aug 04 00:58:31 2004 (41109727)
    76390000 763ad000 imm32 imm32.dll Wed Aug 04 00:56:30 2004 (411096AE)
    763b0000 763f9000 comdlg32 comdlg32.dll Wed Aug 04 00:56:32 2004 (411096B0)
    76600000 7661d000 cscdll cscdll.dll Wed Aug 04 00:56:07 2004 (41109697)
    767f0000 76817000 schannel schannel.dll Wed Aug 04 00:56:39 2004 (411096B7)
    769c0000 76a73000 userenv userenv.dll Wed Aug 04 00:56:41 2004 (411096B9)
    76b40000 76b6d000 winmm winmm.dll Wed Aug 04 00:57:10 2004 (411096D6)
    76c30000 76c5e000 wintrust wintrust.dll Wed Aug 04 00:56:41 2004 (411096B9)
    76c90000 76cb8000 imagehlp imagehlp.dll Wed Aug 04 00:56:25 2004 (411096A9)
    76d60000 76d79000 iphlpapi iphlpapi.dll Wed Aug 04 00:56:10 2004 (4110969A)
    76f20000 76f47000 dnsapi dnsapi.dll Wed Aug 04 00:56:45 2004 (411096BD)
    76f60000 76f8c000 wldap32 wldap32.dll Wed Aug 04 00:56:43 2004 (411096BB)
    76fb0000 76fb8000 winrnr winrnr.dll Wed Aug 04 00:56:35 2004 (411096B3)
    76fc0000 76fc6000 rasadhlp rasadhlp.dll Wed Aug 04 00:56:24 2004 (411096A8)
    76fd0000 7704f000 clbcatq clbcatq.dll Wed Aug 04 00:56:18 2004 (411096A2)
    77050000 77115000 comres comres.dll Wed Aug 04 00:56:36 2004 (411096B4)
    77120000 771ac000 oleaut32 oleaut32.dll Wed Aug 04 00:57:39 2004 (411096F3)
    771b0000 77256000 wininet wininet.dll Wed Aug 04 00:57:08 2004 (411096D4)
    773d0000 774d2000 comctl32 comctl32.dll Wed Aug 04 00:55:56 2004 (4110968C)
    774e0000 7761c000 ole32 ole32.dll Wed Aug 04 00:57:38 2004 (411096F2)
    77920000 77a13000 setupapi setupapi.dll Wed Aug 04 00:56:32 2004 (411096B0)
    77a20000 77a74000 cscui cscui.dll Wed Aug 04 00:56:08 2004 (41109698)
    77a80000 77b14000 crypt32 crypt32.dll Wed Aug 04 00:56:01 2004 (41109691)
    77b20000 77b32000 msasn1 msasn1.dll Wed Aug 04 00:57:23 2004 (411096E3)
    77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 00:56:36 2004 (411096B4)
    77bd0000 77bd7000 midimap midimap.dll Wed Aug 04 00:56:25 2004 (411096A9)
    77be0000 77bf5000 msacm32_77be0000 msacm32.dll Wed Aug 04 00:57:03 2004 (411096CF)
    77c00000 77c08000 version version.dll Wed Aug 04 00:56:39 2004 (411096B7)
    77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 00:59:14 2004 (41109752)
    77d40000 77dd0000 user32 user32.dll Wed Aug 04 00:56:40 2004 (411096B8)
    77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 00:56:23 2004 (411096A7)
    77e70000 77f01000 rpcrt4 rpcrt4.dll Wed Aug 04 00:56:30 2004 (411096AE)
    77f10000 77f56000 gdi32 gdi32.dll Wed Aug 04 00:56:07 2004 (41109697)
    77f60000 77fd6000 shlwapi shlwapi.dll Wed Aug 04 00:56:44 2004 (411096BC)
    77fe0000 77ff1000 secur32 secur32.dll Wed Aug 04 00:56:49 2004 (411096C1)
    7c340000 7c396000 msvcr71 msvcr71.dll Fri Feb 21 04:42:20 2003 (3E561EAC)
    7c800000 7c8f4000 kernel32 kernel32.dll Wed Aug 04 00:56:36 2004 (411096B4)
    7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 00:56:36 2004 (411096B4)
    7c9c0000 7d1d4000 shell32 shell32.dll Wed Aug 04 00:56:39 2004 (411096B7)
    Closing open log file c:\debuglog.txt
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.