[zan2828]

Hello,

I am using Windows XP Professional SP3, and for the past few weeks explorer.exe has been crashing when I attempt to shutdown the system. Instead of displaying the shutdown dialog with the usual options, there is a momentary stall and explorer.exe crashes with an Application Error.

I have since checked the RAM with Memtest, reformatted the system, checked for spyware/malware, but the issue persists. Perhaps one of you will be able to help me in analyzing the minidump. The last three digits in the faulting address (530) are consistent across all the dumps, and the named faulting module, msgina.dll, is also consistent, which leads me to believe that this is not the result of faulty hardware.

Below is output of a recent minidump, generated by WinDbg.

 
0:001> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
+4d2c530
04d2c530 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 04d2c530
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 04d2c530
Attempt to read from address 04d2c530

DEFAULT_BUCKET_ID:  NULL_INSTRUCTION_PTR

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS:  04d2c530 

FAILED_INSTRUCTION_ADDRESS: 
+4d2c530
04d2c530 ??              ???

IP_ON_HEAP:  04d2c530

FAULTING_THREAD:  00000780

PRIMARY_PROBLEM_CLASS:  NULL_INSTRUCTION_PTR

BUGCHECK_STR:  APPLICATION_FAULT_NULL_INSTRUCTION_PTR

LAST_CONTROL_TRANSFER:  from 7599840c to 04d2c530

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0150fa74 7599840c 00000000 01aee468 0150fad0 0x4d2c530
0150fa90 75993a2f 00000002 010464f8 00000000 msgina!CDimmedWindow::Create+0x12
0150faa4 7ca78a05 0150fac0 0150fad0 010460f8 msgina!_ShellDimScreen+0x67
0150fcd8 7ca78cca 0001009c 00000002 0150fcfc shell32!CloseWindowsDialog+0x51
0150fce8 010341ff 0001009c 000001fa 010460f8 shell32!ExitWindowsDialog+0x2a
0150fcfc 01026668 0001009c 00000000 00000111 explorer!CTray::_DoExitWindows+0x86
0150fd30 0101c43e 000001fa 00000111 010460f8 explorer!CTray::_Command+0x2da
0150fde8 01001b5c 0003004e 00000111 000001fa explorer!CTray::v_WndProc+0x981
0150fe0c 7e418734 0003004e 00000111 000001fa explorer!CImpWndProc::s_WndProc+0x65
0150fe38 7e418816 01001b1d 0003004e 00000111 user32!InternalCallWinProc+0x28
0150fea0 7e4189cd 000a04d8 01001b1d 0003004e user32!UserCallWinProcCheckWow+0x150
0150ff00 7e418a10 0150ff28 00000000 0150ff44 user32!DispatchMessageWorker+0x306
0150ff10 01001a35 0150ff28 00000000 010460f8 user32!DispatchMessageW+0xf
0150ff44 0100ffd1 00000000 0150ffb4 77f76f42 explorer!CTray::_MessageLoop+0xd9
0150ff50 77f76f42 010460f8 0000005c 00000000 explorer!CTray::MainThreadProc+0x29
0150ffb4 7c80b713 00000000 0000005c 00000000 shlwapi!WrapperThreadProc+0x94
0150ffec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND:  ~1s; .ecxr ; kb

FOLLOWUP_IP: 
msgina!CDimmedWindow::Create+12
7599840c 8b3d78169775    mov     edi,dword ptr [msgina!_imp__GetSystemMetrics (75971678)]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  msgina!CDimmedWindow::Create+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msgina

IMAGE_NAME:  msgina.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4802a149

FAILURE_BUCKET_ID:  NULL_INSTRUCTION_PTR_c0000005_msgina.dll!CDimmedWindow::Create

BUCKET_ID:  APPLICATION_FAULT_NULL_INSTRUCTION_PTR_BAD_IP_msgina!CDimmedWindow::Create+12

Followup: MachineOwner
---------
 

I would be very grateful for any assistance you may be able to provide. Thank you.

P.S. How do I post a non-scrolling codebox?

