Dr Watson (drwtsn.exe) keeps crashing my computer

G

Guest

Hello to all.
First let me just say that I am not very computer literate when it comes to
checking coding and event logs etc so I apologise in advance if I don't get
your suggestions right the first time.

OK here it is, as easily explained as I can make it: recently when having
Internet Explorer open in the background, clicking on the desktop forces my
cursor to change to that horrible hour glass for about 20-30 seconds, then I
get an error message saying "DrWatson postmortem debugger has encountered a
problem and must close". I then proceed to click send error report. It sends
then my computer freezes up and thats that. I have to manually restart it.
This has only happened recently and is becoming quite tedious. And also it
does the same thing if I click dont send...
I know that DrWatson has something to do with saving files or recording the
script errors before the computer crashes (i think :s ) but thats where it
gets too complicated for me.
It crashed on me only a few hours ago and I was vigalent enough to get as
much information as I can, here it is, hope it helps...

OK first things first...
As soon as that error report popped up I had a look and copied down the
information(if it'll help)

Error Signature
EventType:BEX P1:drwtsn32.exe P2:5.1.2600.0 P3:3b7d84a2
P4:dbghelp.dll P5:5.1.2600.2180 P6:4110969a P7:0001295d
p8:c0000409 P9:00000000

I also had a look in the event viewer and found the entry to do with this
latest crash:

Discription of fault
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d

This is the bit at the bottom in bytes...

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d

....and words...

0000: 6c707041 74616369 206e6f69 6c696146
0010: 20657275 77726420 336e7374 78652e32
0020: 2e352065 36322e31 302e3030 206e6920
0030: 68676264 2e706c65 206c6c64 2e312e35
0040: 30303632 3831322e 74612030 66666f20
0050: 20746573 31303030 6435393


The following information is from the DrWatson log file...

Application exception occurred:
App: C:\WINDOWS\Explorer.EXE (pid=1572)
When: 7/18/2005 @ 20:03:03.890
Exception number: 80000007
()

*----> System Information <----*
Computer Name: SN032162420571
User Name: Anthony Cook
Terminal Session Id: 0
Number of Processors: 1
Processor Type: x86 Family 15 Model 2 Stepping 9
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Anthony Cook

*----> Task List <----*
0 System Process
4 System
480 smss.exe
552 csrss.exe
576 winlogon.exe
624 services.exe
636 lsass.exe
780 svchost.exe
828 svchost.exe
868 svchost.exe
944 svchost.exe
1108 spoolsv.exe
1180 isafe.exe
1212 MPFSERVICE.exe
1248 svchost.exe
1264 wdfmgr.exe
1572 Explorer.EXE
1632 ABoard.exe
1644 hpztsb08.exe
1652 MpfTray.exe
1660 Dragdiag.exe
1676 VetTray.exe
1692 sistray.EXE
1732 jusched.exe
1752 realsched.exe
1760 ybrwicon.exe
1776 BTHelpNotifier.exe
1796 AOSD.exe
1820 MpfAgent.exe
1912 ycommon.exe
384 LVComS.exe
1016 iexplore.exe
812 msnmsgr.exe
1416 VetMsg.exe
540 LimeWire.exe
3952 drwtsn32.exe

*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\Explorer.EXE
(00000000016a0000 - 00000000016b2000: C:\WINDOWS\system32\browselc.dll
(00000000016c0000 - 00000000016cc000: C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll
(0000000001d90000 - 0000000001e18000: C:\WINDOWS\system32\shdoclc.dll
(0000000002330000 - 0000000002452000: C:\PROGRA~1\quickbar\quickbar.dll
(0000000002560000 - 0000000002635000: C:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
(00000000034f0000 - 000000000365d000: C:\WINDOWS\System32\quartz.dll
(000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
(0000000010000000 - 0000000010020000: C:\PROGRA~1\BTYAHO~1\SMARTB~1\SBHook.dll
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
(000000004ec50000 - 000000004edf3000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxTheme.dll
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI32.dll
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\System32\themeui.dll
(000000005cad0000 - 000000005caf7000: C:\WINDOWS\System32\shmedia.dll
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEng.dll
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl32.dll
(000000005edd0000 - 000000005ede7000: C:\WINDOWS\system32\olepro32.dll
(0000000060ca0000 - 0000000060d2c000: C:\WINDOWS\System32\qedit.dll
(00000000629c0000 - 00000000629c9000: C:\WINDOWS\system32\LPK.DLL
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.dll
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenral.DLL
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\System32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\System32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\System32\WSOCK32.dll
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dll
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\System32\SAMLIB.dll
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanman.dll
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP.dll
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1.dll
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0.dll
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\System32\actxprxy.dll
(0000000072410000 - 000000007242a000: C:\WINDOWS\System32\mydocs.dll
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm32.drv
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud.drv
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPOOL.DRV
(00000000736b0000 - 00000000736b7000: C:\WINDOWS\system32\msdmo.dll
(0000000073b30000 - 0000000073b45000: C:\WINDOWS\system32\mscms.dll
(0000000073b50000 - 0000000073b67000: C:\WINDOWS\System32\AVIFIL32.dll
(0000000073ba0000 - 0000000073bb3000: C:\WINDOWS\System32\sti.dll
(0000000073bc0000 - 0000000073bc6000: C:\WINDOWS\system32\DCIMAN32.DLL
(00000000745e0000 - 00000000748a6000: C:\WINDOWS\system32\msi.dll
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\System32\POWRPROF.dll
(0000000074ae0000 - 0000000074ae7000: C:\WINDOWS\System32\CFGMGR32.dll
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\System32\BatMeter.dll
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\System32\webcheck.dll
(0000000074d90000 - 0000000074dfb000: C:\WINDOWS\system32\USP10.dll
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTUI.dll
(0000000075a70000 - 0000000075a91000: C:\WINDOWS\System32\MSVFW32.dll
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
(0000000075f40000 - 0000000075f51000: C:\WINDOWS\System32\devenum.dll
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov.dll
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davclnt.dll
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSEUI.dll
(0000000076280000 - 00000000762a1000: C:\WINDOWS\System32\stobject.dll
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA.dll
(0000000076380000 - 0000000076385000: C:\WINDOWS\System32\MSIMG32.dll
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg32.dll
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHELL.dll
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL.dll
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKINFO.dll
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshrui.dll
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USERENV.dll
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DLL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.dll
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui.dll
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRUST.dll
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpapi.dll
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutils.dll
(0000000076e90000 - 0000000076ea2000: C:\WINDOWS\system32\rasman.dll
(0000000076eb0000 - 0000000076edf000: C:\WINDOWS\system32\TAPI32.dll
(0000000076ee0000 - 0000000076f1c000: C:\WINDOWS\system32\RASAPI32.DLL
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\System32\WTSAPI32.dll
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININET.dll
(0000000077260000 - 00000000772fe000: C:\WINDOWS\system32\urlmon.dll
(00000000773d0000 - 00000000774d2000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMARTA.DLL
(0000000077760000 - 00000000778cc000: C:\WINDOWS\system32\SHDOCVW.dll
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.dll
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHelp.dll
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midimap.dll
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM32.dll
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
(0000000077c70000 - 0000000077c93000: C:\WINDOWS\system32\msv1_0.dll
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\System32\Secur32.dll
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL32.dll

