Erreur affichage fenetre Panneau de configuration
Le
PHILIPPE
Je ne peux afficher le panneau de config, un message
d'erreur m'indique que explorer.exe a généré des erreurs
et sera fermer par windows.
Un journal des erreurs est créé.
Si quelqu'un connait ce problème, merci de m'informer
comment le résoudre.
Pour vous aider peut être voici la copie du journal des
erreurs généré après ce défaut :
Microsoft (R) Windows 2000 (TM) Version 5.00 DrWtsn32
Copyright (C) 1985-1999 Microsoft Corp. Tous droits
réservés.
Une exception d'application s'est produite :
App : explorer.exe (pid=1044)
Lorsque : 06/01/2004 @ 00:39:10.218
Numéro d'exception : c0000005 (violation d'accès)
*-> Informations système <-*
Nom ordinateur : INTEL-P-4-2-8
Nom utilisateur : Administrateur
Nombre de processeurs : 2
Type de processeur : x86 Family 15 Model 2
Stepping 9
Version Windows 2000 : 5.0
Numéro actuel :
Service Pack : 4
Type actuel : Multiprocessor Free
Organisation enregistrée :
Propriétaire enregistré :
*-> Liste des tâches <-*
0 Idle.exe
8 System.exe
152 SMSS.exe
176 CSRSS.exe
196 WINLOGON.exe
224 SERVICES.exe
236 LSASS.exe
412 svchost.exe
440 spoolsv.exe
472 svchost.exe
504 nvsvc32.exe
532 regsvc.exe
568 mstask.exe
604 SMAgent.exe
632 WinMgmt.exe
660 svchost.exe
932 SMax4PNP.exe
940 SMax4.exe
900 internat.exe
960 rundll32.exe
1044 explorer.exe
280 DRWTSN32.exe
0 _Total.exe
(00400000 - 0043E000)
(78460000 - 784E1000)
(78ED0000 - 78F32000)
(77E70000 - 77F34000)
(770C0000 - 77131000)
(77F40000 - 77F7C000)
(77E00000 - 77E65000)
(77C60000 - 77CAA000)
(77B40000 - 77BC9000)
(77880000 - 778A5000)
(23000000 - 23056000)
(77580000 - 777CF000)
(6E350000 - 6E356000)
(75E00000 - 75E1A000)
(77A40000 - 77B37000)
(72C60000 - 72CE6000)
(779A0000 - 77A3B000)
(78000000 - 78045000)
(77840000 - 77880000)
(77090000 - 770B3000)
(78DB0000 - 78EC2000)
(76DE0000 - 76EA7000)
(793C0000 - 793D1000)
(78D20000 - 78D83000)
(76DC0000 - 76DD2000)
(76F70000 - 76F7F000)
(773B0000 - 773C5000)
(750F0000 - 7513F000)
(78FB0000 - 78FBF000)
(75140000 - 75146000)
(750D0000 - 750DF000)
(74FB0000 - 74FC4000)
(74FA0000 - 74FA8000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FD0000 - 74FD9000)
(750E0000 - 750EC000)
(75190000 - 751A5000)
(75150000 - 75188000)
(76EF0000 - 76F69000)
(76620000 - 76663000)
(76670000 - 76688000)
(766E0000 - 766E8000)
(783C0000 - 78451000)
(76690000 - 76697000)
(77540000 - 77571000)
(77530000 - 77538000)
(773D0000 - 773D8000)
(773E0000 - 773F3000)
(766B0000 - 766B9000)
(76230000 - 7626E000)
(74100000 - 74164000)
(76EB0000 - 76EBC000)
(76BD0000 - 76C45000)
(77F80000 - 77FF3000)
(77810000 - 77817000)
(75950000 - 75956000)
(75CF0000 - 75D72000)
(75A90000 - 75CD2000)
(76D60000 - 76DB7000)
(75A60000 - 75A88000)
(656A0000 - 657B5000)
(6E3C0000 - 6E3CA000)
(6B200000 - 6B23C000)
(75CE0000 - 75CE6000)
(71E40000 - 71E8D000)
(6A6F0000 - 6A710000)
(747F0000 - 74806000)
(6FF60000 - 6FF65000)
(66410000 - 66464000)
(77080000 - 77087000)
(66AF0000 - 66B21000)
(038B0000 - 03AB4000)
(768E0000 - 7690B000)
(77410000 - 77489000)
(77400000 - 77410000)
(77910000 - 77933000)
(75D80000 - 75DF7000)
(64DD0000 - 64DEC000)
(10000000 - 10013000)
(03E40000 - 03E7D000)
État de vidage Thread Id 0x3e4
eax=03b00004 ebx=00000001 ecx=03b00004 edx=00000000
esi=0008c9c8 edi=00000000
eip=77e03569 esp=0006ff00 ebp=0006ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:00af9de7=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FF1C 775AADBB 00000000 004084C4 0008C9C8 00000000
user32!WaitMessage
0006FF60 00408201 00000058 00000000 000205BE 00000005
shell32!Ordinal201
0006FFC0 77E787F5 00000000 00000000 7FFDF000 00000000
explorer!<nosymbols>
0006FFF0 00000000 00408188 00000000 000000C8 00000100
kernel32!DosDateTimeToFileTime
*-> Vidage brut de la pile <-*
0006ff00 41 ae 5a 77 94 55 e8 77 - c8 c9 08 00 01 00 00
00 A.Zw.U.w..
0006ff10 c8 c9 08 00 c8 c9 08 00 - 60 ff 06 00 60 ff 06
00 ..``
0006ff20 bb ad 5a 77 00 00 00 00 - c4 84 40 00 c8 c9 08
00 ..Zw@..
0006ff30 00 00 00 00 be 05 02 00 - 00 f0 fd 7f 00 e0 fd
7f .
0006ff40 92 ab e8 77 00 00 00 00 - 0c 00 00 00 be 05 02
00 w
0006ff50 68 60 07 00 02 00 00 00 - 94 a2 01 00 e0 ff 06
00 h`..
0006ff60 c0 ff 06 00 01 82 40 00 - 58 00 00 00 00 00 00
00 @.X.
0006ff70 be 05 02 00 05 00 00 00 - 00 00 00 00 44 00 00
00 D
0006ff80 18 29 07 00 e0 42 07 00 - 68 60 07 00 00 00 00
00 .)B..h`
0006ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 2a 00 00
00 *
0006ffa0 00 00 00 00 ea f1 06 00 - 01 00 00 00 05 00 00
00 .
0006ffb0 00 00 00 00 ff ff ff ff - ff ff ff ff ff ff ff
ff .
0006ffc0 f0 ff 06 00 f5 87 e7 77 - 00 00 00 00 00 00 00
00 .w..
0006ffd0 00 f0 fd 7f 00 00 00 00 - c8 ff 06 00 00 00 00
00 .
0006ffe0 ff ff ff ff b4 f0 e8 77 - c8 8e e7 77 00 00 00
00 .ww.
0006fff0 00 00 00 00 00 00 00 00 - 88 81 40 00 00 00 00
00 .@..
00070000 c8 00 00 00 00 01 00 00 - ff ee ff ee 02 00 00
00 .
00070010 00 00 00 00 00 fe 00 00 - 00 00 10 00 00 20 00
00 . ..
00070020 00 02 00 00 00 20 00 00 - 8e 32 00 00 ff ef fd
7f .. 2
00070030 01 00 08 06 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x2ec
eax=770cdcf3 ebx=00000000 ecx=00000001 edx=00000000
esi=00080e10 edi=00000100
eip=784639c7 esp=00d5fe28 ebp=00d5ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:017e9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:77b57bd9=458d77b4
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:77b57bd9=b4
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:017e9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:77b57bda=8d77
784639e2 668945e0 mov
[ebp+0xe0],ax ss:017e9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:017e9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D5FF74 770CD9DB 770CDDED 00080E10 40080904 00000070
ntdll!NtReplyWaitReceivePortEx
00D5FFA8 770CDD0B 0007DAC8 00D5FFEC 77E7987C 00080D58
rpcrt4!RpcBindingSetOption
00D5FFB4 77E7987C 00080D58 40080904 00000070 00080D58
rpcrt4!RpcBindingSetOption
00D5FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x39c
eax=00000190 ebx=00000102 ecx=77a4ff04 edx=00000000
esi=78469153 edi=00d9ff74
eip=7846915e esp=00d9ff60 ebp=00d9ff7c iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01829e47=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D9FF7C 77E8AC79 0000EA60 00000000 77A50216 0000EA60
ntdll!ZwDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000
kernel32!Sleep
État de vidage Thread Id 0x388
eax=0000001d ebx=0006fee8 ecx=00ddff3c edx=00000000
esi=0006ff04 edi=00000000
eip=77e03569 esp=00ddff60 ebp=00ddff80 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01869e47=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00DDFF80 0040A389 77C7CEA0 00400000 00076088 00076094
user32!WaitMessage
00DDFFB4 77E7987C 0006FEE8 00076088 00076094 0006FEE8
explorer!<nosymbols>
00DDFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x394
eax=00000394 ebx=00000000 ecx=7ffda000 edx=00000000
esi=776a02b8 edi=00000000
eip=78474091 esp=00e2fdf4 ebp=00e2fe64 iopl=0 nv
up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000216
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:018b9cdb=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:00a8a27a=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:80a63ee6=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E2FE64 784722F8 776A0200 775A92F4 776A02B8 00060066
ntdll!ZwWaitForSingleObject
776A02B8 00000001 00000001 00000324 00000220 00000000
ntdll!RtlImageDirectoryEntryToData
*-> Vidage brut de la pile <-*
00e2fdf4 87 23 47 78 20 02 00 00 - 00 00 00 00 00 00 00
00 .#Gx ..
00e2fe04 00 00 00 00 06 00 00 00 - 07 00 00 00 e8 01 00
00 .
00e2fe14 ec 01 00 00 f8 01 00 00 - c0 01 00 00 4c 02 00
00 L
00e2fe24 8c 05 00 00 e4 01 00 00 - 07 00 00 00 00 00 00
00 .
00e2fe34 cc a6 fd 7f 00 00 00 00 - e4 01 00 00 5c fe e2
00 \
00e2fe44 5c 3a e0 77 0c fe e2 00 - b8 fe e2 00 ff ff ff
ff \:.w
00e2fe54 ff 00 00 00 00 00 00 00 - b8 02 6a 77 00 00 00
00 .jw.
00e2fe64 b8 02 6a 77 f8 22 47 78 - 00 02 6a 77 f4 92 5a
77 ..jw."Gx..jw..Zw
00e2fe74 b8 02 6a 77 66 00 06 00 - 00 00 00 00 ec ff e2
00 ..jwf..
00e2fe84 00 00 00 00 94 03 00 00 - 00 00 00 00 00 00 00
00 .
00e2fe94 d8 01 00 00 94 03 00 00 - 00 00 00 00 00 04 00
00 .
00e2fea4 00 00 00 00 00 00 00 00 - c9 a9 04 00 43 01 00
00 C
00e2feb4 44 03 00 00 d4 01 00 00 - e8 01 00 00 ec 01 00
00 D
00e2fec4 f8 01 00 00 c0 01 00 00 - 4c 02 00 00 8c 05 00
00 ..L.
00e2fed4 8c 05 00 00 06 02 00 00 - a3 fc 42 80 02 00 00
00 .B..
00e2fee4 20 41 e6 85 02 00 00 00 - e4 44 e6 85 e3 ac 46
80 A.D.F.
00e2fef4 ff ff ff ff 02 02 00 00 - bf ab 46 80 18 9c 1c
bd .F..