This post has been edited by zan2828: 03 June 2008 - 05:36 AM

[Mordac85]

zan2828, on Jun 3 2008, 07:33 AM, said:

FAILURE_BUCKET_ID: NULL_INSTRUCTION_PTR_c0000005_msgina.dll!CDimmedWindow::Create

I'm not very familiar with debugging Windows, but this makes me think you have a problem with the dialog library msgina.dll. Did you install any kind of VPN software that may have replaced this dll or be causing your issue?

[cluberti]

No, that's incorrect. Whatever was loaded at 0x4d2c530 is the culprit. But because this is a minidump, and because symbols aren't configured, !analyze -v is guessing.

Need an actual .dmp file - can it be uploaded somewhere?

[zan2828]

Yes I will upload a dump.

Attached File(s)

•  user.rar (17.22K)
  Number of downloads: 8

[cluberti]

Yes, this is the culprit thread:

#  1  Id: 76c.784 Suspend: -1 Teb: 7ffdb000 Unfrozen
ChildEBP RetAddr  Args to Child			  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0150fa74 7599840c 00000000 039764d0 0150fad0 0x4a3c530
0150fa90 75993a2f 00000002 010464f8 00000000 msgina!CDimmedWindow::Create+0x12
0150faa4 7ca78a05 0150fac0 0150fad0 010460f8 msgina!_ShellDimScreen+0x67
0150fcd8 7ca78cca 0001009c 00000002 0150fcfc shell32!CloseWindowsDialog+0x51
0150fce8 010341ff 0001009c 000001fa 010460f8 shell32!ExitWindowsDialog+0x2a
0150fcfc 01026668 0001009c 00000000 00000111 explorer!CTray::_DoExitWindows+0x86
0150fd30 0101c43e 000001fa 00000111 010460f8 explorer!CTray::_Command+0x2da
0150fde8 01001b5c 00030048 00000111 000001fa explorer!CTray::v_WndProc+0x981
0150fe0c 7e418734 00030048 00000111 000001fa explorer!CImpWndProc::s_WndProc+0x65
0150fe38 7e418816 01001b1d 00030048 00000111 user32!InternalCallWinProc+0x28
0150fea0 7e4189cd 000a04d8 01001b1d 00030048 user32!UserCallWinProcCheckWow+0x150
0150ff00 7e418a10 0150ff28 00000000 0150ff44 user32!DispatchMessageWorker+0x306
0150ff10 01001a35 0150ff28 00000000 010460f8 user32!DispatchMessageW+0xf
0150ff44 0100ffd1 00000000 0150ffb4 77f76f42 explorer!CTray::_MessageLoop+0xd9
0150ff50 77f76f42 010460f8 0000005c 00000000 explorer!CTray::MainThreadProc+0x29
0150ffb4 7c80b713 00000000 0000005c 00000000 shlwapi!WrapperThreadProc+0x94
0150ffec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37

However, there's literally nothing at all even close to loaded in that memory range, and it also looks like msgina is doing a debugger check:

0:001> ub 7599840c 
msgina!CDimmedWindow::Create+0x3:
759983fd 8bec			mov	 ebp,esp
759983ff 51			  push	ecx
75998400 51			  push	ecx
75998401 53			  push	ebx
75998402 56			  push	esi
75998403 57			  push	edi
75998404 8bf1			mov	 esi,ecx
75998406 ff1528139775	call	dword ptr [msgina!_imp__IsDebuggerPresent (75971328)]

0:001> u 75971328
msgina!_imp__IsDebuggerPresent:
75971328 2331			and	 esi,dword ptr [ecx]
7597132a 817cc4a8827c0031 cmp	 dword ptr [esp+eax*8-58h],31007C82h
75971332 817c6eac807ce605 cmp	 dword ptr [esi+ebp*2-54h],5E67C80h
7597133a 837cdbae80	  cmp	 dword ptr [ebx+ebx*8-52h],0FFFFFF80h
7597133f 7cd4			jl	  msgina!_imp__EnterCriticalSection+0x1 (75971315)
75971341 25837c64a1	  and	 eax,0A1647C83h
75971346 807c8ede80	  cmp	 byte ptr [esi+ecx*4-22h],80h
7597134b 7ccb			jl	  msgina!_imp__LeaveCriticalSection (75971318)

Here's a thought - if you disable DEP entirely (add /noexecute=alwaysoff in your boot.ini), does the problem go away?

