MSN and Windows Messenger

Ole32.dll is causing an error in both programs.
In Windows Messenger, it won't even boot up without giving me the dreaded
error about ole32.dll
In MSN Messenger, it happens only when I try to use the audio setup wizard.
I have downgraded, and upgraded to see if it helps, but nothing does.
Please help me!
And if you feel like taking the time, email me directly at
steve757@comcast.net
Thanks!

I have verified that the ole32.dll is the correct version.
..
It's not the leaky file problem, as my dll is version 2600.2180 sp2.

Here's the full Dr Watson report.



Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.



Application exception occurred:
App: C:\Program Files\Messenger\msmsgs.exe (pid=3048)
When: 9/24/2004 @ 15:45:25.515
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: STEVE
User Name: Steven
Terminal Session Id: 0
Number of Processors: 1
Processor Type: x86 Family 15 Model 2 Stepping 7
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Uniprocessor Free
Registered Organization: Impulse Video
Registered Owner: Steven L Solomon

*----> Task List <----*
0 System Process
4 System
336 smss.exe
384 csrss.exe
408 winlogon.exe
452 services.exe
464 lsass.exe
636 svchost.exe
684 svchost.exe
720 svchost.exe
764 svchost.exe
812 svchost.exe
968 spoolsv.exe
1124 KodakCCS.exe
1144 mcvsrte.exe
1160 MSKSrvr.exe
1280 nvsvc32.exe
1544 mcshield.exe
1752 alg.exe
1660 Explorer.EXE
1416 winampa.exe
1476 MskAgent.exe
1456 McAgent.exe
1136 kxmixer.exe
1196 em_exec.exe
1212 mcvsshld.exe
932 RUNDLL32.EXE
1844 hpztsb07.exe
1972 mcvsescn.exe
1964 hpcmpmgr.exe
140 RoboTaskBarIcon.exe
596 EasyShare.exe
876 AdSub.exe
2136 mcvsftsn.exe
3368 svchost.exe
3168 wmiprvse.exe
3048 msmsgs.exe
3816 dwwin.exe
3856 drwtsn32.exe