00e2ff04 80 5c 75 85 e0 5d 75 85 - df 53 06 80 3d 00 00
00 .\u..]u..S..=
00e2ff14 ff ff ff ff 64 49 06 80 - 01 10 29 80 e1 00 00
00 .dI.)..
00e2ff24 4f 4c 06 80 08 00 00 00 - 20 70 91 85 20 70 91
85 OL p.. p..
État de vidage Thread Id 0x37c
eax=03ffdfdc ebx=00000002 ecx=03e30220 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00e7fe5c ebp=00e7fea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01909d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E7FEA8 77E03990 00E7FE80 00000001 00000000 00E7FEA0
ntdll!NtWaitForMultipleObjects
00E7FF04 77E03A5C 00E7FED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
00E7FF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
00E7FF74 77C6744C 00E7FFA0 00E7FFA4 00E7FFA8 00E7FF9C
shlwapi!PathBuildRootW
00E7FFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
00E7FFEC 00000000 00000000 00000000 00000000 00000000
shlwapi!Ordinal307
État de vidage Thread Id 0x410
eax=03dc729c ebx=00000002 ecx=03dc0240 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00ebfe5c ebp=00ebfea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01949d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00EBFEA8 77E03990 00EBFE80 00000001 00000000 00EBFEA0
ntdll!NtWaitForMultipleObjects
00EBFF04 77E03A5C 00EBFED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
00EBFF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
00EBFF74 77C6744C 00EBFFA0 00EBFFA4 00EBFFA8 00EBFF9C
shlwapi!PathBuildRootW
00EBFFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
00EBFFEC 00000000 77C673AB 00000000 00000000 000000C8
shlwapi!Ordinal307
*-> Vidage brut de la pile <-*
00ebfe5c d7 bd e7 77 02 00 00 00 - 80 fe eb 00 01 00 00
00 w
00ebfe6c 00 00 00 00 a0 fe eb 00 - 00 00 00 00 00 00 00
00 .
00ebfe7c 02 00 00 00 fc 01 00 00 - 14 02 00 00 c8 42 a4
77 .B.w
00ebfe8c 00 00 00 00 00 00 00 00 - 00 00 00 00 a0 fe eb
00 .
00ebfe9c 00 00 00 00 00 ba 3c dc - ff ff ff ff 04 ff eb
00 <
00ebfeac 90 39 e0 77 80 fe eb 00 - 01 00 00 00 00 00 00
00 .9.w
00ebfebc a0 fe eb 00 00 00 00 00 - 60 ea 00 00 70 41 ca
77 ..`pA.w
00ebfecc 00 00 00 00 fc 01 00 00 - 14 02 00 00 84 ff eb
00 .
00ebfedc 4f 7a 88 77 00 00 de 76 - 74 ff eb 00 00 00 00
00 Oz.wvt.
00ebfeec 70 41 ca 77 34 91 46 78 - 00 00 00 00 cc 86 fd
7f pA.w4.Fx..
00ebfefc 00 00 00 00 14 02 00 00 - 20 ff eb 00 5c 3a e0
77 .. \:.w
00ebff0c d0 fe eb 00 90 41 ca 77 - 60 ea 00 00 41 00 00
00 ..A.w`A
00ebff1c 00 00 00 00 74 ff eb 00 - 73 29 c6 77 01 00 00
00 .ts).w.
00ebff2c 90 41 ca 77 00 00 00 00 - 60 ea 00 00 41 00 00
00 .A.w.`A
00ebff3c 00 00 00 00 70 41 ca 77 - 34 91 46 78 58 3f 10
00 .pA.w4.FxX?..
00ebff4c a0 34 b2 77 a5 84 a9 77 - 00 00 00 00 78 d8 0a
00 .4.ww.x
00ebff5c 00 00 00 00 78 ff eb 00 - f8 a9 04 00 70 41 ca
77 .x.pA.w
00ebff6c 60 ea 00 00 01 00 00 00 - ac ff eb 00 4c 74 c6
77 `..Lt.w
00ebff7c a0 ff eb 00 a4 ff eb 00 - a8 ff eb 00 9c ff eb
00 .
00ebff8c 60 ea 00 00 00 00 00 00 - 00 00 c6 77 00 00 00
00 `.w.
État de vidage Thread Id 0x364
eax=000000c0 ebx=00ddfd00 ecx=77e83496 edx=00000000
esi=ffffffff edi=00000557
eip=7846915e esp=0107ffa0 ebp=0107ffb4 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01b09e87=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0107FFB4 77E7987C 00DDFD00 00000557 FFFFFFFF 00DDFD00
ntdll!ZwDelayExecution
0107FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x36c
eax=00000004 ebx=00000000 ecx=00070178 edx=00000000
esi=010bfed8 edi=00000000
eip=77e02f5c esp=010bfe98 ebp=010bfeb0 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:01b49d7f=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:01b49d7f=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
010BFEB0 76EF1E36 010BFED8 00000000 00000000 00000000
user32!TranslateMessageEx
00000001 00000000 00000000 00000000 00000000 00000000
netshell!DllGetClassObject
État de vidage Thread Id 0x368
eax=76621a78 ebx=00000003 ecx=00070000 edx=00000000
esi=78473233 edi=00000003
eip=7847323e esp=010fff20 ebp=010fff6c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01b89e07=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
010FFF6C 77E8ABFB 010FFF44 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
010FFFB4 77E7987C 00000000 00000000 00DDFA44 00000000
kernel32!WaitForMultipleObjects
010FFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x35c
eax=777f1aae ebx=77e239d4 ecx=777f314c edx=00000000
esi=0113fd70 edi=77e02f5f
eip=77e02f5c esp=0113fd04 ebp=0113fd1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:01bc9beb=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:01bc9beb=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0113FD1C 76671AD2 0113FD70 00000000 00000000 00000000
user32!TranslateMessageEx
0113FD90 7667198E 0005006C 00000000 76672848 00000001
stobject!DllGetClassObject
0113FFB4 77E7987C 00000000 00003000 010FFFFC 00000000
stobject!DllGetClassObject
0113FFEC 00000000 76671949 00000000 00000000 00040000
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
0113fd04 86 2f e0 77 70 fd 13 01 - 00 00 00 00 00 00 00
00 ./.wp..
0113fd14 00 00 00 00 00 00 00 00 - 90 fd 13 01 d2 1a 67
76 ..gv
0113fd24 70 fd 13 01 00 00 00 00 - 00 00 00 00 00 00 00
00 p
0113fd34 00 30 00 00 00 00 67 76 - 00 00 00 00 30 00 00
00 .0.gv.0
0113fd44 00 40 00 00 00 13 67 76 - 00 00 00 00 1e 00 00
00 .@.gv..
0113fd54 00 00 67 76 31 01 02 00 - 11 00 01 00 10 00 00
00 ..gv1..
0113fd64 00 00 00 00 50 28 67 76 - 00 00 00 00 6c 00 05
00 .P(gv.l
0113fd74 13 01 00 00 07 00 00 00 - 00 00 00 00 6f f1 01
00 o
0113fd84 9a 00 00 00 41 00 00 00 - 00 00 00 00 b4 ff 13
01 .A..
0113fd94 8e 19 67 76 6c 00 05 00 - 00 00 00 00 48 28 67
76 ..gvl.H(gv
0113fda4 01 00 00 00 fc ff 0f 01 - 43 00 3a 00 5c 00 57
00 ..C.:.\.W.
0113fdb4 49 00 4e 00 4e 00 54 00 - 5c 00 73 00 79 00 73
00 I.N.N.T.\.s.y.s.
0113fdc4 74 00 65 00 6d 00 33 00 - 32 00 5c 00 73 00 74
00 t.e.m.3.2.\.s.t.
0113fdd4 6f 00 62 00 6a 00 65 00 - 63 00 74 00 2e 00 64
00 o.b.j.e.c.td.
0113fde4 6c 00 6c 00 00 00 e7 77 - 1b 00 00 00 00 02 00
00 l.l.w..
0113fdf4 fc ff 13 01 23 00 00 00 - 00 00 00 00 00 00 00
00 .#..
0113fe04 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe14 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe24 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe34 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x334
eax=77532bda ebx=00000002 ecx=00000000 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=011cff24 ebp=011cff70 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01c59e0b=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
011CFF70 77E8ABFB 011CFF48 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
011CFFB4 77E7987C 00000000 00000009 0113F520 00000000
kernel32!WaitForMultipleObjects
011CFFEC 00000000 77532BDA 00000000 00000000 000000C8
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
011cff24 d7 bd e7 77 02 00 00 00 - 48 ff 1c 01 01 00 00
00 w.H.
011cff34 00 00 00 00 00 00 00 00 - 09 00 00 00 00 00 00
00 .
011cff44 00 00 00 00 60 03 00 00 - 68 03 00 00 80 21 73
85 .`h.!s.
011cff54 f0 54 06 80 14 04 00 00 - 00 00 00 00 98 dc 06
bd .T..
011cff64 00 00 00 00 00 00 00 00 - b0 dc 06 bd b4 ff 1c
01 .
011cff74 fb ab e8 77 48 ff 1c 01 - 01 00 00 00 00 00 00
00 wH..
011cff84 00 00 00 00 00 00 00 00 - 1a 2c 53 77 02 00 00
00 ,Sw.
011cff94 a4 ff 1c 01 00 00 00 00 - ff ff ff ff 20 f5 13
01
011cffa4 60 03 00 00 68 03 00 00 - 00 00 00 00 00 00 00
00 `h..
011cffb4 ec ff 1c 01 7c 98 e7 77 - 00 00 00 00 09 00 00
00 .|..w..
011cffc4 20 f5 13 01 00 00 00 00 - 00 f0 fa 7f 00 00 00
00
011cffd4 c0 ff 1c 01 00 00 00 00 - ff ff ff ff b4 f0 e8
77 w
011cffe4 60 d3 e7 77 00 00 00 00 - 00 00 00 00 00 00 00
00 `..w
011cfff4 da 2b 53 77 00 00 00 00 - 00 00 00 00 c8 00 00
00 .+Sw
011d0004 00 01 00 00 ff ee ff ee - 02 00 00 00 00 00 00
00 .
011d0014 00 fe 00 00 00 00 10 00 - 00 20 00 00 00 02 00
00
011d0024 00 20 00 00 b7 01 00 00 - ff ef fd 7f 0a 00 08
06 . ..
011d0034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
011d0044 98 05 1d 01 0f 00 00 00 - f8 ff ff ff 50 00 1d
01 P
011d0054 50 00 1d 01 40 06 1d 01 - 00 00 00 00 00 00 00
00 P@..
État de vidage Thread Id 0x360
eax=01350004 ebx=00000000 ecx=00000000 edx=00000000
esi=00080e10 edi=00000100
eip=784639c7 esp=0135fe28 ebp=0135ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:01de9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:01dd9eea=????????
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:01dd9eea=??
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:01de9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:01dd9eeb=????
784639e2 668945e0 mov
[ebp+0xe0],ax ss:01de9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:01de9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0135FF74 770CD9DB 770CDDED 00080E10 00000000 00000000
ntdll!NtReplyWaitReceivePortEx
0135FFA8 770CDD0B 0007DAC8 0135FFEC 77E7987C 00091AF8
rpcrt4!RpcBindingSetOption
0135FFB4 77E7987C 00091AF8 00000000 00000000 00091AF8
rpcrt4!RpcBindingSetOption
0135FFEC 00000000 770CDCF3 00091AF8 00000000 000000C8
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
0135fe28 ac db 0c 77 1c 01 00 00 - 54 ff 35 01 00 00 00
00 w.T.5..