[zan2828]

I haven't tried disabling DEP entirely or via the boot.ini method, but I have disabled it for explorer through the system properties menu.

Now, instead of getting DEP error messages I just get a generic Application Error messsage upon explorer crashing.

However, my antivirus caught something new (a variant of Win32/Injector.AU) with yesterday's definition update, so this problem MAY be due to an infiltration that was lurking around undetected. A Microsoft employee on a Windbg Google Group browsing the minidump output believes it is a virus too.

I haven't crashed since then. I'll keep you posted.

Here is the link to the other discussion, BTW.

http://groups.google.com/group/microsoft.p...b941315d717753c

This post has been edited by zan2828: 05 June 2008 - 11:28 AM

[cluberti]

I agree with that person as well, and that's why I asked you to disable DEP - it can mask virus issues .

[zan2828]

Crashed again, here is another dump file.

I will try the boot.ini edit like you suggested.

Also, is there a process where I can make more meaningful dumps? Just now, I set Dr Watson to generate full instead of mini dumps, and I noticed that the application errors were tagged with <nosymbols>. Where can I get appropriate symbols?

Attached File(s)

•  user.rar (16.82K)
  Number of downloads: 1

This post has been edited by zan2828: 05 June 2008 - 11:13 PM

[cluberti]

zan2828, on Jun 5 2008, 11:48 PM, said:

Where can I get appropriate symbols?

You need to set the symbol path - I prefer the _NT_SYMBOL_PATH System environment variable for this, and set it to SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols.

As to the dump, it's the same (different address, but same result - nothing there at all). Please disable DEP via boot.ini before posting any more dumps.

[zan2828]

It crashed again, this time with DEP turned off. The dump is exactly the same as last time.

Im really at a loss as to what is going on. As I mentioned in first post, formatting the system did nothing to fix the problem.

I am going to attach the relevant portion of the Dr. Watson log, if it helps any. I also was able to make another log by following these instructions: http://www.msfn.org/...mps-t90244.html

Again thank you for your efforts.

Attached File(s)

•  log.txt (73.84K)
  Number of downloads: 3
•  PID_1840__EXPLORER.EXE__Date_06_06_2008__Time_18_41_17PM.rar (4.33K)
  Number of downloads: 1
•  user.rar (17.09K)
  Number of downloads: 0

This post has been edited by zan2828: 07 June 2008 - 01:43 AM

[zan2828]

ADplus 1st and 2nd chance memory dump Windbg output:

 
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
+0
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000adc

DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

PRIMARY_PROBLEM_CLASS:  STATUS_BREAKPOINT

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

LAST_CONTROL_TRANSFER:  from 7c90da8c to 7c90e4f4

STACK_TEXT:  
01a8fe14 7c90da8c 77e765e3 000001b0 01a8ff74 ntdll!KiFastSystemCallRet
01a8fe18 77e765e3 000001b0 01a8ff74 00000000 ntdll!ZwReplyWaitReceivePortEx+0xc
01a8ff80 77e76caf 01a8ffa8 77e76ad1 000ba6b0 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+0x12a
01a8ff88 77e76ad1 000ba6b0 0145f9bc 020a7f88 rpcrt4!RecvLotsaCallsWrapper+0xd
01a8ffa8 77e76c97 000ba568 01a8ffec 7c80b713 rpcrt4!BaseCachedThreadRoutine+0x79
01a8ffb4 7c80b713 020c12e0 0145f9bc 020a7f88 rpcrt4!ThreadStartRoutine+0x1a
01a8ffec 00000000 77e76c7d 020c12e0 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND:  ~0s; .ecxr ; kb

FOLLOWUP_IP: 
rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+12a
77e765e3 8b7df4          mov     edi,dword ptr [ebp-0Ch]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+12a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: rpcrt4

IMAGE_NAME:  rpcrt4.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4802a106

FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_rpcrt4.dll!LRPC_ADDRESS::ReceiveLotsaCalls

BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+12a

Followup: MachineOwner
---------
 

 
0:001> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
+3e6c530
03e6c530 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 03e6c530
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 03e6c530
Attempt to read from address 03e6c530

DEFAULT_BUCKET_ID:  NULL_INSTRUCTION_PTR

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS:  03e6c530 

FAILED_INSTRUCTION_ADDRESS: 
+3e6c530
03e6c530 ??              ???