*----> Module List <----*
(00000000003b0000 - 00000000003c7000:
C:\PROGRA~1\McAfee\SPAMKI~1\mskoeplg.dll
(0000000000400000 - 000000000056e000: C:\Program Files\Messenger\msmsgs.exe
(0000000000de0000 - 0000000000e10000: C:\PROGRA~1\MESSEN~1\msimmsgr.dll
(0000000000e30000 - 0000000000e6b000: C:\Program Files\Messenger\rtcimsp.dll
(0000000000f50000 - 0000000000f72000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
(0000000001430000 - 000000000146a000: C:\WINDOWS\system32\kswdmcap.ax
(0000000001580000 - 000000000159c000: c:\progra~1\mcafee.com\vso\McVSSkt.dll
(00000000015d0000 - 00000000015db000: C:\Program Files\Common
Files\Logitech\Scrolling\LgMsgHk.dll
(0000000001910000 - 0000000001941000: C:\WINDOWS\system32\ac3filter.cpl
(0000000001950000 - 0000000001a1b000: C:\WINDOWS\system32\vsfilter.dll
(0000000001c30000 - 0000000001c4c000: C:\WINDOWS\System32\matrix_mixer.ax
(0000000001c50000 - 0000000001cb0000: C:\WINDOWS\system32\vp6dec.ax
(0000000001cc0000 - 0000000001cff000: C:\WINDOWS\system32\CoreVorbis.ax
(0000000001d00000 - 0000000001d4a000: C:\WINDOWS\system32\3ivxDSDecoder.ax
(0000000001d50000 - 0000000001e73000: C:\WINDOWS\system32\3ivx.dll
(0000000001e90000 - 0000000001eda000:
C:\WINDOWS\system32\3ivxDSMediaSplitter.ax
(0000000001ee0000 - 0000000001f47000:
C:\WINDOWS\system32\OpenQuicktimeLib.dll
(0000000001f50000 - 0000000001f95000: C:\WINDOWS\system32\CoreAAC.ax
(0000000001fa0000 - 0000000001ffe000: C:\WINDOWS\System32\mp4sds32.ax
(0000000002820000 - 000000000286e000:
C:\WINDOWS\system32\RealMediaSplitter.ax
(0000000002880000 - 00000000028bf000: C:\WINDOWS\system32\oggds.dll
(00000000028c0000 - 00000000028cf000: C:\WINDOWS\system32\ogg.dll
(00000000028d0000 - 00000000028f7000: C:\WINDOWS\system32\vorbis.dll
(0000000002900000 - 00000000029e0000: C:\WINDOWS\system32\vorbisenc.dll
(0000000002a10000 - 0000000002b22000:
C:\audio\STEINB~1\MASTER~1\MEPHAS~1.DLL
(0000000002d30000 - 0000000002db0000: C:\Program Files\Common
Files\Ahead\DSFilter\NeAudio.ax
(0000000002db0000 - 0000000002e04000:
C:\WINDOWS\system32\MatroskaSplitter.ax
(0000000002e20000 - 0000000002e6f000: C:\WINDOWS\system32\DRMClien.DLL
(0000000002eb0000 - 0000000002ec0000: C:\Program Files\Common
Files\Ahead\DSFilter\NeQTADec.ax
(0000000002ec0000 - 0000000002ed4000: C:\WINDOWS\system32\aac_parser.ax
(0000000002ef0000 - 0000000002f03000: C:\Program Files\Common
Files\Ahead\DSFilter\NeQTVDec.ax
(0000000002f30000 - 0000000003057000: C:\Program Files\Common
Files\Ahead\DSFilter\NeVideo.ax
(0000000003060000 - 000000000314a000: C:\Program Files\Common
Files\Ahead\Lib\AdvrCntr.dll
(0000000003150000 - 00000000031d4000: C:\WINDOWS\system32\CLVSD.ax
(00000000035e0000 - 0000000003609000: C:\Program Files\DirectShow .SHN
FIlter\SHNTrans.ax
(0000000003710000 - 0000000003724000: C:\Program
Files\mpegable\DS\dsamrauddec.ax
(0000000003730000 - 00000000037c0000: C:\Program
Files\mpegable\DS\AudioCodec.dll
(00000000037c0000 - 000000000381e000: C:\Program
Files\mpegable\DS\dllzAAC.dll
(0000000003820000 - 000000000382f000: C:\Program
Files\mpegable\DS\StreamIO.dll
(0000000003870000 - 0000000003883000: C:\Program
Files\mpegable\DS\dsmpeg4viddec.ax
(0000000003890000 - 00000000038d6000: C:\Program
Files\mpegable\DS\VideoCodecDecoder.dll
(0000000003a00000 - 0000000003a14000: C:\Program
Files\mpegable\DS\dsmpeg4auddec.ax
(0000000007dc0000 - 0000000007e4a000: C:\WINDOWS\system32\wmspdmod.dll
(0000000008120000 - 0000000008180000: C:\WINDOWS\system32\wmadmod.dll
(00000000085e0000 - 00000000086a7000: C:\WINDOWS\system32\wmsdmod.dll
(0000000008900000 - 00000000089d6000: C:\WINDOWS\system32\wmvdmod.dll
(0000000008c00000 - 0000000008c22000: C:\WINDOWS\system32\wmpasf.dll
(0000000008c40000 - 0000000008d72000: C:\WINDOWS\System32\wmvadvd.dll
(0000000009200000 - 0000000009237000: C:\WINDOWS\system32\qasf.dll
(000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
(0000000010000000 - 0000000010007000: C:\Program
Files\Logitech\MouseWare\System\LgWndHk.dll
(000000001c400000 - 000000001c46f000: C:\WINDOWS\System32\WMAVDS32.ax
(000000001d140000 - 000000001d151000: C:\WINDOWS\system32\voxmsdec.ax
(000000001d1c0000 - 000000001d1d3000: C:\WINDOWS\System32\mmswitch.ax
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
(0000000022000000 - 000000002210a000:
C:\audio\STEINB~1\MASTER~1\MESPEC~1.DLL
(0000000037000000 - 00000000372a1000:
C:\audio\STEINB~1\MASTER~1\MECOMP~1.DLL
(0000000038000000 - 00000000380dd000:
C:\audio\STEINB~1\MASTER~1\MESPEC~2.DLL
(000000004d110000 - 000000004d20a000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
(000000004d550000 - 000000004d638000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.DxmRtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
(000000004e960000 - 000000004e9c9000: C:\WINDOWS\system32\mp4sdmod.dll
(000000004fa50000 - 000000004fac0000: C:\WINDOWS\system32\mp43dmod.dll
(0000000057dc0000 - 0000000057e23000: C:\WINDOWS\System32\wmvds32.ax
(0000000057e30000 - 0000000057e97000: C:\WINDOWS\System32\wmv8ds32.ax
(0000000057eb0000 - 0000000057ebb000: C:\WINDOWS\System32\vbisurf.ax
(0000000057ef0000 - 0000000057f01000: C:\WINDOWS\System32\msscds32.ax
(0000000057f20000 - 0000000057f5a000: C:\WINDOWS\System32\msadds32.ax
(0000000057f60000 - 0000000057fc4000: C:\WINDOWS\System32\mpg4ds32.ax
(0000000057fd0000 - 0000000057ff7000: C:\WINDOWS\System32\mpg2splt.ax
(00000000580b0000 - 0000000058188000: C:\WINDOWS\System32\ir41_32.ax
(00000000581a0000 - 00000000581d9000: C:\WINDOWS\System32\iac25_32.ax
(00000000582b0000 - 00000000582c2000: C:\WINDOWS\System32\acelpdec.ax
(0000000058d10000 - 0000000058d1f000: C:\WINDOWS\System32\wstdecod.dll
(000000005b6f0000 - 000000005b74a000: C:\WINDOWS\System32\termmgr.dll
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI32.dll
(000000005df80000 - 000000005dfe0000: C:\WINDOWS\System32\qdvd.dll
(000000005dfe0000 - 000000005e028000: C:\WINDOWS\System32\qdv.dll
(000000005e030000 - 000000005e053000: C:\WINDOWS\system32\ksproxy.ax
(000000005edd0000 - 000000005ede7000: C:\WINDOWS\system32\OLEPRO32.DLL
(0000000061570000 - 00000000615d0000: C:\WINDOWS\system32\mpg4dmod.dll
(0000000065380000 - 00000000653c8000: C:\WINDOWS\system32\kstvtune.ax
(0000000065400000 - 000000006540c000: C:\WINDOWS\system32\ksxbar.ax
(00000000662b0000 - 0000000066308000: C:\WINDOWS\system32\hnetcfg.dll
(00000000666f0000 - 00000000666fb000: C:\WINDOWS\system32\inetmib1.dll
(0000000069200000 - 0000000069235000: C:\Program
Files\Messenger\MSGSLANG.DLL
(000000006bf50000 - 000000006bfcd000: C:\WINDOWS\system32\dxmasf.dll
(0000000071a50000 - 0000000071a8f000: C:\WINDOWS\system32\mswsock.dll
(0000000071a90000 - 0000000071a98000: C:\WINDOWS\System32\wshtcpip.dll
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\System32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\System32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK32.dll
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dll
(0000000071f60000 - 0000000071f68000: C:\WINDOWS\system32\snmpapi.dll
(0000000072cd0000 - 0000000072ce8000: C:\WINDOWS\System32\l3codecx.ax
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm32.drv
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud.drv
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPOOL.DRV
(00000000736b0000 - 00000000736b7000: C:\WINDOWS\system32\msdmo.dll
(0000000073760000 - 00000000737a9000: C:\WINDOWS\system32\DDRAW.dll
(0000000073870000 - 0000000073934000: C:\WINDOWS\System32\ir50_32.dll
(0000000073bc0000 - 0000000073bc6000: C:\WINDOWS\system32\DCIMAN32.dll
(0000000073dd0000 - 0000000073ece000: C:\WINDOWS\system32\MFC42.DLL
(0000000073ee0000 - 0000000073ee4000: C:\WINDOWS\system32\ksuser.dll
(0000000073f10000 - 0000000073f6c000: C:\WINDOWS\system32\DSOUND.dll
(0000000074810000 - 000000007497d000: C:\WINDOWS\System32\quartz.dll
(00000000757f0000 - 0000000075822000: C:\WINDOWS\System32\qcap.dll
(0000000075a70000 - 0000000075a91000: C:\WINDOWS\system32\MSVFW32.dll
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
(0000000075f40000 - 0000000075f51000: C:\WINDOWS\System32\devenum.dll
(0000000076080000 - 00000000760e5000: C:\WINDOWS\system32\MSVCP60.dll
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA.dll
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg32.dll
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DLL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.dll
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRUST.dll
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpapi.dll
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutils.dll
(0000000076e90000 - 0000000076ea2000: C:\WINDOWS\system32\rasman.dll
(0000000076eb0000 - 0000000076edf000: C:\WINDOWS\system32\TAPI32.dll
(0000000076ee0000 - 0000000076f1c000: C:\WINDOWS\system32\RASAPI32.dll
(0000000076f20000 - 0000000076f47000: C:\WINDOWS\system32\DNSAPI.dll
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\wtsapi32.dll
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININET.dll
(0000000077260000 - 00000000772fc000: C:\WINDOWS\system32\urlmon.dll
(00000000773d0000 - 00000000774d2000:
C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll
(00000000774e0000 - 000000007761c000: C:\WINDOWS\system32\ole32.dll
(0000000077710000 - 0000000077751000: C:\WINDOWS\System32\es.dll
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\setupapi.dll
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midimap.dll
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM32.dll
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur32.dll
(000000007c000000 - 000000007c054000: C:\WINDOWS\system32\MSVCR70.dll
(000000007c340000 - 000000007c396000: C:\WINDOWS\system32\MSVCR71.dll
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL32.dll