0135fe38 e0 5e 0a 00 58 ff 35 01 - 50 da 07 00 48 9c 07
00 .^..X.5.PH
0135fe48 34 91 46 78 00 00 00 00 - 00 00 00 00 00 00 00
00 4.Fx
0135fe58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe78 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe98 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fea8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135feb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fec8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fed8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fee8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fef8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135ff08 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135ff18 00 00 00 00 00 00 00 00 - 00 00 00 00 e4 44 e6
85 .D..
0135ff28 e3 ac 46 80 ff ff ff ff - 20 70 91 85 80 e9 71
85 ..F.. p.q.
0135ff38 00 00 00 00 ec e9 71 85 - 80 e9 71 85 10 eb 71
85 qqq.
0135ff48 21 c3 42 80 80 e9 71 85 - e0 ea 71 85 02 00 05
00 !.Bqq..
0135ff58 00 a2 2f 4d ff ff ff ff - 50 fe 35 01 00 00 02
80 ../M.P.5..
État de vidage Thread Id 0x434
eax=00000090 ebx=000493e0 ecx=78ee61a6 edx=00000000
esi=00080038 edi=000493e0
eip=7846beb2 esp=013afebc ebp=013afee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
fonction : NtRemoveIoCompletion
7846bea7 b8a8000000 mov eax,0xa8
7846beac 8d542404 lea edx,
[esp+0x4] ss:01e39da3=????????
7846beb0 cd2e int 2e
7846beb2 c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
013AFEE4 770C57C0 00000120 013AFF1C 013AFF0C 013AFF14
ntdll!NtRemoveIoCompletion
013AFF20 770E2899 000493E0 013AFF60 013AFF5C 013AFF70
rpcrt4!UuidFromStringA
013AFF74 770E2778 770CDD59 00080038 0113F3CA 7846C277
rpcrt4!I_RpcTransConnectionReallocPacket
013AFFA8 770CDD0B 000A11E0 013AFFEC 77E7987C 0009E6B8
rpcrt4!I_RpcTransConnectionReallocPacket
013AFFB4 77E7987C 0009E6B8 0113F3CA 7846C277 0009E6B8
rpcrt4!RpcBindingSetOption
013AFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x43c
eax=00000001 ebx=00000000 ecx=014e2bd8 edx=00000000
esi=00074098 edi=00000000
eip=77e03569 esp=013efee8 ebp=013eff2c iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01e79dcf=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
013EFF2C 76E0160E 000600B4 00000000 7846D04A 000A8538
user32!WaitMessage
013EFFB4 77E7987C 000A8538 00000000 7846D04A 000A8538
browseui!Ordinal102
013EFFEC 00000000 76E015D2 000A8538 00000000 65696C43
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
013efee8 b2 17 e0 76 00 00 00 00 - 4a d0 46 78 38 85 0a
00 v.J.Fx8
013efef8 4a 00 1e 00 13 01 00 00 - 00 10 00 00 00 00 00
00 J
013eff08 95 95 04 00 bc 04 00 00 - 1f 00 00 00 00 00 00
00 .
013eff18 01 00 00 00 98 40 07 00 - 02 80 00 00 f0 db 0a
00 ..@.
013eff28 00 00 00 00 b4 ff 3e 01 - 0e 16 e0 76 b4 00 06
00 >.v.
013eff38 00 00 00 00 4a d0 46 78 - 38 85 0a 00 b0 91 71
85 .J.Fx8..q.
013eff48 21 c3 42 80 20 90 71 85 - 80 91 71 85 f0 54 06
80 !.B. .qq..T..
013eff58 78 9c 32 bd 78 9c 32 bd - 08 94 4d 80 01 00 00
00 x.2.x.2M..
013eff68 00 00 00 00 b0 9c 32 bd - 00 00 00 00 b0 91 71
85 2.q.
013eff78 05 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
013eff88 81 f9 42 80 00 00 00 00 - 00 00 00 00 31 fa 42
80 ..B1.B.
013eff98 20 70 91 85 38 ff 3e 01 - 01 01 00 00 dc ff 3e
01 p..8.>.>.
013effa8 72 73 e5 76 38 49 e0 76 - 00 00 00 00 ec ff 3e
01 rs.v8I.v>.
013effb8 7c 98 e7 77 38 85 0a 00 - 00 00 00 00 4a d0 46
78 |..w8.J.Fx
013effc8 38 85 0a 00 00 c0 fa 7f - 49 20 ed 78 c0 ff 3e
01 8.I .x..>.
013effd8 49 20 ed 78 ff ff ff ff - b4 f0 e8 77 60 d3 e7
77 I .x.w`..w
013effe8 00 00 00 00 00 00 00 00 - 00 00 00 00 d2 15 e0
76 v
013efff8 38 85 0a 00 00 00 00 00 - 43 6c 69 65 6e 74 20
55 8.Client U
013f0008 72 6c 43 61 63 68 65 20 - 4d 4d 46 20 56 65 72
20 rlCache MMF Ver
013f0018 35 2e 32 00 00 80 00 00 - 00 00 00 00 80 00 00
00 5.2.
État de vidage Thread Id 0x3f0
eax=000012b3 ebx=0191ff74 ecx=014f0f70 edx=00000000
esi=78474086 edi=00000470
eip=78474091 esp=0191ff58 ebp=0191ff7c iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:023a9e3f=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:00a8b199=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:01f7ae56=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0191FF7C 77E81B1B 00000470 000927C0 00000000 75B3B36D
ntdll!ZwWaitForSingleObject
78469134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A
kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
État de vidage Thread Id 0x3d8
eax=0199fd70 ebx=0195ff74 ecx=000de000 edx=00000000
esi=78474086 edi=00000478
eip=78474091 esp=0195ff58 ebp=0195ff7c iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:023e9e3f=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:02429c56=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:00b67ee6=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0195FF7C 77E81B1B 00000478 000927C0 00000000 75B3B36D
ntdll!ZwWaitForSingleObject
78469134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A
kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
État de vidage Thread Id 0x464
eax=c0000034 ebx=00000520 ecx=7846d7cc edx=00000000
esi=01eeff98 edi=77e05780
eip=77e02f5c esp=01eeff58 ebp=01eeff78 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:02979e3f=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:02979e3f=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01EEFF78 77545C36 01EEFF98 00000000 00000000 00000000
user32!TranslateMessageEx
01EEFFB4 77E7987C 00000520 77565428 013EDA18 00000520
winmm!midiOutGetNumDevs
01EEFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x378
eax=00006004 ebx=00000002 ecx=00071f38 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=02bafe5c ebp=02bafea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:03639d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
02BAFEA8 77E03990 02BAFE80 00000001 00000000 02BAFEA0
ntdll!NtWaitForMultipleObjects
02BAFF04 77E03A5C 02BAFED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
02BAFF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
02BAFF74 77C6744C 02BAFFA0 02BAFFA4 02BAFFA8 02BAFF9C
shlwapi!PathBuildRootW
02BAFFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
02BAFFEC 00000000 00000000 00000000 00000000 00000000
shlwapi!Ordinal307
État de vidage Thread Id 0x324
eax=ffffffff ebx=00000000 ecx=00000002 edx=006f0043
esi=00000001 edi=03b3e144
eip=77e7e38e esp=03b3e09c ebp=03b3e104 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : CompareStringW
77e7e370 8b7d18 mov edi,
[ebp+0x18] ss:045c7fea=????????
77e7e373 33db xor ebx,ebx
77e7e375 895508 mov
[ebp+0x8],edx ss:045c7fea=????????
77e7e378 3bd3 cmp edx,ebx
77e7e37a 897d1c mov
[ebp+0x1c],edi ss:045c7fea=????????
77e7e37d 0f84f54f0100 je
WriteProfileStringA+0x25 (77e93378)
77e7e383 3bfb cmp edi,ebx
77e7e385 0f84ed4f0100 je
WriteProfileStringA+0x25 (77e93378)
77e7e38b 6a02 push 0x2
77e7e38d 59 pop ecx
FAUTE ->77e7e38e 668b02 mov ax,
[edx] ds:006f0043=????
77e7e391 663b07 cmp ax,
[edi] ds:03b3e144=0047
77e7e394 0f84edb4ffff je
SetThreadExecutionState+0x232 (77e79887)
77e7e39a 668b02 mov ax,
[edx] ds:006f0043=????
77e7e39d 663b07 cmp ax,
[edi] ds:03b3e144=0047
77e7e3a0 0f8417cdffff je
GetStdHandle+0x1b0 (77e7b0bd)
77e7e3a6 8b4ddc mov ecx,
[ebp+0xdc] ss:045c7fea=????????
77e7e3a9 895dc8 mov
[ebp+0xc8],ebx ss:045c7fea=????????
77e7e3ac f7de neg esi
77e7e3ae 1bf6 sbb esi,esi
77e7e3b0 33c0 xor eax,eax
77e7e3b2 81e6000000e8 and esi,0xe8000000
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
03B3E104 77E8A1AA 006F0043 00000001 006F0043 FFFFFFFF
kernel32!CompareStringW
03B3E188 00670069 00720075 00720065 006C0020 00730065
kernel32!lstrcmpiW
0066006E 00000000 00000000 00000000 00000000 00000000
<nosymbols>
*-> Vidage brut de la pile <-*
03b3e09c 43 00 6f 00 2c 14 11 00 - 44 e1 b3 03 58 e2 b3
03 C.o.,DX
03b3e0ac 16 06 00 00 6c e2 b3 03 - 74 e2 b3 03 3a 3c ed
78 .lt:<.x
03b3e0bc 58 e2 b3 03 00 00 00 00 - 00 00 00 00 6c e3 b3
03 X..l
03b3e0cc b6 00 00 00 5c 00 52 00 - 45 00 47 00 49 00 53
00 .\.R.E.G.I.S.
03b3e0dc 54 00 52 00 00 33 07 00 - 4d 00 41 00 43 00 48
00 T.R..3..M.A.C.H.
03b3e0ec 49 00 4e 00 45 00 5c 00 - 2c 14 11 00 31 90 e7
77 I.N.E.\.,1..w
03b3e0fc 44 e1 b3 03 68 61 10 00 - 88 e1 b3 03 aa a1 e8
77 Dhaw
03b3e10c 43 00 6f 00 01 00 00 00 - 43 00 6f 00 ff ff ff
ff C.o..C.o..
03b3e11c 44 e1 b3 03 44 e1 b3 03 - 8d a1 e8 77 00 00 00
00 DDw.
03b3e12c 05 9a 5f 77 43 00 6f 00 - 44 e1 b3 03 60 e7 b3
03 .._wC.o.D`
03b3e13c 08 13 09 00 40 eb b3 03 - 47 00 65 00 73 00 74
00 .@G.e.s.t.
03b3e14c 69 00 6f 00 6e 00 6e 00 - 61 00 69 00 72 00 65
00 i.o.n.n.a.i.r.e.
03b3e15c 20 00 64 00 65 00 20 00 - 42 00 75 00 72 00 65
00 .d.e. .B.u.r.e.
03b3e16c 61 00 75 00 20 00 4e 00 - 56 00 49 00 44 00 49
00 a.u. .N.V.I.D.I.
03b3e17c 41 00 20 00 6e 00 56 00 - 43 00 6f 00 6e 00 66
00 A. .n.V.C.o.n.f.
03b3e18c 69 00 67 00 75 00 72 00 - 65 00 72 00 20 00 6c
00 i.g.u.r.e.r. .l.
03b3e19c 65 00 73 00 20 00 70 00 - 61 00 72 00 61 00 6d
00 e.s. .p.a.r.a.m.
03b3e1ac e8 00 74 00 72 00 65 00 - 73 00 20 00 64 00 75
00 ..t.r.e.s. .d.u.
