dream.reckless, анализ в WinDbg выдает:
Код:
!analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify timestamp for mshtml.dll
*** WARNING: Unable to verify timestamp for EngineYarmap2.dll
*** ERROR: Module load completed but symbols could not be loaded for EngineYarmap2.dll
*** WARNING: Unable to verify timestamp for YarMap2.exe
*** ERROR: Module load completed but symbols could not be loaded for YarMap2.exe
Unable to load image C:\Program Files\Yarmap2\Microsoft.VC90.MFC\mfc90.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfc90.dll
*** ERROR: Module load completed but symbols could not be loaded for mfc90.dll
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/YarMap2_exe/1_0_0_205/Mxicd_dll/2_10_114_0/00034f22.htm?Retriage=1
FAULTING_IP:
Mxicd+34f22
69534f22 8851ff mov byte ptr [ecx-1],dl
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 69534f22 (Mxicd+0x00034f22)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 12004020
Attempt to write to address 12004020
DEFAULT_BUCKET_ID: INVALID_POINTER_WRITE
PROCESS_NAME: YarMap2.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 12004020
WRITE_ADDRESS: 12004020
FOLLOWUP_IP:
Mxicd+34f22
69534f22 8851ff mov byte ptr [ecx-1],dl
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
FAULTING_THREAD: 000004e0
PRIMARY_PROBLEM_CLASS: INVALID_POINTER_WRITE
BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_WRITE
IP_ON_STACK:
+2502faf0184df58
0012ca94 0819 or byte ptr [ecx],bl
FRAME_ONE_INVALID: 1
LAST_CONTROL_TRANSFER: from 0012ca94 to 69534f22
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
0012ca00 0012ca94 69538bdd 4b4000eb 12004020 Mxicd+0x34f22
0012ca04 69538bdd 4b4000eb 12004020 1277c360 0x12ca94
0012ca94 00000000 00000000 00000000 00004000 Mxicd+0x38bdd
STACK_COMMAND: ~0s; .ecxr ; kb
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Mxicd+34f22
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Mxicd
IMAGE_NAME: Mxicd.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 3e2e39d9
FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_Mxicd.dll!Unknown
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_WRITE_Mxicd+34f22
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/YarMap2_exe/1_0_0_205/4ec9e021/Mxicd_dll/2_10_114_0/3e2e39d9/c0000005/00034f22.htm?Retriage=1
Followup: MachineOwner
---------
Сбой на Mxicd.dll - я ведь вам говорил об этой библиотеке (поиск подсказывает, что она относится к драйверу S3 Savage).