*----> State Dump for Thread Id 0xbec <----*

eax=00000001 ebx=0013dd50 ecx=0013de7c edx=7c90eb94 esi=00000000
edi=7ffde000
eip=7c90eb94 esp=0013dd28 ebp=0013ddc4 iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00200246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll - function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\USER32.dll -
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\System32\quartz.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\System32\qcap.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.DxmRtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
-
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
-
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Messenger\rtcimsp.dll -
ChildEBP RetAddr Args to Child
0013ddc4 77d4bbfe 00000002 0013ddec 00000000 ntdll!KiFastSystemCallRet
0013de20 77d4bcad 00000001 0013de80 0000000a USER32!SetWindowTextW+0x120
0013de3c 748322e8 00000001 0013de80 00000000
USER32!MsgWaitForMultipleObjects+0x1f
0013de90 7486c4de 000003e4 ffffffff 00000000 quartz+0x222e8
0013deb0 74856139 0013ded4 0013e188 0013e188 quartz+0x5c4de
0013dee0 7483e192 02ba93a0 0013e188 0036e4f8 quartz!DllCanUnloadNow+0xcfe5
0013df00 74871ea0 02ba93a0 0013e188 74812274 quartz!DllGetClassObject+0xb297
0013e138 748720af 015e5afc 015e7184 00000000 quartz+0x61ea0
0013e1c8 748721a3 015e5afc 015e7184 00000000 quartz+0x620af
0013e1f0 7487226e 015e5afc 80040207 00000000 quartz+0x621a3
0013e218 7487249a 015e5afc 0036e594 00000000 quartz+0x6226e
0013e230 75809070 0036e4f8 015e5afc 015e7184 quartz+0x6249a
0013e280 75808eda 015e7184 00000001 00000000 qcap+0x19070
0013e2f8 758090e8 0036dfa4 015e0354 00000000 qcap+0x18eda
0013e340 75808eda 015e0354 00000001 00000000 qcap+0x190e8
0013e3b8 758090e8 0036ee34 0036bf1c 00000000 qcap+0x18eda
0013e400 75808eda 0036bf1c 00000001 4d554c98 qcap+0x190e8
0013e478 75809e0b 0036ad2c 00000004 77526009 qcap+0x18eda
0013e5bc 4d5b0436 0036c9b4 4d5519f8 00000000 qcap+0x19e0b
0013e77c 4d5b0a16 0036aeb8 00000000 0013e7f4
dxmrtp!AudioGetRenderDeviceInfo+0x120a3
0013e938 4d5b0da4 0013e974 00000001 0013ed10
dxmrtp!AudioGetRenderDeviceInfo+0x12683
0013e948 4d152bcf 0013e974 00000000 00e83b58 dxmrtp+0x60da4
0013ed10 4d1552b9 0013ed48 0013ed44 00e834e8 rtcdll+0x42bcf
0013eda4 4d1534a7 00e834f0 00000000 00e8217c rtcdll+0x452b9
0013ef68 4d12c247 00e834e8 00060298 00000465 rtcdll+0x434a7
0013efc4 4d132c1c 00e71efc 00000000 00e71ef8 rtcdll+0x1c247
0013f024 4d134c59 00000000 00e71ec0 00e3df69 rtcdll+0x22c1c
0013f030 00e3df69 00e820dc 00000000 7c910331 rtcdll+0x24c59
00e71ec0 00e31980 00e31954 00e3193c 00e31918 rtcimsp+0xdf69
00e319ac 00e374f2 00e37f2a 00e37111 00e38d50 rtcimsp+0x1980
00e37f54 0c2474ff e31ba868 2474ff00 0003e810 rtcimsp!DllCanUnloadNow+0x69
0c2474ff 00000000 00000000 00000000 00000000 0xc2474ff