03b3e1bc 20 00 67 00 65 00 73 00 - 74 00 69 00 6f 00 6e
00 .g.e.s.t.i.o.n.
03b3e1cc 6e 00 61 00 69 00 72 00 - 65 00 20 00 64 00 65
00 n.a.i.r.e. .d.e.
Une exception d'application s'est produite :
App : explorer.exe (pid=844)
Lorsque : 06/01/2004 @ 00:47:02.078
Numéro d'exception : c0000005 (violation d'accès)
*-> Informations système <-*
Nom ordinateur : INTEL-P-4-2-8
Nom utilisateur : Administrateur
Nombre de processeurs : 2
Type de processeur : x86 Family 15 Model 2
Stepping 9
Version Windows 2000 : 5.0
Numéro actuel : 2195
Service Pack : 4
Type actuel : Multiprocessor Free
Organisation enregistrée : Particulier
Propriétaire enregistré : DAVID Philippe
*-> Liste des tâches <-*
0 Idle.exe
8 System.exe
152 SMSS.exe
176 CSRSS.exe
196 WINLOGON.exe
224 SERVICES.exe
236 LSASS.exe
420 svchost.exe
448 spoolsv.exe
480 svchost.exe
512 nvsvc32.exe
540 regsvc.exe
576 mstask.exe
608 SMAgent.exe
640 WinMgmt.exe
664 svchost.exe
740 WinMgmt.exe
844 explorer.exe
928 SMax4PNP.exe
936 SMax4.exe
956 internat.exe
964 rundll32.exe
972 MaxBlast3.exe
1056 DRWTSN32.exe
0 _Total.exe
(00400000 - 0043E000)
(78460000 - 784E1000)
(78ED0000 - 78F32000)
(77E70000 - 77F34000)
(770C0000 - 77131000)
(77F40000 - 77F7C000)
(77E00000 - 77E65000)
(77C60000 - 77CAA000)
(77B40000 - 77BC9000)
(77880000 - 778A5000)
(23000000 - 23056000)
(77580000 - 777CF000)
(77A40000 - 77B37000)
(72C60000 - 72CE6000)
(779A0000 - 77A3B000)
(78000000 - 78045000)
(77840000 - 77880000)
(77090000 - 770B3000)
(78DB0000 - 78EC2000)
(76DE0000 - 76EA7000)
(793C0000 - 793D1000)
(78D20000 - 78D83000)
(76DC0000 - 76DD2000)
(76F70000 - 76F7F000)
(773B0000 - 773C5000)
(750F0000 - 7513F000)
(78FB0000 - 78FBF000)
(75140000 - 75146000)
(750D0000 - 750DF000)
(74FB0000 - 74FC4000)
(74FA0000 - 74FA8000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FD0000 - 74FD9000)
(750E0000 - 750EC000)
(75190000 - 751A5000)
(75150000 - 75188000)
(76EF0000 - 76F69000)
(76620000 - 76663000)
(00FF0000 - 011F4000)
(76670000 - 76688000)
(766E0000 - 766E8000)
(783C0000 - 78451000)
(76690000 - 76697000)
(77540000 - 77571000)
(77530000 - 77538000)
(773D0000 - 773D8000)
(773E0000 - 773F3000)
(766B0000 - 766B9000)
(6E350000 - 6E356000)
(75E00000 - 75E1A000)
(76EB0000 - 76EBC000)
(77F80000 - 77FF3000)
(77810000 - 77817000)
(75950000 - 75956000)
(75CF0000 - 75D72000)
(75A90000 - 75CD2000)
(76BD0000 - 76C45000)
(76D60000 - 76DB7000)
(75A60000 - 75A88000)
(656A0000 - 657B5000)
(6E3C0000 - 6E3CA000)
(6B200000 - 6B23C000)
(75CE0000 - 75CE6000)
(768E0000 - 7690B000)
(77410000 - 77489000)
(77400000 - 77410000)
(77910000 - 77933000)
(75D80000 - 75DF7000)
(64DD0000 - 64DEC000)
(10000000 - 10013000)
(022A0000 - 022DD000)
État de vidage Thread Id 0x348
eax=00000000 ebx=00000001 ecx=00000000 edx=00000000
esi=0008c788 edi=00000000
eip=77e03569 esp=0006ff00 ebp=0006ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:00af9de7=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FF1C 775AADBB 00000000 004084C4 0008C788 00000000
user32!WaitMessage
0006FF60 00408201 00000058 00000000 000205BE 00000001
shell32!Ordinal201
0006FFC0 77E787F5 00000000 00000000 7FFDF000 00000000
explorer!<nosymbols>
0006FFF0 00000000 00408188 00000000 000000C8 00000100
kernel32!DosDateTimeToFileTime
*-> Vidage brut de la pile <-*
0006ff00 41 ae 5a 77 94 55 e8 77 - 88 c7 08 00 01 00 00
00 A.Zw.U.w..
0006ff10 88 c7 08 00 88 c7 08 00 - 60 ff 06 00 60 ff 06
00 ..``
0006ff20 bb ad 5a 77 00 00 00 00 - c4 84 40 00 88 c7 08
00 ..Zw@..
0006ff30 00 00 00 00 be 05 02 00 - 00 f0 fd 7f 00 e0 fd
7f .
0006ff40 92 ab e8 77 00 00 00 00 - 0c 00 00 00 be 05 02
00 w
0006ff50 68 60 07 00 02 00 00 00 - 08 cf 00 00 e0 ff 06
00 h`..
0006ff60 c0 ff 06 00 01 82 40 00 - 58 00 00 00 00 00 00
00 @.X.
0006ff70 be 05 02 00 01 00 00 00 - 00 00 00 00 44 00 00
00 D
0006ff80 18 29 07 00 e0 42 07 00 - 68 60 07 00 00 00 00
00 .)B..h`
0006ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 98 e9 06
00 .
0006ffa0 28 9c 07 00 90 e9 06 00 - 01 00 00 00 01 00 00
00 (
0006ffb0 00 00 00 00 ff ff ff ff - ff ff ff ff ff ff ff
ff .
0006ffc0 f0 ff 06 00 f5 87 e7 77 - 00 00 00 00 00 00 00
00 .w..
0006ffd0 00 f0 fd 7f 00 00 00 00 - c8 ff 06 00 00 00 00
00 .
0006ffe0 ff ff ff ff b4 f0 e8 77 - c8 8e e7 77 00 00 00
00 .ww.
0006fff0 00 00 00 00 00 00 00 00 - 88 81 40 00 00 00 00
00 .@..
00070000 c8 00 00 00 00 01 00 00 - ff ee ff ee 02 00 00
00 .
00070010 00 00 00 00 00 fe 00 00 - 00 00 10 00 00 20 00
00 . ..
00070020 00 02 00 00 00 20 00 00 - e1 14 00 00 ff ef fd
7f .. .
00070030 01 00 08 06 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x35c
eax=770cdcf3 ebx=00000000 ecx=00000001 edx=00000000
esi=00080c90 edi=00000000
eip=784639c7 esp=00d4fe28 ebp=00d4ff74 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:017d9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89ee6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:77b57bd9=458d77b4
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:77b57bd9=b4
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:017d9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89ee6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:77b57bda=8d77
784639e2 668945e0 mov
[ebp+0xe0],ax ss:017d9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:017d9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D4FF74 770CD9DB 770CDD59 00080C90 40080784 00000070
ntdll!NtReplyWaitReceivePortEx
00D4FFA8 770CDD0B 0007FCA8 00D4FFEC 77E7987C 00080BD8
rpcrt4!RpcBindingSetOption
00D4FFB4 77E7987C 00080BD8 40080784 00000070 00080BD8
rpcrt4!RpcBindingSetOption
00D4FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x360
eax=77a7e915 ebx=00000102 ecx=00083820 edx=00000000
esi=78469153 edi=00d8ff74
eip=7846915e esp=00d8ff60 ebp=00d8ff7c iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01819e47=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D8FF7C 77E8AC79 0000EA60 00000000 77A50216 0000EA60
ntdll!ZwDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000
kernel32!Sleep
État de vidage Thread Id 0x364
eax=360101f9 ebx=0006fee8 ecx=008401d0 edx=00000000
esi=0006ff04 edi=00000000
eip=77e03569 esp=00dcff60 ebp=00dcff80 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01859e47=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00DCFF80 0040A389 77C7CEA0 00400000 00076088 00076094
user32!WaitMessage
00DCFFB4 77E7987C 0006FEE8 00076088 00076094 0006FEE8
explorer!<nosymbols>
00DCFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x368
eax=00000000 ebx=00000007 ecx=77592228 edx=00000000
esi=78473233 edi=00000007
eip=7847323e esp=00e1fd98 ebp=00e1fde4 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:018a9c7f=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E1FDE4 77E03990 00E1FDBC 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00E1FE40 77E03A5C 00E1FE0C 00E1FEB8 FFFFFFFF 000000FF
user32!MsgWaitForMultipleObjectsEx
00E1FE5C 775A9390 00000006 00E1FEB8 00000000 FFFFFFFF
user32!MsgWaitForMultipleObjects
776A02B8 00000000 00000001 000002F4 000001C8 00000000
shell32!Ordinal200
État de vidage Thread Id 0x36c
eax=0245dfdc ebx=00000002 ecx=02290220 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00e5fe5c ebp=00e5fea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=
d'erreur m'indique que explorer.exe a généré des erreurs
et sera fermer par windows.
Un journal des erreurs est créé.
Si quelqu'un connait ce problème, merci de m'informer
comment le résoudre.
Pour vous aider peut être voici la copie du journal des
erreurs généré après ce défaut :
Microsoft (R) Windows 2000 (TM) Version 5.00 DrWtsn32
Copyright (C) 1985-1999 Microsoft Corp. Tous droits
réservés.