*----> State Dump for Thread Id 0x628 <----*

eax=0007f1a0 ebx=00000000 ecx=7c810198 edx=02205868 esi=7c97c0d8 edi=00000000
eip=7c90eb94 esp=0007ed10 ebp=0007ed98 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
FAULT ->ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\SHLWAPI.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\SHDOCVW.dll -


I hope you can understand all this because its jibberish to me :)
Thanks for your patience with me...
Anthony
 
G

Gunilla

Hi Anthony.

I am not an expert but see that you have some files on your PC that can be
questioned whether they are legal or not. One for certain is
"C:\PROGRA~1\quickbar\quickbar.dll" and, from what I know, belongs to
NewDotNet as you can see here
http://castlecops.com/tk1706-quickbar_dll.html

Another one which seems to be suspicious is LimeWire.exe. It belongs to a
Lime Wire, a P2P program, but can also be a Worm as you can see here
http://www.bleepingcomputer.com/startups/LimeWire.exe-10914.html

And also "sistray.exe" is another suspicious file. Take a look here
http://startup.iamnotageek.com/srch-sistray.exe.html But all depends, of
course, on if you have sis-based-vga-chipset.

To get some insight you should really download Hijack This from here
http://www.spywareinfo.com/~merijn/downloads.html and read the instructions
here http://tomcoyote.com/hjt/ where at the same place you also can post
it but you have to register your self first.

Good luck!

Gunilla.
 
R

Rock

anthony_cook said:
Hello to all.
First let me just say that I am not very computer literate when it comes to
checking coding and event logs etc so I apologise in advance if I don't get
your suggestions right the first time.

OK here it is, as easily explained as I can make it: recently when having
Internet Explorer open in the background, clicking on the desktop forces my
cursor to change to that horrible hour glass for about 20-30 seconds, then I
get an error message saying "DrWatson postmortem debugger has encountered a
problem and must close". I then proceed to click send error report. It sends
then my computer freezes up and thats that. I have to manually restart it.
This has only happened recently and is becoming quite tedious. And also it
does the same thing if I click dont send...
I know that DrWatson has something to do with saving files or recording the
script errors before the computer crashes (i think :s ) but thats where it
gets too complicated for me.
It crashed on me only a few hours ago and I was vigalent enough to get as
much information as I can, here it is, hope it helps...
Click to expand...

<snip>

Start with a thorough check for malware:

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm
 
G

Guest

Wow! i did not know this piece of junk (i.e. my computer) was that badly
infected with stuff. I thought I had enough anti-virus software and a pretty
good firewall not to worry about stuff like that! if I follow these
instructions would I be able to remove these nasty piece's of work?
Thanks again for helping me out
Anthony
 
G

Guest

Thanks again...
I shall follow your instructions to the letter and will let you know how I
get on.
Anthony
 
R

Rock

anthony_cook said:
Wow! i did not know this piece of junk (i.e. my computer) was that badly
infected with stuff. I thought I had enough anti-virus software and a pretty
good firewall not to worry about stuff like that! if I follow these
instructions would I be able to remove these nasty piece's of work?
Thanks again for helping me out
Anthony
Click to expand...

Please quote at least a portion of the post you're replying to so we
know to whom and about what you are responding.

It takes more than just an AV program and a firewall. There are many
nasties out there that AV programs don't see - many of which are
installed by you the user.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Dr. Watson crash on RUNDLL32.EXE, Control Panel icon, other apps too 2
Explorer exception 2
Internet Explorer 8 Error Messages and Dump File 16
Error: Symbol file could not be found 5
SP2 crashes explorer.exe and iexplorer.exe 2
Svchost.exe Errors 9
Windows reboots very often... 1
explorer.exe crash on search 1

Top