*----> Raw Stack Dump <----*
000000000013dd28 ab e9 90 7c f2 94 80 7c - 02 00 00 00 50 dd 13 00
....|...|....P...
000000000013dd38 01 00 00 00 00 00 00 00 - 84 dd 13 00 00 00 00 00
.................
000000000013dd48 02 00 00 00 00 00 00 00 - e4 03 00 00 24 00 00 00
.............$...
000000000013dd58 00 00 00 00 d2 ec d4 77 - 00 00 00 00 64 de 13 00
........w....d...
000000000013dd68 02 01 00 00 60 dd 13 00 - 14 00 00 00 01 00 00 00
.....`...........
000000000013dd78 00 00 00 00 00 00 00 00 - 10 00 00 00 60 79 fe ff
.............`y..
000000000013dd88 ff ff ff ff f2 94 80 7c - 00 e0 fd 7f 00 d0 fd 7f
........|........
000000000013dd98 ab 95 80 7c 84 dd 13 00 - 50 dd 13 00 02 01 00 00
....|....P.......
000000000013dda8 02 00 00 00 44 dd 13 00 - e4 03 00 00 5c ef 13 00
.....D.......\...
000000000013ddb8 f3 99 83 7c 90 95 80 7c - 00 00 00 00 20 de 13 00
....|...|.... ...
000000000013ddc8 fe bb d4 77 02 00 00 00 - ec dd 13 00 00 00 00 00
....w............
000000000013ddd8 0a 00 00 00 00 00 00 00 - 02 01 00 00 01 00 00 00
.................
000000000013dde8 0a 00 00 00 e4 03 00 00 - 24 00 00 00 00 d0 fd 7f
.........$.......
000000000013ddf8 00 00 00 00 e4 dd 13 00 - b0 dd 13 00 02 01 00 00
.................
000000000013de08 01 00 00 00 a4 dd 13 00 - 00 00 00 00 00 00 00 00
.................
000000000013de18 00 d0 fd 7f 24 00 00 00 - 3c de 13 00 ad bc d4 77
.....$...<......w
000000000013de28 01 00 00 00 80 de 13 00 - 0a 00 00 00 40 00 00 00
.............@...
000000000013de38 ec dd 13 00 90 de 13 00 - e8 22 83 74 01 00 00 00
..........".t....
000000000013de48 80 de 13 00 00 00 00 00 - 0a 00 00 00 40 00 00 00
.............@...
000000000013de58 f8 e4 36 00 f8 e4 36 00 - f8 e4 36 00 98 02 06 00
...6...6...6.....

*----> State Dump for Thread Id 0xbf8 <----*

eax=77e76bf0 ebx=00000000 ecx=00000009 edx=7c910732 esi=00163090
edi=00163134
eip=7c90eb94 esp=00b5fe1c ebp=00b5ff80 iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\RPCRT4.dll -
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
ChildEBP RetAddr Args to Child
00b5ff80 77e76c22 00b5ffa8 77e76a3b 00163090 ntdll!KiFastSystemCallRet
00b5ff88 77e76a3b 00163090 00000000 0013f838 RPCRT4!I_RpcBCacheFree+0x5ea
00b5ffa8 77e76c0a 001660f8 00b5ffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
00b5ffb4 7c80b50b 0016e648 00000000 0013f838 RPCRT4!I_RpcBCacheFree+0x5d2
00b5ffec 00000000 77e76bf0 0016e648 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000b5fe1c 99 e3 90 7c 03 67 e7 77 - fc 00 00 00 70 ff b5 00
....|.g.w....p...
0000000000b5fe2c 00 00 00 00 60 41 19 00 - 54 ff b5 00 b0 cc 57 80
.....`A..T.....W.
0000000000b5fe3c cb cc 57 80 64 4d b5 f8 - 78 f4 13 00 27 cc 57 80
...W.dM..x...'.W.
0000000000b5fe4c 37 47 56 80 48 8a f3 82 - 58 4b fa 82 80 39 7c 83
7GV.H...XK...9|.
0000000000b5fe5c 94 fa 13 00 48 4d b5 f8 - 30 93 58 80 00 c6 56 80
.....HM..0.X...V.
0000000000b5fe6c 64 4d b5 f8 de 04 00 00 - 05 00 00 00 00 00 00 00
dM..............
0000000000b5fe7c 00 00 00 00 58 4b fa 82 - 88 4b b5 f8 25 44 56 80
.....XK...K..%DV.
0000000000b5fe8c 05 00 00 00 05 00 00 00 - 60 5e 56 e2 60 5b 03 e1
.........`^V.`[..
0000000000b5fe9c 02 00 00 00 fe ff f8 00 - 30 07 08 e1 60 5e 56 e2
.........0...`^V.
0000000000b5feac b0 35 56 00 00 00 00 00 - 00 00 00 00 5c 00 52 00
..5V.........\.R.
0000000000b5febc ff ff ff ff 28 4c b5 f8 - 6c 38 56 80 61 06 00 00
.....(L..l8V.a...
0000000000b5fecc 34 00 00 c0 48 8a f3 82 - 78 04 01 e1 50 89 e9 82
4...H...x...P...
0000000000b5fedc ec 4b b5 f8 c1 4f 50 80 - fc 4b b5 f8 04 00 00 00
..K...OP..K......
0000000000b5feec 00 00 00 00 50 89 e9 82 - 30 0d 72 83 07 00 00 00
.....P...0.r.....
0000000000b5fefc 84 8a e9 82 2a 00 00 00 - ff 00 00 00 00 00 00 00
.....*...........
0000000000b5ff0c 20 4c b5 f8 19 4f 50 80 - 44 bf fc 82 24 4c b5 f8
L...OP.D...$L..
0000000000b5ff1c 62 c8 4d 80 6a c8 4d 80 - 14 bf fc 82 a8 bd fc 82
b.M.j.M.........
0000000000b5ff2c dc bd fc 82 80 ff b5 00 - 99 66 e7 77 4c ff b5 00
..........f.wL...
0000000000b5ff3c a9 66 e7 77 ed 10 90 7c - f8 e3 16 00 48 e6 16 00
..f.w...|....H...
0000000000b5ff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff
.../M.....]......