Une exception d'application s'est produite :
App : explorer.exe (pid=1044)
Lorsque : 06/01/2004 @ 00:39:10.218
Numéro d'exception : c0000005 (violation d'accès)
*-> Informations système <-*
Nom ordinateur : INTEL-P-4-2-8
Nom utilisateur : Administrateur
Nombre de processeurs : 2
Type de processeur : x86 Family 15 Model 2
Stepping 9
Version Windows 2000 : 5.0
Numéro actuel :
Service Pack : 4
Type actuel : Multiprocessor Free
Organisation enregistrée :
Propriétaire enregistré :
*-> Liste des tâches <-*
0 Idle.exe
8 System.exe
152 SMSS.exe
176 CSRSS.exe
196 WINLOGON.exe
224 SERVICES.exe
236 LSASS.exe
412 svchost.exe
440 spoolsv.exe
472 svchost.exe
504 nvsvc32.exe
532 regsvc.exe
568 mstask.exe
604 SMAgent.exe
632 WinMgmt.exe
660 svchost.exe
932 SMax4PNP.exe
940 SMax4.exe
900 internat.exe
960 rundll32.exe
1044 explorer.exe
280 DRWTSN32.exe
0 _Total.exe
(00400000 - 0043E000)
(78460000 - 784E1000)
(78ED0000 - 78F32000)
(77E70000 - 77F34000)
(770C0000 - 77131000)
(77F40000 - 77F7C000)
(77E00000 - 77E65000)
(77C60000 - 77CAA000)
(77B40000 - 77BC9000)
(77880000 - 778A5000)
(23000000 - 23056000)
(77580000 - 777CF000)
(6E350000 - 6E356000)
(75E00000 - 75E1A000)
(77A40000 - 77B37000)
(72C60000 - 72CE6000)
(779A0000 - 77A3B000)
(78000000 - 78045000)
(77840000 - 77880000)
(77090000 - 770B3000)
(78DB0000 - 78EC2000)
(76DE0000 - 76EA7000)
(793C0000 - 793D1000)
(78D20000 - 78D83000)
(76DC0000 - 76DD2000)
(76F70000 - 76F7F000)
(773B0000 - 773C5000)
(750F0000 - 7513F000)
(78FB0000 - 78FBF000)
(75140000 - 75146000)
(750D0000 - 750DF000)
(74FB0000 - 74FC4000)
(74FA0000 - 74FA8000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FD0000 - 74FD9000)
(750E0000 - 750EC000)
(75190000 - 751A5000)
(75150000 - 75188000)
(76EF0000 - 76F69000)
(76620000 - 76663000)
(76670000 - 76688000)
(766E0000 - 766E8000)
(783C0000 - 78451000)
(76690000 - 76697000)
(77540000 - 77571000)
(77530000 - 77538000)
(773D0000 - 773D8000)
(773E0000 - 773F3000)
(766B0000 - 766B9000)
(76230000 - 7626E000)
(74100000 - 74164000)
(76EB0000 - 76EBC000)
(76BD0000 - 76C45000)
(77F80000 - 77FF3000)
(77810000 - 77817000)
(75950000 - 75956000)
(75CF0000 - 75D72000)
(75A90000 - 75CD2000)
(76D60000 - 76DB7000)
(75A60000 - 75A88000)
(656A0000 - 657B5000)
(6E3C0000 - 6E3CA000)
(6B200000 - 6B23C000)
(75CE0000 - 75CE6000)
(71E40000 - 71E8D000)
(6A6F0000 - 6A710000)
(747F0000 - 74806000)
(6FF60000 - 6FF65000)
(66410000 - 66464000)
(77080000 - 77087000)
(66AF0000 - 66B21000)
(038B0000 - 03AB4000)
(768E0000 - 7690B000)
(77410000 - 77489000)
(77400000 - 77410000)
(77910000 - 77933000)
(75D80000 - 75DF7000)
(64DD0000 - 64DEC000)
(10000000 - 10013000)
(03E40000 - 03E7D000)
État de vidage Thread Id 0x3e4
eax=03b00004 ebx=00000001 ecx=03b00004 edx=00000000
esi=0008c9c8 edi=00000000
eip=77e03569 esp=0006ff00 ebp=0006ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:00af9de7=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FF1C 775AADBB 00000000 004084C4 0008C9C8 00000000
user32!WaitMessage
0006FF60 00408201 00000058 00000000 000205BE 00000005
shell32!Ordinal201
0006FFC0 77E787F5 00000000 00000000 7FFDF000 00000000
explorer!<nosymbols>
0006FFF0 00000000 00408188 00000000 000000C8 00000100
kernel32!DosDateTimeToFileTime
*-> Vidage brut de la pile <-*
0006ff00 41 ae 5a 77 94 55 e8 77 - c8 c9 08 00 01 00 00
00 A.Zw.U.w..
0006ff10 c8 c9 08 00 c8 c9 08 00 - 60 ff 06 00 60 ff 06
00 ..``
0006ff20 bb ad 5a 77 00 00 00 00 - c4 84 40 00 c8 c9 08
00 ..Zw@..
0006ff30 00 00 00 00 be 05 02 00 - 00 f0 fd 7f 00 e0 fd
7f .
0006ff40 92 ab e8 77 00 00 00 00 - 0c 00 00 00 be 05 02
00 w
0006ff50 68 60 07 00 02 00 00 00 - 94 a2 01 00 e0 ff 06
00 h`..
0006ff60 c0 ff 06 00 01 82 40 00 - 58 00 00 00 00 00 00
00 @.X.
0006ff70 be 05 02 00 05 00 00 00 - 00 00 00 00 44 00 00
00 D
0006ff80 18 29 07 00 e0 42 07 00 - 68 60 07 00 00 00 00
00 .)B..h`
0006ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 2a 00 00
00 *
0006ffa0 00 00 00 00 ea f1 06 00 - 01 00 00 00 05 00 00
00 .
0006ffb0 00 00 00 00 ff ff ff ff - ff ff ff ff ff ff ff
ff .
0006ffc0 f0 ff 06 00 f5 87 e7 77 - 00 00 00 00 00 00 00
00 .w..
0006ffd0 00 f0 fd 7f 00 00 00 00 - c8 ff 06 00 00 00 00
00 .
0006ffe0 ff ff ff ff b4 f0 e8 77 - c8 8e e7 77 00 00 00
00 .ww.
0006fff0 00 00 00 00 00 00 00 00 - 88 81 40 00 00 00 00
00 .@..
00070000 c8 00 00 00 00 01 00 00 - ff ee ff ee 02 00 00
00 .
00070010 00 00 00 00 00 fe 00 00 - 00 00 10 00 00 20 00
00 . ..
00070020 00 02 00 00 00 20 00 00 - 8e 32 00 00 ff ef fd
7f .. 2
00070030 01 00 08 06 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x2ec
eax=770cdcf3 ebx=00000000 ecx=00000001 edx=00000000
esi=00080e10 edi=00000100
eip=784639c7 esp=00d5fe28 ebp=00d5ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:017e9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:77b57bd9=458d77b4
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:77b57bd9=b4
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:017e9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:77b57bda=8d77
784639e2 668945e0 mov
[ebp+0xe0],ax ss:017e9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:017e9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D5FF74 770CD9DB 770CDDED 00080E10 40080904 00000070
ntdll!NtReplyWaitReceivePortEx
00D5FFA8 770CDD0B 0007DAC8 00D5FFEC 77E7987C 00080D58
rpcrt4!RpcBindingSetOption
00D5FFB4 77E7987C 00080D58 40080904 00000070 00080D58
rpcrt4!RpcBindingSetOption
00D5FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x39c
eax=00000190 ebx=00000102 ecx=77a4ff04 edx=00000000
esi=78469153 edi=00d9ff74
eip=7846915e esp=00d9ff60 ebp=00d9ff7c iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01829e47=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D9FF7C 77E8AC79 0000EA60 00000000 77A50216 0000EA60
ntdll!ZwDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000
kernel32!Sleep
État de vidage Thread Id 0x388
eax=0000001d ebx=0006fee8 ecx=00ddff3c edx=00000000
esi=0006ff04 edi=00000000
eip=77e03569 esp=00ddff60 ebp=00ddff80 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01869e47=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00DDFF80 0040A389 77C7CEA0 00400000 00076088 00076094
user32!WaitMessage
00DDFFB4 77E7987C 0006FEE8 00076088 00076094 0006FEE8
explorer!<nosymbols>
00DDFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x394
eax=00000394 ebx=00000000 ecx=7ffda000 edx=00000000
esi=776a02b8 edi=00000000
eip=78474091 esp=00e2fdf4 ebp=00e2fe64 iopl=0 nv
up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000216
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:018b9cdb=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:00a8a27a=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:80a63ee6=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E2FE64 784722F8 776A0200 775A92F4 776A02B8 00060066
ntdll!ZwWaitForSingleObject
776A02B8 00000001 00000001 00000324 00000220 00000000
ntdll!RtlImageDirectoryEntryToData
*-> Vidage brut de la pile <-*
00e2fdf4 87 23 47 78 20 02 00 00 - 00 00 00 00 00 00 00
00 .#Gx ..
00e2fe04 00 00 00 00 06 00 00 00 - 07 00 00 00 e8 01 00
00 .
00e2fe14 ec 01 00 00 f8 01 00 00 - c0 01 00 00 4c 02 00
00 L
00e2fe24 8c 05 00 00 e4 01 00 00 - 07 00 00 00 00 00 00
00 .
00e2fe34 cc a6 fd 7f 00 00 00 00 - e4 01 00 00 5c fe e2
00 \
00e2fe44 5c 3a e0 77 0c fe e2 00 - b8 fe e2 00 ff ff ff
ff \:.w
00e2fe54 ff 00 00 00 00 00 00 00 - b8 02 6a 77 00 00 00
00 .jw.
00e2fe64 b8 02 6a 77 f8 22 47 78 - 00 02 6a 77 f4 92 5a
77 ..jw."Gx..jw..Zw
00e2fe74 b8 02 6a 77 66 00 06 00 - 00 00 00 00 ec ff e2
00 ..jwf..
00e2fe84 00 00 00 00 94 03 00 00 - 00 00 00 00 00 00 00
00 .
00e2fe94 d8 01 00 00 94 03 00 00 - 00 00 00 00 00 04 00
00 .
00e2fea4 00 00 00 00 00 00 00 00 - c9 a9 04 00 43 01 00
00 C
00e2feb4 44 03 00 00 d4 01 00 00 - e8 01 00 00 ec 01 00
00 D
00e2fec4 f8 01 00 00 c0 01 00 00 - 4c 02 00 00 8c 05 00
00 ..L.
00e2fed4 8c 05 00 00 06 02 00 00 - a3 fc 42 80 02 00 00
00 .B..
00e2fee4 20 41 e6 85 02 00 00 00 - e4 44 e6 85 e3 ac 46
80 A.D.F.
00e2fef4 ff ff ff ff 02 02 00 00 - bf ab 46 80 18 9c 1c
bd .F..
00e2ff04 80 5c 75 85 e0 5d 75 85 - df 53 06 80 3d 00 00
00 .\u..]u..S..=
00e2ff14 ff ff ff ff 64 49 06 80 - 01 10 29 80 e1 00 00
00 .dI.)..
00e2ff24 4f 4c 06 80 08 00 00 00 - 20 70 91 85 20 70 91
85 OL p.. p..
État de vidage Thread Id 0x37c
eax=03ffdfdc ebx=00000002 ecx=03e30220 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00e7fe5c ebp=00e7fea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01909d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E7FEA8 77E03990 00E7FE80 00000001 00000000 00E7FEA0
ntdll!NtWaitForMultipleObjects
00E7FF04 77E03A5C 00E7FED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
00E7FF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
00E7FF74 77C6744C 00E7FFA0 00E7FFA4 00E7FFA8 00E7FF9C
shlwapi!PathBuildRootW
00E7FFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
00E7FFEC 00000000 00000000 00000000 00000000 00000000
shlwapi!Ordinal307
État de vidage Thread Id 0x410
eax=03dc729c ebx=00000002 ecx=03dc0240 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00ebfe5c ebp=00ebfea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01949d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00EBFEA8 77E03990 00EBFE80 00000001 00000000 00EBFEA0
ntdll!NtWaitForMultipleObjects
00EBFF04 77E03A5C 00EBFED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
00EBFF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
00EBFF74 77C6744C 00EBFFA0 00EBFFA4 00EBFFA8 00EBFF9C
shlwapi!PathBuildRootW
00EBFFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
00EBFFEC 00000000 77C673AB 00000000 00000000 000000C8
shlwapi!Ordinal307
*-> Vidage brut de la pile <-*
00ebfe5c d7 bd e7 77 02 00 00 00 - 80 fe eb 00 01 00 00
00 w
00ebfe6c 00 00 00 00 a0 fe eb 00 - 00 00 00 00 00 00 00
00 .
00ebfe7c 02 00 00 00 fc 01 00 00 - 14 02 00 00 c8 42 a4
77 .B.w
00ebfe8c 00 00 00 00 00 00 00 00 - 00 00 00 00 a0 fe eb
00 .
00ebfe9c 00 00 00 00 00 ba 3c dc - ff ff ff ff 04 ff eb
00 <
00ebfeac 90 39 e0 77 80 fe eb 00 - 01 00 00 00 00 00 00
00 .9.w
00ebfebc a0 fe eb 00 00 00 00 00 - 60 ea 00 00 70 41 ca
77 ..`pA.w
00ebfecc 00 00 00 00 fc 01 00 00 - 14 02 00 00 84 ff eb
00 .
