I think I'm covered in the protection area, using Kaspersky Internet
and Anti virus security. Did multiple scan with many different
programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
Gerry said:What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Gerry said:What you have done with regard to spyware does not rule it out but makes
it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to run
Hijack This and submit a log to a specialist forum for analysis.
The details of ole32.dll seem to match the copy on my computer. What is
the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test by
removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
I think I'm covered in the protection area, using Kaspersky Internet
and Anti virus security. Did multiple scan with many different
programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
Gerry said:What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second chance
not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000297 ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.
Thanks.
Since I'm struggling with this problem for long time I did test the
memory and analyzed hijackthis file multiple times all look to be
fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
Gerry said:What you have done with regard to spyware does not rule it out but
makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to run
Hijack This and submit a log to a specialist forum for analysis.
The details of ole32.dll seem to match the copy on my computer. What
is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test by
removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
I think I'm covered in the protection area, using Kaspersky Internet
and Anti virus security. Did multiple scan with many different
programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second chance
not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.
Thanks.
Gerry said:Your version of ole32.dll is older than mine, which came with a security
update KB902400 and is dated 26 July 2005. You might check your Windows
Update and see if there is any reference in History to 902400 and
whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Since I'm struggling with this problem for long time I did test the
memory and analyzed hijackthis file multiple times all look to be
fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
Gerry said:What you have done with regard to spyware does not rule it out but
makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to run
Hijack This and submit a log to a specialist forum for analysis.
The details of ole32.dll seem to match the copy on my computer. What
is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test by
removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky Internet
and Anti virus security. Did multiple scan with many different
programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second chance
not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.
Thanks.
Gerry said:Your version of ole32.dll is older than mine, which came with a security
update KB902400 and is dated 26 July 2005. You might check your Windows
Update and see if there is any reference in History to 902400 and
whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Since I'm struggling with this problem for long time I did test the
memory and analyzed hijackthis file multiple times all look to be
fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
Gerry said:What you have done with regard to spyware does not rule it out but
makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to run
Hijack This and submit a log to a specialist forum for analysis.
The details of ole32.dll seem to match the copy on my computer. What
is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test by
removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky Internet
and Anti virus security. Did multiple scan with many different
programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4 (774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second chance
not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.
Thanks.
RGold said:Not sure why the date is different but the file version didn't change
after I re installed the update.
The ole32 version is 5.1.260.2726
Thanks.
Gerry said:Your version of ole32.dll is older than mine, which came with a
security update KB902400 and is dated 26 July 2005. You might check
your Windows Update and see if there is any reference in History to
902400 and whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Since I'm struggling with this problem for long time I did test the
memory and analyzed hijackthis file multiple times all look to be
fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
:
What you have done with regard to spyware does not rule it out but
makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to
run Hijack This and submit a log to a specialist forum for
analysis.
The details of ole32.dll seem to match the copy on my computer.
What is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test
by removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky
Internet and Anti virus security. Did multiple scan with many
different programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4
(774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second
chance not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180,
faulting module unknown, version 0.0.0.0, fault address
0x00000000.
Thanks.
Gerry said:Yes I noticed the file version was the same. Please let me know if it
stops the errors?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold said:Not sure why the date is different but the file version didn't change
after I re installed the update.
The ole32 version is 5.1.260.2726
Thanks.
Gerry said:Your version of ole32.dll is older than mine, which came with a
security update KB902400 and is dated 26 July 2005. You might check
your Windows Update and see if there is any reference in History to
902400 and whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Since I'm struggling with this problem for long time I did test the
memory and analyzed hijackthis file multiple times all look to be
fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
:
What you have done with regard to spyware does not rule it out but
makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to
run Hijack This and submit a log to a specialist forum for
analysis.
The details of ole32.dll seem to match the copy on my computer.
What is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test
by removing one stick at a time and run the machine with different
combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky
Internet and Anti virus security. Did multiple scan with many
different programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4
(774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second
chance not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6 esi=00001080
edi=00000000 eip=7c90eb94 esp=00a59f48 ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180,
faulting module unknown, version 0.0.0.0, fault address
0x00000000.
Thanks.
No change. Is uninstalling office is a good idea? it's big
"customer" of ole32.
Thanks.
Gerry said:Yes I noticed the file version was the same. Please let me know if it
stops the errors?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold said:Not sure why the date is different but the file version didn't
change after I re installed the update.
The ole32 version is 5.1.260.2726
Thanks.
:
Your version of ole32.dll is older than mine, which came with a
security update KB902400 and is dated 26 July 2005. You might check
your Windows Update and see if there is any reference in History to
902400 and whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Since I'm struggling with this problem for long time I did test
the memory and analyzed hijackthis file multiple times all look
to be fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
:
What you have done with regard to spyware does not rule it out
but makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to
run Hijack This and submit a log to a specialist forum for
analysis.