*----> State Dump for Thread Id 0xbb0 <----*

eax=774f319a ebx=00007530 ecx=7ffde000 edx=00000000 esi=00000000
edi=00c6ff50
eip=7c90eb94 esp=00c6ff20 ebp=00c6ff78 iopl=0 nv up ei pl nz na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ole32.dll -
ChildEBP RetAddr Args to Child
00c6ff78 7c802451 0000ea60 00000000 00c6ffb4 ntdll!KiFastSystemCallRet
00c6ff88 774f2fcb 0000ea60 00171608 774f314d kernel32!Sleep+0xf
00c6ffb4 7c80b50b 00171608 7c910945 7c91094e ole32!StringFromGUID2+0x2d1
00c6ffec 00000000 774f319a 00171608 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000c6ff20 5c d8 90 7c ed 23 80 7c - 00 00 00 00 50 ff c6 00
\..|.#.|....P...
0000000000c6ff30 50 25 80 7c f0 56 60 77 - 30 75 00 00 14 00 00 00
P%.|.V`w0u......
0000000000c6ff40 01 00 00 00 00 00 00 00 - 00 00 00 00 10 00 00 00
.................
0000000000c6ff50 00 ba 3c dc ff ff ff ff - 08 4f 4e 77 50 ff c6 00
...<......ONwP...
0000000000c6ff60 30 ff c6 00 58 50 16 00 - dc ff c6 00 f3 99 83 7c
0...XP.........|
0000000000c6ff70 58 24 80 7c 00 00 00 00 - 88 ff c6 00 51 24 80 7c
X$.|........Q$.|
0000000000c6ff80 60 ea 00 00 00 00 00 00 - b4 ff c6 00 cb 2f 4f 77
`............/Ow
0000000000c6ff90 60 ea 00 00 08 16 17 00 - 4d 31 4f 77 00 00 00 00
`.......M1Ow....
0000000000c6ffa0 45 09 91 7c 08 16 17 00 - 00 00 4e 77 b5 31 4f 77
E..|......Nw.1Ow
0000000000c6ffb0 4e 09 91 7c ec ff c6 00 - 0b b5 80 7c 08 16 17 00
N..|.......|....
0000000000c6ffc0 45 09 91 7c 4e 09 91 7c - 08 16 17 00 00 b0 fd 7f
E..|N..|........
0000000000c6ffd0 00 46 7c 83 c0 ff c6 00 - f0 31 e2 82 ff ff ff ff
..F|......1......
0000000000c6ffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00
....|...|........
0000000000c6fff0 00 00 00 00 9a 31 4f 77 - 08 16 17 00 00 00 00 00
......1Ow........
0000000000c70000 c8 00 00 00 2e 01 00 00 - ff ee ff ee 02 10 00 00
.................
0000000000c70010 00 00 00 00 00 fe 00 00 - 00 00 10 00 00 20 00 00
.............. ..
0000000000c70020 00 02 00 00 00 20 00 00 - 80 01 00 00 ff ef fd 7f .....
...........
0000000000c70030 07 00 08 06 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
0000000000c70040 00 00 00 00 98 05 c7 00 - 0f 00 00 00 f8 ff ff ff
.................
0000000000c70050 50 00 c7 00 50 00 c7 00 - 40 06 c7 00 00 00 00 00
P...P...@.......

*----> State Dump for Thread Id 0xbc0 <----*

eax=77e76bf0 ebx=00000000 ecx=00000008 edx=00000000 esi=00163090
edi=00163134
eip=7c90eb94 esp=00ddfe1c ebp=00ddff80 iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
ChildEBP RetAddr Args to Child
00ddff80 77e76c22 00ddffa8 77e76a3b 00163090 ntdll!KiFastSystemCallRet
00ddff88 77e76a3b 00163090 00000040 00000000 RPCRT4!I_RpcBCacheFree+0x5ea
00ddffa8 77e76c0a 001660f8 00ddffec 7c80b50b RPCRT4!I_RpcBCacheFree+0x403
00ddffb4 7c80b50b 0018f498 00000040 00000000 RPCRT4!I_RpcBCacheFree+0x5d2
00ddffec 00000000 77e76bf0 0018f498 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
0000000000ddfe1c 99 e3 90 7c 03 67 e7 77 - fc 00 00 00 70 ff dd 00
....|.g.w....p...
0000000000ddfe2c 00 00 00 00 50 40 19 00 - 54 ff dd 00 57 b9 01 00
.....P@..T...W...
0000000000ddfe3c 28 70 5a 82 00 00 00 00 - 9c 36 50 c0 c0 44 e9 82
(pZ......6P..D..
0000000000ddfe4c 30 06 00 00 64 8b 99 f5 - 3d be 4e 80 30 06 00 00
0...d...=.N.0...
0000000000ddfe5c c0 44 e9 82 00 50 fd 7f - fc 07 30 c0 54 ff 1f c0
..D...P....0.T...
0000000000ddfe6c 30 06 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
0...............
0000000000ddfe7c 00 00 00 00 2f 06 00 00 - 28 8c 99 f5 0e c1 4e 80
...../...(.....N.
0000000000ddfe8c fc 07 30 c0 28 8c 99 f5 - 86 bf 4e 80 00 50 fd 7f
...0.(.....N..P..
0000000000ddfe9c 00 00 00 00 00 00 00 00 - a0 f4 e7 82 c8 42 e9 82
..............B..
0000000000ddfeac 01 43 e9 82 00 00 00 00 - 54 ff 1f c0 00 00 00 00
..C......T.......
0000000000ddfebc 80 0c 56 80 ff ff ba 00 - 00 00 04 00 af 0b 00 00
...V.............
0000000000ddfecc 94 43 e9 82 c8 42 e9 82 - c8 42 e9 82 00 00 00 00
..C...B...B......
0000000000ddfedc 00 00 bb 00 3c 8b 99 f5 - d8 94 e7 82 ff ff ff ff
.....<...........
0000000000ddfeec f1 2a 4e 80 00 50 fd 7f - ff ff ff ff 1f 92 56 80
..*N..P........V.
0000000000ddfefc 6b f0 4d 80 ff ff ff ff - b8 8c 99 f5 bc 8c 99 f5
k.M.............
0000000000ddff0c 00 80 00 00 14 8d 99 f5 - 44 1f e5 82 24 8c 99 f5
.........D...$...
0000000000ddff1c 62 c8 4d 80 6a c8 4d 80 - 14 1f e5 82 a8 1d e5 82
b.M.j.M.........
0000000000ddff2c dc 1d e5 82 80 ff dd 00 - 99 66 e7 77 4c ff dd 00
..........f.wL...
0000000000ddff3c a9 66 e7 77 ed 10 90 7c - f0 f0 18 00 98 f4 18 00
..f.w...|........
0000000000ddff4c 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff
.../M.....]......