00ebfedc 4f 7a 88 77 00 00 de 76 - 74 ff eb 00 00 00 00
00 Oz.wvt.
00ebfeec 70 41 ca 77 34 91 46 78 - 00 00 00 00 cc 86 fd
7f pA.w4.Fx..
00ebfefc 00 00 00 00 14 02 00 00 - 20 ff eb 00 5c 3a e0
77 .. \:.w
00ebff0c d0 fe eb 00 90 41 ca 77 - 60 ea 00 00 41 00 00
00 ..A.w`A
00ebff1c 00 00 00 00 74 ff eb 00 - 73 29 c6 77 01 00 00
00 .ts).w.
00ebff2c 90 41 ca 77 00 00 00 00 - 60 ea 00 00 41 00 00
00 .A.w.`A
00ebff3c 00 00 00 00 70 41 ca 77 - 34 91 46 78 58 3f 10
00 .pA.w4.FxX?..
00ebff4c a0 34 b2 77 a5 84 a9 77 - 00 00 00 00 78 d8 0a
00 .4.ww.x
00ebff5c 00 00 00 00 78 ff eb 00 - f8 a9 04 00 70 41 ca
77 .x.pA.w
00ebff6c 60 ea 00 00 01 00 00 00 - ac ff eb 00 4c 74 c6
77 `..Lt.w
00ebff7c a0 ff eb 00 a4 ff eb 00 - a8 ff eb 00 9c ff eb
00 .
00ebff8c 60 ea 00 00 00 00 00 00 - 00 00 c6 77 00 00 00
00 `.w.
État de vidage Thread Id 0x364
eax=000000c0 ebx=00ddfd00 ecx=77e83496 edx=00000000
esi=ffffffff edi=00000557
eip=7846915e esp=0107ffa0 ebp=0107ffb4 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01b09e87=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0107FFB4 77E7987C 00DDFD00 00000557 FFFFFFFF 00DDFD00
ntdll!ZwDelayExecution
0107FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x36c
eax=00000004 ebx=00000000 ecx=00070178 edx=00000000
esi=010bfed8 edi=00000000
eip=77e02f5c esp=010bfe98 ebp=010bfeb0 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:01b49d7f=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:01b49d7f=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
010BFEB0 76EF1E36 010BFED8 00000000 00000000 00000000
user32!TranslateMessageEx
00000001 00000000 00000000 00000000 00000000 00000000
netshell!DllGetClassObject
État de vidage Thread Id 0x368
eax=76621a78 ebx=00000003 ecx=00070000 edx=00000000
esi=78473233 edi=00000003
eip=7847323e esp=010fff20 ebp=010fff6c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01b89e07=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
010FFF6C 77E8ABFB 010FFF44 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
010FFFB4 77E7987C 00000000 00000000 00DDFA44 00000000
kernel32!WaitForMultipleObjects
010FFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x35c
eax=777f1aae ebx=77e239d4 ecx=777f314c edx=00000000
esi=0113fd70 edi=77e02f5f
eip=77e02f5c esp=0113fd04 ebp=0113fd1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:01bc9beb=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:01bc9beb=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0113FD1C 76671AD2 0113FD70 00000000 00000000 00000000
user32!TranslateMessageEx
0113FD90 7667198E 0005006C 00000000 76672848 00000001
stobject!DllGetClassObject
0113FFB4 77E7987C 00000000 00003000 010FFFFC 00000000
stobject!DllGetClassObject
0113FFEC 00000000 76671949 00000000 00000000 00040000
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
0113fd04 86 2f e0 77 70 fd 13 01 - 00 00 00 00 00 00 00
00 ./.wp..
0113fd14 00 00 00 00 00 00 00 00 - 90 fd 13 01 d2 1a 67
76 ..gv
0113fd24 70 fd 13 01 00 00 00 00 - 00 00 00 00 00 00 00
00 p
0113fd34 00 30 00 00 00 00 67 76 - 00 00 00 00 30 00 00
00 .0.gv.0
0113fd44 00 40 00 00 00 13 67 76 - 00 00 00 00 1e 00 00
00 .@.gv..
0113fd54 00 00 67 76 31 01 02 00 - 11 00 01 00 10 00 00
00 ..gv1..
0113fd64 00 00 00 00 50 28 67 76 - 00 00 00 00 6c 00 05
00 .P(gv.l
0113fd74 13 01 00 00 07 00 00 00 - 00 00 00 00 6f f1 01
00 o
0113fd84 9a 00 00 00 41 00 00 00 - 00 00 00 00 b4 ff 13
01 .A..
0113fd94 8e 19 67 76 6c 00 05 00 - 00 00 00 00 48 28 67
76 ..gvl.H(gv
0113fda4 01 00 00 00 fc ff 0f 01 - 43 00 3a 00 5c 00 57
00 ..C.:.\.W.
0113fdb4 49 00 4e 00 4e 00 54 00 - 5c 00 73 00 79 00 73
00 I.N.N.T.\.s.y.s.
0113fdc4 74 00 65 00 6d 00 33 00 - 32 00 5c 00 73 00 74
00 t.e.m.3.2.\.s.t.
0113fdd4 6f 00 62 00 6a 00 65 00 - 63 00 74 00 2e 00 64
00 o.b.j.e.c.td.
0113fde4 6c 00 6c 00 00 00 e7 77 - 1b 00 00 00 00 02 00
00 l.l.w..
0113fdf4 fc ff 13 01 23 00 00 00 - 00 00 00 00 00 00 00
00 .#..
0113fe04 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe14 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe24 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0113fe34 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x334
eax=77532bda ebx=00000002 ecx=00000000 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=011cff24 ebp=011cff70 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:01c59e0b=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
011CFF70 77E8ABFB 011CFF48 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
011CFFB4 77E7987C 00000000 00000009 0113F520 00000000
kernel32!WaitForMultipleObjects
011CFFEC 00000000 77532BDA 00000000 00000000 000000C8
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
011cff24 d7 bd e7 77 02 00 00 00 - 48 ff 1c 01 01 00 00
00 w.H.
011cff34 00 00 00 00 00 00 00 00 - 09 00 00 00 00 00 00
00 .
011cff44 00 00 00 00 60 03 00 00 - 68 03 00 00 80 21 73
85 .`h.!s.
011cff54 f0 54 06 80 14 04 00 00 - 00 00 00 00 98 dc 06
bd .T..
011cff64 00 00 00 00 00 00 00 00 - b0 dc 06 bd b4 ff 1c
01 .
011cff74 fb ab e8 77 48 ff 1c 01 - 01 00 00 00 00 00 00
00 wH..
011cff84 00 00 00 00 00 00 00 00 - 1a 2c 53 77 02 00 00
00 ,Sw.
011cff94 a4 ff 1c 01 00 00 00 00 - ff ff ff ff 20 f5 13
01
011cffa4 60 03 00 00 68 03 00 00 - 00 00 00 00 00 00 00
00 `h..
011cffb4 ec ff 1c 01 7c 98 e7 77 - 00 00 00 00 09 00 00
00 .|..w..
011cffc4 20 f5 13 01 00 00 00 00 - 00 f0 fa 7f 00 00 00
00
011cffd4 c0 ff 1c 01 00 00 00 00 - ff ff ff ff b4 f0 e8
77 w
011cffe4 60 d3 e7 77 00 00 00 00 - 00 00 00 00 00 00 00
00 `..w
011cfff4 da 2b 53 77 00 00 00 00 - 00 00 00 00 c8 00 00
00 .+Sw
011d0004 00 01 00 00 ff ee ff ee - 02 00 00 00 00 00 00
00 .
011d0014 00 fe 00 00 00 00 10 00 - 00 20 00 00 00 02 00
00
011d0024 00 20 00 00 b7 01 00 00 - ff ef fd 7f 0a 00 08
06 . ..
011d0034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
011d0044 98 05 1d 01 0f 00 00 00 - f8 ff ff ff 50 00 1d
01 P
011d0054 50 00 1d 01 40 06 1d 01 - 00 00 00 00 00 00 00
00 P@..
État de vidage Thread Id 0x360
eax=01350004 ebx=00000000 ecx=00000000 edx=00000000
esi=00080e10 edi=00000100
eip=784639c7 esp=0135fe28 ebp=0135ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:01de9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:01dd9eea=????????
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:01dd9eea=??
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:01de9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89fe6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:01dd9eeb=????
784639e2 668945e0 mov
[ebp+0xe0],ax ss:01de9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:01de9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0135FF74 770CD9DB 770CDDED 00080E10 00000000 00000000
ntdll!NtReplyWaitReceivePortEx
0135FFA8 770CDD0B 0007DAC8 0135FFEC 77E7987C 00091AF8
rpcrt4!RpcBindingSetOption
0135FFB4 77E7987C 00091AF8 00000000 00000000 00091AF8
rpcrt4!RpcBindingSetOption
0135FFEC 00000000 770CDCF3 00091AF8 00000000 000000C8
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
0135fe28 ac db 0c 77 1c 01 00 00 - 54 ff 35 01 00 00 00
00 w.T.5..
0135fe38 e0 5e 0a 00 58 ff 35 01 - 50 da 07 00 48 9c 07
00 .^..X.5.PH
0135fe48 34 91 46 78 00 00 00 00 - 00 00 00 00 00 00 00
00 4.Fx
0135fe58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe78 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fe98 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fea8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135feb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fec8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fed8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fee8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135fef8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135ff08 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
0135ff18 00 00 00 00 00 00 00 00 - 00 00 00 00 e4 44 e6
85 .D..
0135ff28 e3 ac 46 80 ff ff ff ff - 20 70 91 85 80 e9 71
85 ..F.. p.q.
0135ff38 00 00 00 00 ec e9 71 85 - 80 e9 71 85 10 eb 71
85 qqq.
0135ff48 21 c3 42 80 80 e9 71 85 - e0 ea 71 85 02 00 05
00 !.Bqq..
0135ff58 00 a2 2f 4d ff ff ff ff - 50 fe 35 01 00 00 02
80 ../M.P.5..
État de vidage Thread Id 0x434
eax=00000090 ebx=000493e0 ecx=78ee61a6 edx=00000000
esi=00080038 edi=000493e0
eip=7846beb2 esp=013afebc ebp=013afee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
fonction : NtRemoveIoCompletion
7846bea7 b8a8000000 mov eax,0xa8
7846beac 8d542404 lea edx,
[esp+0x4] ss:01e39da3=????????
7846beb0 cd2e int 2e
7846beb2 c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
013AFEE4 770C57C0 00000120 013AFF1C 013AFF0C 013AFF14
ntdll!NtRemoveIoCompletion
013AFF20 770E2899 000493E0 013AFF60 013AFF5C 013AFF70
rpcrt4!UuidFromStringA
013AFF74 770E2778 770CDD59 00080038 0113F3CA 7846C277
rpcrt4!I_RpcTransConnectionReallocPacket
013AFFA8 770CDD0B 000A11E0 013AFFEC 77E7987C 0009E6B8
rpcrt4!I_RpcTransConnectionReallocPacket
013AFFB4 77E7987C 0009E6B8 0113F3CA 7846C277 0009E6B8
rpcrt4!RpcBindingSetOption
013AFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x43c
eax=00000001 ebx=00000000 ecx=014e2bd8 edx=00000000
esi=00074098 edi=00000000
eip=77e03569 esp=013efee8 ebp=013eff2c iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01e79dcf=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
013EFF2C 76E0160E 000600B4 00000000 7846D04A 000A8538
user32!WaitMessage
013EFFB4 77E7987C 000A8538 00000000 7846D04A 000A8538
browseui!Ordinal102
013EFFEC 00000000 76E015D2 000A8538 00000000 65696C43
kernel32!SetThreadExecutionState
*-> Vidage brut de la pile <-*
013efee8 b2 17 e0 76 00 00 00 00 - 4a d0 46 78 38 85 0a
00 v.J.Fx8
013efef8 4a 00 1e 00 13 01 00 00 - 00 10 00 00 00 00 00
00 J
013eff08 95 95 04 00 bc 04 00 00 - 1f 00 00 00 00 00 00
00 .