The details of ole32.dll seem to match the copy on my computer.
What is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test
by removing one stick at a time and run the machine with
different combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky
Internet and Anti virus security. Did multiple scan with many
different programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may
be wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4
(774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights
reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second
chance not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6
esi=00001080 edi=00000000 eip=7c90eb94 esp=00a59f48
ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180,
faulting module unknown, version 0.0.0.0, fault address
0x00000000.
Thanks.
Gerry said:Try registering the file.
http://consumer.installshield.com/kb.asp?id=Q108199
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
No change. Is uninstalling office is a good idea? it's big
"customer" of ole32.
Thanks.
Gerry said:Yes I noticed the file version was the same. Please let me know if it
stops the errors?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Not sure why the date is different but the file version didn't
change after I re installed the update.
The ole32 version is 5.1.260.2726
Thanks.
:
Your version of ole32.dll is older than mine, which came with a
security update KB902400 and is dated 26 July 2005. You might check
your Windows Update and see if there is any reference in History to
902400 and whether installation was successful or failed?
You can also check for a copy of the file in this folder:
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Since I'm struggling with this problem for long time I did test
the memory and analyzed hijackthis file multiple times all look
to be fine.
The error happen only when I'm surfing the Internet with either
FireFox and IE 6, 7. There are days that no error at all and there
are days that I get the error few times.
The Windows disk is pre SP2. But I have all the latest updates.
I ran the windows file check utility and it didn't fine any thing
wrong. The ole is:
Wednesday, August 04, 2004, 12:56:46 AM, Size 1.22 MB.
Appreciate your time on this.
:
What you have done with regard to spyware does not rule it out
but makes it less of a front runner.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
If you cannot find the cause of the problem you may be advised to
run Hijack This and submit a log to a specialist forum for
analysis.
The details of ole32.dll seem to match the copy on my computer.
What is the file date and size?
Does your Windows XP CD include or predate SP2?
Have you tested your memory?
http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot
If your RAM memory is made up of more than one stick you can test
by removing one stick at a time and run the machine with
different combinations.
Does the error manifest itself at start-up or later? Is there any
pattern regarding the timing of the error?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
I think I'm covered in the protection area, using Kaspersky
Internet and Anti virus security. Did multiple scan with many
different programs and all came clean.
I analyzed the dump file and looks like the issue is caused by
ole32.dll:
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: NULL_INSTRUCTION_PTR
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774fe3dc to 00000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may
be wrong. 00a5ff94 774fe3dc 00000000 00000000 02d9b088 0x0
00a5ffb4 7c80b683 02d9b088 00000000 00000000
ole32!StringFromGUID2+0x5da 00a5ffec 00000000 774fe429 02d9b088
00000000 kernel32!GetModuleFileNameA+0x1b4
FOLLOWUP_IP:
ole32!StringFromGUID2+5da
774fe3dc ff15e4124e77 call dword ptr [ole32+0x12e4
(774e12e4)]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ole32
IMAGE_NAME: ole32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42e5be93
FAULTING_THREAD: 000021ec
PRIMARY_PROBLEM_CLASS: NULL_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_NULL_INSTRUCTION_PTR
SYMBOL_NAME: ole32!StringFromGUID2+5da
STACK_COMMAND: ~74s; .ecxr ; kb
FAILURE_BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
BUCKET_ID:
APPLICATION_FAULT_NULL_INSTRUCTION_PTR_NULL_IP_ole32!StringFromGUID2+5da
Followup: MachineOwner
---------
0:074> lmvm ole32
start end module name
774e0000 7761d000 ole32 (export symbols) ole32.dll
Loaded symbol image file: ole32.dll
Mapped memory image file: D:\WINDOWS\system32\ole32.dll
Image path: D:\WINDOWS\system32\ole32.dll
Image name: ole32.dll
Timestamp: Mon Jul 25 21:39:47 2005 (42E5BE93)
CheckSum: 0013DC6B
ImageSize: 0013D000
File version: 5.1.2600.2726
Product version: 5.1.2600.2726
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.1.2600.2726
FileVersion: 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights
reserved.
:
What are your anti-spyware arrangements?
--
Hope this helps.
Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
RGold wrote:
Here is info from dump file:
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(44c.21ec): Access violation - code c0000005 (first/second
chance not available)
eax=0000003c ebx=80070000 ecx=69451b8c edx=69451bc6
esi=00001080 edi=00000000 eip=7c90eb94 esp=00a59f48
ebp=00a59fac iopl=0
nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023
fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret
:
I get it randomly...
How can this be fixed?
Faulting application svchost.exe, version 5.1.2600.2180,
faulting module unknown, version 0.0.0.0, fault address
0x00000000.
Thanks.
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.