*----> State Dump for Thread Id 0xbf4 <----*

eax=00369340 ebx=0108fe1c ecx=00369528 edx=00000000 esi=00000000
edi=7ffde000
eip=7c90eb94 esp=0108fdf4 ebp=0108fe90 iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\System32\termmgr.dll -
ChildEBP RetAddr Args to Child
0108fe90 77d4bbfe 00000002 0108feb8 00000000 ntdll!KiFastSystemCallRet
0108feec 5b714937 00000001 5b73f1d4 ffffffff USER32!SetWindowTextW+0x120
0108ffac 5b715063 0108ffec 7c80b50b 5b73f198 termmgr+0x24937
0108ffb4 7c80b50b 5b73f198 00000000 00000000 termmgr+0x25063
0108ffec 00000000 5b715056 5b73f198 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000108fdf4 ab e9 90 7c f2 94 80 7c - 02 00 00 00 1c fe 08 01
....|...|........
000000000108fe04 01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000108fe14 02 00 00 00 02 00 00 00 - 68 02 00 00 74 02 00 00
.........h...t...
000000000108fe24 8c fe 08 01 eb 87 d4 77 - 00 90 fd 7f 8c fe 08 01
........w........
000000000108fe34 32 88 d4 77 4c fe 08 01 - 14 00 00 00 01 00 00 00
2..wL...........
000000000108fe44 00 00 00 00 00 00 00 00 - 10 00 00 00 01 00 00 00
.................
000000000108fe54 00 00 00 00 00 00 00 00 - 00 e0 fd 7f 00 90 fd 7f
.................
000000000108fe64 30 00 00 00 00 00 00 00 - 1c fe 08 01 00 00 00 00
0...............
000000000108fe74 02 00 00 00 10 fe 08 01 - dc fe 08 01 dc ff 08 01
.................
000000000108fe84 f3 99 83 7c 90 95 80 7c - 00 00 00 00 ec fe 08 01
....|...|........
000000000108fe94 fe bb d4 77 02 00 00 00 - b8 fe 08 01 00 00 00 00
....w............
000000000108fea4 ff ff ff ff 01 00 00 00 - 78 92 d4 77 00 00 00 00
.........x..w....
000000000108feb4 98 f1 73 5b 68 02 00 00 - 74 02 00 00 ec fe 08 01
...s[h...t.......
000000000108fec4 df 93 d4 77 3c ff 08 01 - 07 00 00 00 00 00 00 00
....w<...........
000000000108fed4 b4 fe 08 01 01 00 00 00 - 00 00 00 00 01 00 00 00
.................
000000000108fee4 00 90 fd 7f 74 02 00 00 - ac ff 08 01 37 49 71 5b
.....t.......7Iq[
000000000108fef4 01 00 00 00 d4 f1 73 5b - ff ff ff ff ff 04 00 00
.......s[........
000000000108ff04 b8 fe 08 01 00 00 00 00 - 00 00 00 00 98 f1 73 5b
...............s[
000000000108ff14 00 00 00 00 7f 45 71 5b - 00 00 00 00 00 00 00 00
......Eq[........
000000000108ff24 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................

*----> State Dump for Thread Id 0xbf0 <----*

eax=72d230e8 ebx=0142fef8 ecx=00000098 edx=001a5c98 esi=00000000
edi=7ffde000
eip=7c90eb94 esp=0142fed0 ebp=0142ff6c iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\wdmaud.drv -
ChildEBP RetAddr Args to Child
0142ff6c 7c809c86 00000002 0142ffa4 00000000 ntdll!KiFastSystemCallRet
0142ff88 72d2312a 00000002 0142ffa4 00000000
kernel32!WaitForMultipleObjects+0x18
0142ffb4 7c80b50b 00000000 00000000 00160000 wdmaud!midMessage+0x348
0142ffec 00000000 72d230e8 00000000 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000142fed0 ab e9 90 7c f2 94 80 7c - 02 00 00 00 f8 fe 42 01
....|...|......B.
000000000142fee0 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000142fef0 00 00 00 00 00 00 00 00 - 3c 03 00 00 38 03 00 00
.........<...8...
000000000142ff00 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000142ff10 00 00 00 00 bc b1 e2 82 - 14 00 00 00 01 00 00 00
.................
000000000142ff20 00 00 00 00 00 00 00 00 - 10 00 00 00 54 b0 e2 82
.............T...
000000000142ff30 62 c8 4d 80 87 f6 57 80 - 00 e0 fd 7f 00 80 fd 7f
b.M...W.........
000000000142ff40 00 80 fd 7f 00 00 00 00 - f8 fe 42 01 00 00 00 00
...........B.....
000000000142ff50 02 00 00 00 ec fe 42 01 - 00 00 00 00 dc ff 42 01
.......B.......B.
000000000142ff60 f3 99 83 7c 90 95 80 7c - 00 00 00 00 88 ff 42 01
....|...|......B.
000000000142ff70 86 9c 80 7c 02 00 00 00 - a4 ff 42 01 00 00 00 00
....|......B.....
000000000142ff80 ff ff ff ff 00 00 00 00 - b4 ff 42 01 2a 31 d2 72
...........B.*1.r
000000000142ff90 02 00 00 00 a4 ff 42 01 - 00 00 00 00 ff ff ff ff
.......B.........
000000000142ffa0 00 00 16 00 3c 03 00 00 - 38 03 00 00 00 00 00 00
.....<...8.......
000000000142ffb0 dc e2 90 7c ec ff 42 01 - 0b b5 80 7c 00 00 00 00
....|..B....|....
000000000142ffc0 00 00 00 00 00 00 16 00 - 00 00 00 00 00 80 fd 7f
.................
000000000142ffd0 00 46 7c 83 c0 ff 42 01 - f8 de 71 83 ff ff ff ff
..F|...B...q.....
000000000142ffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00
....|...|........
000000000142fff0 00 00 00 00 e8 30 d2 72 - 00 00 00 00 00 00 00 00
......0.r........
0000000001430000 4d 5a 90 00 03 00 00 00 - 04 00 00 00 ff ff 00 00
MZ..............