013eff18 01 00 00 00 98 40 07 00 - 02 80 00 00 f0 db 0a
00 ..@.
013eff28 00 00 00 00 b4 ff 3e 01 - 0e 16 e0 76 b4 00 06
00 >.v.
013eff38 00 00 00 00 4a d0 46 78 - 38 85 0a 00 b0 91 71
85 .J.Fx8..q.
013eff48 21 c3 42 80 20 90 71 85 - 80 91 71 85 f0 54 06
80 !.B. .qq..T..
013eff58 78 9c 32 bd 78 9c 32 bd - 08 94 4d 80 01 00 00
00 x.2.x.2M..
013eff68 00 00 00 00 b0 9c 32 bd - 00 00 00 00 b0 91 71
85 2.q.
013eff78 05 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 .
013eff88 81 f9 42 80 00 00 00 00 - 00 00 00 00 31 fa 42
80 ..B1.B.
013eff98 20 70 91 85 38 ff 3e 01 - 01 01 00 00 dc ff 3e
01 p..8.>.>.
013effa8 72 73 e5 76 38 49 e0 76 - 00 00 00 00 ec ff 3e
01 rs.v8I.v>.
013effb8 7c 98 e7 77 38 85 0a 00 - 00 00 00 00 4a d0 46
78 |..w8.J.Fx
013effc8 38 85 0a 00 00 c0 fa 7f - 49 20 ed 78 c0 ff 3e
01 8.I .x..>.
013effd8 49 20 ed 78 ff ff ff ff - b4 f0 e8 77 60 d3 e7
77 I .x.w`..w
013effe8 00 00 00 00 00 00 00 00 - 00 00 00 00 d2 15 e0
76 v
013efff8 38 85 0a 00 00 00 00 00 - 43 6c 69 65 6e 74 20
55 8.Client U
013f0008 72 6c 43 61 63 68 65 20 - 4d 4d 46 20 56 65 72
20 rlCache MMF Ver
013f0018 35 2e 32 00 00 80 00 00 - 00 00 00 00 80 00 00
00 5.2.
État de vidage Thread Id 0x3f0
eax=000012b3 ebx=0191ff74 ecx=014f0f70 edx=00000000
esi=78474086 edi=00000470
eip=78474091 esp=0191ff58 ebp=0191ff7c iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:023a9e3f=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:00a8b199=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:01f7ae56=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0191FF7C 77E81B1B 00000470 000927C0 00000000 75B3B36D
ntdll!ZwWaitForSingleObject
78469134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A
kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
État de vidage Thread Id 0x3d8
eax=0199fd70 ebx=0195ff74 ecx=000de000 edx=00000000
esi=78474086 edi=00000478
eip=78474091 esp=0195ff58 ebp=0195ff7c iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
fonction : ZwWaitForSingleObject
78474086 b8ea000000 mov eax,0xea
7847408b 8d542404 lea edx,
[esp+0x4] ss:023e9e3f=????????
7847408f cd2e int 2e
78474091 c20c00 ret 0xc
78474094 8a5001 mov dl,
[eax+0x1] ds:02429c56=??
78474097 3a5101 cmp dl,
[ecx+0x1] ds:00b67ee6=??
7847409a 0f8598c7ffff jne
RtlEqualPrefixSid+0x44 (78470838)
784740a0 84d2 test dl,dl
784740a2 7410 jz
RtlQueryAtomInAtomTable+0x31 (78474fb4)
784740a4 0fb6d2 movzx edx,dl
784740a7 33ff xor edi,edi
784740a9 8d72ff lea esi,
[edx+0xff] ds:00a89ee6=????????
784740ac 85f6 test esi,esi
784740ae 0f8f04100100 jnle
RtlEraseUnicodeString+0x4e (784850b8)
784740b4 b001 mov al,0x1
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0195FF7C 77E81B1B 00000478 000927C0 00000000 75B3B36D
ntdll!ZwWaitForSingleObject
78469134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A
kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
État de vidage Thread Id 0x464
eax=c0000034 ebx=00000520 ecx=7846d7cc edx=00000000
esi=01eeff98 edi=77e05780
eip=77e02f5c esp=01eeff58 ebp=01eeff78 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : TranslateMessageEx
77e02f3a 0f8540d80200 jne
UnregisterHotKey+0xe89 (77e30780)
77e02f40 33c0 xor eax,eax
77e02f42 c20800 ret 0x8
77e02f45 ff742408 push dword ptr
[esp+0x8] ss:02979e3f=????????
77e02f49 51 push ecx
77e02f4a e8ce1e0000 call
GetKeyState+0x9b (77e04e1d)
77e02f4f ebf1 jmp
DrawStateA+0x6e6 (77e0e842)
77e02f51 b89a110000 mov eax,0x119a
77e02f56 8d542404 lea edx,
[esp+0x4] ss:02979e3f=????????
77e02f5a cd2e int 2e
77e02f5c c21000 ret 0x10
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01EEFF78 77545C36 01EEFF98 00000000 00000000 00000000
user32!TranslateMessageEx
01EEFFB4 77E7987C 00000520 77565428 013EDA18 00000520
winmm!midiOutGetNumDevs
01EEFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x378
eax=00006004 ebx=00000002 ecx=00071f38 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=02bafe5c ebp=02bafea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:03639d43=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
02BAFEA8 77E03990 02BAFE80 00000001 00000000 02BAFEA0
ntdll!NtWaitForMultipleObjects
02BAFF04 77E03A5C 02BAFED0 77CA4190 0000EA60 00000041
user32!MsgWaitForMultipleObjectsEx
02BAFF20 77C62973 00000001 77CA4190 00000000 0000EA60
user32!MsgWaitForMultipleObjects
02BAFF74 77C6744C 02BAFFA0 02BAFFA4 02BAFFA8 02BAFF9C
shlwapi!PathBuildRootW
02BAFFAC 77C673D4 00000012 77E7987C 00000000 00000000
shlwapi!Ordinal307
02BAFFEC 00000000 00000000 00000000 00000000 00000000
shlwapi!Ordinal307
État de vidage Thread Id 0x324
eax=ffffffff ebx=00000000 ecx=00000002 edx=006f0043
esi=00000001 edi=03b3e144
eip=77e7e38e esp=03b3e09c ebp=03b3e104 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : CompareStringW
77e7e370 8b7d18 mov edi,
[ebp+0x18] ss:045c7fea=????????
77e7e373 33db xor ebx,ebx
77e7e375 895508 mov
[ebp+0x8],edx ss:045c7fea=????????
77e7e378 3bd3 cmp edx,ebx
77e7e37a 897d1c mov
[ebp+0x1c],edi ss:045c7fea=????????
77e7e37d 0f84f54f0100 je
WriteProfileStringA+0x25 (77e93378)
77e7e383 3bfb cmp edi,ebx
77e7e385 0f84ed4f0100 je
WriteProfileStringA+0x25 (77e93378)
77e7e38b 6a02 push 0x2
77e7e38d 59 pop ecx
FAUTE ->77e7e38e 668b02 mov ax,
[edx] ds:006f0043=????
77e7e391 663b07 cmp ax,
[edi] ds:03b3e144=0047
77e7e394 0f84edb4ffff je
SetThreadExecutionState+0x232 (77e79887)
77e7e39a 668b02 mov ax,
[edx] ds:006f0043=????
77e7e39d 663b07 cmp ax,
[edi] ds:03b3e144=0047
77e7e3a0 0f8417cdffff je
GetStdHandle+0x1b0 (77e7b0bd)
77e7e3a6 8b4ddc mov ecx,
[ebp+0xdc] ss:045c7fea=????????
77e7e3a9 895dc8 mov
[ebp+0xc8],ebx ss:045c7fea=????????
77e7e3ac f7de neg esi
77e7e3ae 1bf6 sbb esi,esi
77e7e3b0 33c0 xor eax,eax
77e7e3b2 81e6000000e8 and esi,0xe8000000
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
03B3E104 77E8A1AA 006F0043 00000001 006F0043 FFFFFFFF
kernel32!CompareStringW
03B3E188 00670069 00720075 00720065 006C0020 00730065
kernel32!lstrcmpiW
0066006E 00000000 00000000 00000000 00000000 00000000
<nosymbols>
*-> Vidage brut de la pile <-*
03b3e09c 43 00 6f 00 2c 14 11 00 - 44 e1 b3 03 58 e2 b3
03 C.o.,DX
03b3e0ac 16 06 00 00 6c e2 b3 03 - 74 e2 b3 03 3a 3c ed
78 .lt:<.x
03b3e0bc 58 e2 b3 03 00 00 00 00 - 00 00 00 00 6c e3 b3
03 X..l
03b3e0cc b6 00 00 00 5c 00 52 00 - 45 00 47 00 49 00 53
00 .\.R.E.G.I.S.
03b3e0dc 54 00 52 00 00 33 07 00 - 4d 00 41 00 43 00 48
00 T.R..3..M.A.C.H.
03b3e0ec 49 00 4e 00 45 00 5c 00 - 2c 14 11 00 31 90 e7
77 I.N.E.\.,1..w
03b3e0fc 44 e1 b3 03 68 61 10 00 - 88 e1 b3 03 aa a1 e8
77 Dhaw
03b3e10c 43 00 6f 00 01 00 00 00 - 43 00 6f 00 ff ff ff
ff C.o..C.o..
03b3e11c 44 e1 b3 03 44 e1 b3 03 - 8d a1 e8 77 00 00 00
00 DDw.
03b3e12c 05 9a 5f 77 43 00 6f 00 - 44 e1 b3 03 60 e7 b3
03 .._wC.o.D`
03b3e13c 08 13 09 00 40 eb b3 03 - 47 00 65 00 73 00 74
00 .@G.e.s.t.
03b3e14c 69 00 6f 00 6e 00 6e 00 - 61 00 69 00 72 00 65
00 i.o.n.n.a.i.r.e.
03b3e15c 20 00 64 00 65 00 20 00 - 42 00 75 00 72 00 65
00 .d.e. .B.u.r.e.
03b3e16c 61 00 75 00 20 00 4e 00 - 56 00 49 00 44 00 49
00 a.u. .N.V.I.D.I.
03b3e17c 41 00 20 00 6e 00 56 00 - 43 00 6f 00 6e 00 66
00 A. .n.V.C.o.n.f.
03b3e18c 69 00 67 00 75 00 72 00 - 65 00 72 00 20 00 6c
00 i.g.u.r.e.r. .l.
03b3e19c 65 00 73 00 20 00 70 00 - 61 00 72 00 61 00 6d
00 e.s. .p.a.r.a.m.
03b3e1ac e8 00 74 00 72 00 65 00 - 73 00 20 00 64 00 75
00 ..t.r.e.s. .d.u.
03b3e1bc 20 00 67 00 65 00 73 00 - 74 00 69 00 6f 00 6e
00 .g.e.s.t.i.o.n.
03b3e1cc 6e 00 61 00 69 00 72 00 - 65 00 20 00 64 00 65
00 n.a.i.r.e. .d.e.