*----> State Dump for Thread Id 0xd14 <----*

eax=02ee1fb0 ebx=00000000 ecx=00000001 edx=00000000 esi=00000000
edi=00000000
eip=775260d0 esp=0157fbd8 ebp=0157fbe0 iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00200246

function: ole32!CoCreateInstance
775260ba 52 push edx
775260bb ff36 push dword ptr [esi]
775260bd ff7510 push dword ptr [ebp+0x10]
775260c0 50 push eax
775260c1 ff510c call dword ptr [ecx+0xc]
775260c4 8bd8 mov ebx,eax
775260c6 85db test ebx,ebx
775260c8 7c16 jl ole32!CoCreateInstance+0xd7
(775260e0)
775260ca 8b4d14 mov ecx,[ebp+0x14]
775260cd 8b4508 mov eax,[ebp+0x8]
FAULT ->775260d0 83660800 and dword ptr [esi+0x8],0x0
ds:0023:00000008=????????
775260d4 83f901 cmp ecx,0x1
775260d7 894604 mov [esi+0x4],eax
775260da 0f877b0b0400 jnbe ole32!CLSIDFromString+0x123b7
(77566c5b)
775260e0 5e pop esi
775260e1 8bc3 mov eax,ebx
775260e3 5b pop ebx
775260e4 5d pop ebp
775260e5 c21400 ret 0x14
775260e8 90 nop
775260e9 90 nop

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\System32\devenum.dll -
ChildEBP RetAddr Args to Child
0157fbe0 77525f66 02ee1fb0 00000000 00000000 ole32!CoCreateInstance+0xc7
0157fcd0 77526000 02ba93c0 00000000 00000401 ole32!CLIPFORMAT_UserFree+0x634
0157fcf8 77525fcf 02ba93c0 00000000 00000401 ole32!CoCreateInstanceEx+0x4f
0157fd1c 7752603d 02ba93c0 00000000 00000401 ole32!CoCreateInstanceEx+0x1e
0157fd4c 75f45c70 02ba93c0 00000000 00000401 ole32!CoCreateInstance+0x34
0157fe00 7486c45d 02ba93a0 001b2ac0 00000000 devenum+0x5c70
0157fe20 7482a713 0013ded4 0013e188 77d4887e quartz+0x5c45d
0157fe58 74829108 00080290 0000040a 0013ded4 quartz+0x1a713
0157fe7c 77d48709 00080290 0000040a 0013ded4 quartz+0x19108
0157fea8 77d487eb 748290ca 00080290 0000040a USER32!GetDC+0x72
0157ff10 77d489a5 00000000 748290ca 00080290 USER32!GetDC+0x154
0157ff70 77d489e8 0157ff98 00000000 0157ffb4 USER32!GetWindowLongW+0x127
0157ff80 7486f047 0157ff98 7c913288 00000000 USER32!DispatchMessageW+0xf
0157ffb4 7c80b50b 00000000 7c913288 00000000 quartz+0x5f047
0157ffec 00000000 7486efb2 000003bc 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000157fbd8 60 1a 4e 77 00 00 00 00 - d0 fc 57 01 66 5f 52 77
`.Nw......W.f_Rw
000000000157fbe8 b0 1f ee 02 00 00 00 00 - 00 00 00 00 01 00 00 00
.................
000000000157fbf8 40 fd 57 01 8c 26 f4 75 - 84 fd 57 01 a0 93 ba 02
@.W..&.u..W.....
000000000157fc08 00 00 00 00 c0 93 ba 02 - 50 39 e8 02 bc 27 f5 02
.........P9...'..
000000000157fc18 5c 39 e8 02 8e e6 f4 02 - 00 00 00 00 88 e1 13 00
\9..............
000000000157fc28 b4 24 fc 02 05 40 00 80 - 00 00 00 00 00 00 00 00
..$...@..........
000000000157fc38 40 fd 57 01 d0 2f ee 02 - 00 00 00 00 bc fc 57 01
@.W../........W.
000000000157fc48 3e 0f e9 41 c1 56 33 46 - 81 c3 6e 8b ac 8b dd 70
>..A.V3F..n....p
000000000157fc58 60 1a 4e 77 08 00 00 00 - 00 00 00 00 01 04 00 00
`.Nw............
000000000157fc68 00 00 00 00 00 00 00 00 - 3c fc 57 01 00 00 00 00
.........<.W.....
000000000157fc78 78 02 19 00 e8 15 63 00 - 14 00 00 00 01 00 00 00
x.....c.........
000000000157fc88 00 00 00 00 00 00 00 00 - 10 00 00 00 00 00 00 00
.................
000000000157fc98 10 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000157fca8 74 fc 57 01 00 00 00 00 - 04 fd 57 01 94 04 d7 77
t.W.......W....w
000000000157fcb8 08 88 d4 77 e2 b8 78 3c - 4d 6c d1 11 ae e2 00 00
....w..x<Ml......
000000000157fcc8 f7 75 4b 98 74 d0 00 00 - f8 fc 57 01 00 60 52 77
..uK.t.....W..`Rw
000000000157fcd8 c0 93 ba 02 00 00 00 00 - 01 04 00 00 00 00 00 00
.................
000000000157fce8 01 00 00 00 00 00 00 00 - 40 fd 57 01 00 00 00 00
.........@.W.....
000000000157fcf8 1c fd 57 01 cf 5f 52 77 - c0 93 ba 02 00 00 00 00
...W.._Rw........
000000000157fd08 01 04 00 00 00 00 00 00 - 01 00 00 00 40 fd 57 01
.............@.W.