Une exception d'application s'est produite :
App : explorer.exe (pid=844)
Lorsque : 06/01/2004 @ 00:47:02.078
Numéro d'exception : c0000005 (violation d'accès)
*-> Informations système <-*
Nom ordinateur : INTEL-P-4-2-8
Nom utilisateur : Administrateur
Nombre de processeurs : 2
Type de processeur : x86 Family 15 Model 2
Stepping 9
Version Windows 2000 : 5.0
Numéro actuel : 2195
Service Pack : 4
Type actuel : Multiprocessor Free
Organisation enregistrée : Particulier
Propriétaire enregistré : DAVID Philippe
*-> Liste des tâches <-*
0 Idle.exe
8 System.exe
152 SMSS.exe
176 CSRSS.exe
196 WINLOGON.exe
224 SERVICES.exe
236 LSASS.exe
420 svchost.exe
448 spoolsv.exe
480 svchost.exe
512 nvsvc32.exe
540 regsvc.exe
576 mstask.exe
608 SMAgent.exe
640 WinMgmt.exe
664 svchost.exe
740 WinMgmt.exe
844 explorer.exe
928 SMax4PNP.exe
936 SMax4.exe
956 internat.exe
964 rundll32.exe
972 MaxBlast3.exe
1056 DRWTSN32.exe
0 _Total.exe
(00400000 - 0043E000)
(78460000 - 784E1000)
(78ED0000 - 78F32000)
(77E70000 - 77F34000)
(770C0000 - 77131000)
(77F40000 - 77F7C000)
(77E00000 - 77E65000)
(77C60000 - 77CAA000)
(77B40000 - 77BC9000)
(77880000 - 778A5000)
(23000000 - 23056000)
(77580000 - 777CF000)
(77A40000 - 77B37000)
(72C60000 - 72CE6000)
(779A0000 - 77A3B000)
(78000000 - 78045000)
(77840000 - 77880000)
(77090000 - 770B3000)
(78DB0000 - 78EC2000)
(76DE0000 - 76EA7000)
(793C0000 - 793D1000)
(78D20000 - 78D83000)
(76DC0000 - 76DD2000)
(76F70000 - 76F7F000)
(773B0000 - 773C5000)
(750F0000 - 7513F000)
(78FB0000 - 78FBF000)
(75140000 - 75146000)
(750D0000 - 750DF000)
(74FB0000 - 74FC4000)
(74FA0000 - 74FA8000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FD0000 - 74FD9000)
(750E0000 - 750EC000)
(75190000 - 751A5000)
(75150000 - 75188000)
(76EF0000 - 76F69000)
(76620000 - 76663000)
(00FF0000 - 011F4000)
(76670000 - 76688000)
(766E0000 - 766E8000)
(783C0000 - 78451000)
(76690000 - 76697000)
(77540000 - 77571000)
(77530000 - 77538000)
(773D0000 - 773D8000)
(773E0000 - 773F3000)
(766B0000 - 766B9000)
(6E350000 - 6E356000)
(75E00000 - 75E1A000)
(76EB0000 - 76EBC000)
(77F80000 - 77FF3000)
(77810000 - 77817000)
(75950000 - 75956000)
(75CF0000 - 75D72000)
(75A90000 - 75CD2000)
(76BD0000 - 76C45000)
(76D60000 - 76DB7000)
(75A60000 - 75A88000)
(656A0000 - 657B5000)
(6E3C0000 - 6E3CA000)
(6B200000 - 6B23C000)
(75CE0000 - 75CE6000)
(768E0000 - 7690B000)
(77410000 - 77489000)
(77400000 - 77410000)
(77910000 - 77933000)
(75D80000 - 75DF7000)
(64DD0000 - 64DEC000)
(10000000 - 10013000)
(022A0000 - 022DD000)
État de vidage Thread Id 0x348
eax=00000000 ebx=00000001 ecx=00000000 edx=00000000
esi=0008c788 edi=00000000
eip=77e03569 esp=0006ff00 ebp=0006ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:00af9de7=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FF1C 775AADBB 00000000 004084C4 0008C788 00000000
user32!WaitMessage
0006FF60 00408201 00000058 00000000 000205BE 00000001
shell32!Ordinal201
0006FFC0 77E787F5 00000000 00000000 7FFDF000 00000000
explorer!<nosymbols>
0006FFF0 00000000 00408188 00000000 000000C8 00000100
kernel32!DosDateTimeToFileTime
*-> Vidage brut de la pile <-*
0006ff00 41 ae 5a 77 94 55 e8 77 - 88 c7 08 00 01 00 00
00 A.Zw.U.w..
0006ff10 88 c7 08 00 88 c7 08 00 - 60 ff 06 00 60 ff 06
00 ..``
0006ff20 bb ad 5a 77 00 00 00 00 - c4 84 40 00 88 c7 08
00 ..Zw@..
0006ff30 00 00 00 00 be 05 02 00 - 00 f0 fd 7f 00 e0 fd
7f .
0006ff40 92 ab e8 77 00 00 00 00 - 0c 00 00 00 be 05 02
00 w
0006ff50 68 60 07 00 02 00 00 00 - 08 cf 00 00 e0 ff 06
00 h`..
0006ff60 c0 ff 06 00 01 82 40 00 - 58 00 00 00 00 00 00
00 @.X.
0006ff70 be 05 02 00 01 00 00 00 - 00 00 00 00 44 00 00
00 D
0006ff80 18 29 07 00 e0 42 07 00 - 68 60 07 00 00 00 00
00 .)B..h`
0006ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 98 e9 06
00 .
0006ffa0 28 9c 07 00 90 e9 06 00 - 01 00 00 00 01 00 00
00 (
0006ffb0 00 00 00 00 ff ff ff ff - ff ff ff ff ff ff ff
ff .
0006ffc0 f0 ff 06 00 f5 87 e7 77 - 00 00 00 00 00 00 00
00 .w..
0006ffd0 00 f0 fd 7f 00 00 00 00 - c8 ff 06 00 00 00 00
00 .
0006ffe0 ff ff ff ff b4 f0 e8 77 - c8 8e e7 77 00 00 00
00 .ww.
0006fff0 00 00 00 00 00 00 00 00 - 88 81 40 00 00 00 00
00 .@..
00070000 c8 00 00 00 00 01 00 00 - ff ee ff ee 02 00 00
00 .
00070010 00 00 00 00 00 fe 00 00 - 00 00 10 00 00 20 00
00 . ..
00070020 00 02 00 00 00 20 00 00 - e1 14 00 00 ff ef fd
7f .. .
00070030 01 00 08 06 00 00 00 00 - 00 00 00 00 00 00 00
00 .
État de vidage Thread Id 0x35c
eax=770cdcf3 ebx=00000000 ecx=00000001 edx=00000000
esi=00080c90 edi=00000000
eip=784639c7 esp=00d4fe28 ebp=00d4ff74 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : NtReplyWaitReceivePortEx
784639bc b8ac000000 mov eax,0xac
784639c1 8d542404 lea edx,
[esp+0x4] ss:017d9d0f=????????
784639c5 cd2e int 2e
784639c7 c21400 ret 0x14
784639ca 8b4710 mov eax,
[edi+0x10] ds:00a89ee6=????????
784639cd 8b483c mov ecx,
[eax+0x3c] ds:77b57bd9=458d77b4
784639d0 f6400801 test byte ptr
[eax+0x8],0x1 ds:77b57bd9=b4
784639d4 7502 jnz
RtlCreateProcessParameters+0xd (78463cd8)
784639d6 03c8 add ecx,eax
784639d8 894de4 mov
[ebp+0xe4],ecx ss:017d9e5a=????????
784639db 8b4710 mov eax,
[edi+0x10] ds:00a89ee6=????????
784639de 668b4038 mov ax,
[eax+0x38] ds:77b57bda=8d77
784639e2 668945e0 mov
[ebp+0xe0],ax ss:017d9e5b=????
784639e6 668945e2 mov
[ebp+0xe2],ax ss:017d9e5b=????
784639ea 53 push ebx
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D4FF74 770CD9DB 770CDD59 00080C90 40080784 00000070
ntdll!NtReplyWaitReceivePortEx
00D4FFA8 770CDD0B 0007FCA8 00D4FFEC 77E7987C 00080BD8
rpcrt4!RpcBindingSetOption
00D4FFB4 77E7987C 00080BD8 40080784 00000070 00080BD8
rpcrt4!RpcBindingSetOption
00D4FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x360
eax=77a7e915 ebx=00000102 ecx=00083820 edx=00000000
esi=78469153 edi=00d8ff74
eip=7846915e esp=00d8ff60 ebp=00d8ff7c iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
fonction : ZwDelayExecution
78469153 b832000000 mov eax,0x32
78469158 8d542404 lea edx,
[esp+0x4] ss:01819e47=????????
7846915c cd2e int 2e
7846915e c20800 ret 0x8
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D8FF7C 77E8AC79 0000EA60 00000000 77A50216 0000EA60
ntdll!ZwDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000
kernel32!Sleep
État de vidage Thread Id 0x364
eax=360101f9 ebx=0006fee8 ecx=008401d0 edx=00000000
esi=0006ff04 edi=00000000
eip=77e03569 esp=00dcff60 ebp=00dcff80 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : WaitMessage
77e0355e b836120000 mov eax,0x1236
77e03563 8d542404 lea edx,
[esp+0x4] ss:01859e47=????????
77e03567 cd2e int 2e
77e03569 c3 ret
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00DCFF80 0040A389 77C7CEA0 00400000 00076088 00076094
user32!WaitMessage
00DCFFB4 77E7987C 0006FEE8 00076088 00076094 0006FEE8
explorer!<nosymbols>
00DCFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!SetThreadExecutionState
État de vidage Thread Id 0x368
eax=00000000 ebx=00000007 ecx=77592228 edx=00000000
esi=78473233 edi=00000007
eip=7847323e esp=00e1fd98 ebp=00e1fde4 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
fonction : NtWaitForMultipleObjects
78473233 b8e9000000 mov eax,0xe9
78473238 8d542404 lea edx,
[esp+0x4] ss:018a9c7f=????????
7847323c cd2e int 2e
7847323e c21400 ret 0x14
*-> Parcours arrière de la pile <-*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00E1FDE4 77E03990 00E1FDBC 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00E1FE40 77E03A5C 00E1FE0C 00E1FEB8 FFFFFFFF 000000FF
user32!MsgWaitForMultipleObjectsEx
00E1FE5C 775A9390 00000006 00E1FEB8 00000000 FFFFFFFF
user32!MsgWaitForMultipleObjects
776A02B8 00000000 00000001 000002F4 000001C8 00000000
shell32!Ordinal200
État de vidage Thread Id 0x36c
eax=0245dfdc ebx=00000002 ecx=02290220 edx=00000000
esi=78473233 edi=00000002
eip=7847323e esp=00e5fe5c ebp=00e5fea8 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b
gs=
Poser une question
Quelqu'un qui a un modem va devoir attendre une minute(réellement) avant de
pouvoir lire ton message....
Si tu tiens vraiment à nous faire profiter de la copie de ton journal
d'erreur, copie le sur ton site perso et contente toi de mettre une lien
dans le message sur le newsgroup.
Accessoirement, tu peux aussi lire soigneusement les messages postés depuis
une semaine sur ce newsgroup avant d'envoyer ton message, ce qui t'évitera
un message satirique comme le mien ;-)
Je ne peux afficher le panneau de config, un message
d'erreur m'indique que explorer.exe a généré des erreurs
et sera fermer par windows.
Un journal des erreurs est créé.
Si quelqu'un connait ce problème, merci de m'informer
comment le résoudre.
Question en centeaines de lignes, réponse en 1 seule ligne :)
http://www.commentcamarche.net/foru...iguration-
plante