*----> State Dump for Thread Id 0xb88 <----*

eax=5e04c17f ebx=017ffe68 ecx=ffffffff edx=7c910570 esi=00000000
edi=7ffde000
eip=7c90eb94 esp=017ffe40 ebp=017ffedc iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ksproxy.ax -
ChildEBP RetAddr Args to Child
017ffedc 7c809c86 00000004 017fff54 00000000 ntdll!KiFastSystemCallRet
017ffef8 5e04c336 00000004 017fff54 00000000
kernel32!WaitForMultipleObjects+0x18
017fffb4 7c80b50b 800703e5 001b6f98 0013d4b8 ksproxy+0x1c336
017fffec 00000000 5e04c17f 0036d158 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
00000000017ffe40 ab e9 90 7c f2 94 80 7c - 04 00 00 00 68 fe 7f 01
....|...|....h...
00000000017ffe50 01 00 00 00 00 00 00 00 - 00 00 00 00 58 d1 36 00
.............X.6.
00000000017ffe60 ff ff 00 00 00 00 07 80 - 04 04 00 00 0c 04 00 00
.................
00000000017ffe70 f8 03 00 00 00 04 00 00 - 58 d1 36 00 64 ff 7f 01
.........X.6.d...
00000000017ffe80 00 00 00 00 78 fe 7f 01 - 14 00 00 00 01 00 00 00
.....x...........
00000000017ffe90 00 00 00 00 00 00 00 00 - 10 00 00 00 ac fe 7f 01
.................
00000000017ffea0 92 93 80 7c e5 03 00 00 - 00 e0 fd 7f 00 60 fd 7f
....|.........`..
00000000017ffeb0 f5 16 80 7c 00 00 00 00 - 68 fe 7f 01 ff ff 00 00
....|....h.......
00000000017ffec0 04 00 00 00 5c fe 7f 01 - 00 00 00 00 dc ff 7f 01
.....\...........
00000000017ffed0 f3 99 83 7c 90 95 80 7c - 00 00 00 00 f8 fe 7f 01
....|...|........
00000000017ffee0 86 9c 80 7c 04 00 00 00 - 54 ff 7f 01 00 00 00 00
....|....T.......
00000000017ffef0 ff ff ff ff 00 00 00 00 - b4 ff 7f 01 36 c3 04 5e
.............6..^
00000000017fff00 04 00 00 00 54 ff 7f 01 - 00 00 00 00 ff ff ff ff
.....T...........
00000000017fff10 98 6f 1b 00 b8 d4 13 00 - 58 d1 36 00 80 d3 6a d1
..o......X.6...j.
00000000017fff20 1a ac cf 11 a5 d6 28 db - 04 c1 00 00 01 00 00 00
.......(.........
00000000017fff30 01 00 00 00 80 d3 6a d1 - 1a ac cf 11 a5 d6 28 db
.......j.......(.
00000000017fff40 04 c1 00 00 00 00 00 00 - 01 00 00 00 00 00 00 00
.................
00000000017fff50 05 00 00 00 04 04 00 00 - 0c 04 00 00 f8 03 00 00
.................
00000000017fff60 00 04 00 00 03 01 00 00 - 00 00 00 00 00 00 00 00
.................
00000000017fff70 00 00 00 00 0c 04 00 00 - 50 5d 24 f5 33 00 73 00
.........P]$.3.s.

*----> State Dump for Thread Id 0xaf4 <----*

eax=5e0344fe ebx=0190ff18 ecx=00000000 edx=00000000 esi=00000000
edi=7ffde000
eip=7c90eb94 esp=0190fef0 ebp=0190ff8c iopl=0 nv up ei pl zr na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000246

function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
ChildEBP RetAddr Args to Child
0190ff8c 5e034521 00000001 0036b978 00000000 ntdll!KiFastSystemCallRet
0190ffb4 7c80b50b 0036ad20 00000000 00000000
ksproxy!DllUnregisterServer+0x1152
0190ffec 00000000 5e0344fe 0036ad20 00000000
kernel32!GetModuleFileNameA+0x1b4

*----> Raw Stack Dump <----*
000000000190fef0 ab e9 90 7c f2 94 80 7c - 01 00 00 00 18 ff 90 01
....|...|........
000000000190ff00 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000190ff10 20 ad 36 00 20 ad 36 00 - 90 03 00 00 62 c8 4d 80 .6.
..6.....b.M.
000000000190ff20 6a c8 4d 80 5c f9 e9 82 - f0 f7 e9 82 24 f8 e9 82
j.M.\.......$...
000000000190ff30 30 00 0a 00 87 f6 57 80 - 14 00 00 00 01 00 00 00
0.....W.........
000000000190ff40 00 00 00 00 00 00 00 00 - 10 00 00 00 00 00 00 00
.................
000000000190ff50 05 00 00 00 00 00 00 00 - 00 e0 fd 7f 00 50 fd 7f
..............P..
000000000190ff60 d8 1d 4f 80 00 00 00 00 - 18 ff 90 01 e8 58 4e 80
...O..........XN.
000000000190ff70 01 00 00 00 0c ff 90 01 - 50 1d 25 f5 dc ff 90 01
.........P.%.....
000000000190ff80 f3 99 83 7c 90 95 80 7c - 00 00 00 00 b4 ff 90 01
....|...|........
000000000190ff90 21 45 03 5e 01 00 00 00 - 78 b9 36 00 00 00 00 00
!E.^....x.6.....
000000000190ffa0 ff ff ff ff 00 00 00 00 - 00 00 00 00 00 00 00 00
.................
000000000190ffb0 20 ad 36 00 ec ff 90 01 - 0b b5 80 7c 20 ad 36 00
..6........| .6.
000000000190ffc0 00 00 00 00 00 00 00 00 - 20 ad 36 00 00 50 fd 7f
......... .6..P..
000000000190ffd0 00 46 7c 83 c0 ff 90 01 - 50 15 e4 82 ff ff ff ff
..F|.....P.......
000000000190ffe0 f3 99 83 7c 18 b5 80 7c - 00 00 00 00 00 00 00 00
....|...|........
000000000190fff0 00 00 00 00 fe 44 03 5e - 20 ad 36 00 00 00 00 00
......D.^ .6.....
0000000001910000 4d 5a 90 00 03 00 00 00 - 04 00 00 00 ff ff 00 00
MZ..............
0000000001910010 b8 00 00 00 00 00 00 00 - 40 00 00 00 00 00 00 00
.........@.......
0000000001910020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.................


If you are still reading, then you are interested in helping me and I thank
you!