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

IP_ON_HEAP:  03e6c530

IP_IN_FREE_BLOCK: 3e6c530

FAULTING_THREAD:  00000748

PRIMARY_PROBLEM_CLASS:  NULL_INSTRUCTION_PTR

BUGCHECK_STR:  APPLICATION_FAULT_NULL_INSTRUCTION_PTR

LAST_CONTROL_TRANSFER:  from 7599840c to 03e6c530

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0149fa74 7599840c 00000000 02e6acb0 0149fad0 0x3e6c530
0149fa90 75993a2f 00000002 010464f8 00000000 msgina!CDimmedWindow::Create+0x12
0149faa4 7ca78a05 0149fac0 0149fad0 010460f8 msgina!_ShellDimScreen+0x67
0149fcd8 7ca78cca 0001009c 00000002 0149fcfc shell32!CloseWindowsDialog+0x51
0149fce8 010341ff 0001009c 000001fa 010460f8 shell32!ExitWindowsDialog+0x2a
0149fcfc 01026668 0001009c 00000000 00000111 explorer!CTray::_DoExitWindows+0x86
0149fd30 0101c43e 000001fa 00000111 010460f8 explorer!CTray::_Command+0x2da
0149fde8 01001b5c 00040038 00000111 000001fa explorer!CTray::v_WndProc+0x981
0149fe0c 7e418734 00040038 00000111 000001fa explorer!CImpWndProc::s_WndProc+0x65
0149fe38 7e418816 01001b1d 00040038 00000111 user32!InternalCallWinProc+0x28
0149fea0 7e4189cd 000a04a0 01001b1d 00040038 user32!UserCallWinProcCheckWow+0x150
0149ff00 7e418a10 0149ff28 00000000 0149ff44 user32!DispatchMessageWorker+0x306
0149ff10 01001a35 0149ff28 00000000 010460f8 user32!DispatchMessageW+0xf
0149ff44 0100ffd1 00000000 0149ffb4 77f76f42 explorer!CTray::_MessageLoop+0xd9
0149ff50 77f76f42 010460f8 0000005c 00000000 explorer!CTray::MainThreadProc+0x29
0149ffb4 7c80b713 00000000 0000005c 00000000 shlwapi!WrapperThreadProc+0x94
0149ffec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND:  ~1s; .ecxr ; kb

FOLLOWUP_IP: 
msgina!CDimmedWindow::Create+12
7599840c 8b3d78169775    mov     edi,dword ptr [msgina!_imp__GetSystemMetrics (75971678)]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  msgina!CDimmedWindow::Create+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msgina

IMAGE_NAME:  msgina.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4802a149

FAILURE_BUCKET_ID:  NULL_INSTRUCTION_PTR_c0000005_msgina.dll!CDimmedWindow::Create

BUCKET_ID:  APPLICATION_FAULT_NULL_INSTRUCTION_PTR_BAD_IP_msgina!CDimmedWindow::Create+12

Followup: MachineOwner
--------- 

Here are dumps.

http://rapidshare.com/files/120695269/Cras...1-17PM.rar.html

This post has been edited by zan2828: 07 June 2008 - 02:57 AM

[Mr Snrub]

You have a hooked "IsDebuggerPresent" function...

Stack trace of crashing thread:

0:001> kv
ChildEBP RetAddr  Args to Child			  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0149fa74 7599840c 00000000 02e6acb0 0149fad0 0x3e6c530
0149fa90 75993a2f 00000002 010464f8 00000000 msgina!CDimmedWindow::Create+0x12 (FPO: [Non-Fpo])
0149faa4 7ca78a05 0149fac0 0149fad0 010460f8 msgina!_ShellDimScreen+0x67 (FPO: [Non-Fpo])
0149fcd8 7ca78cca 0001009c 00000002 0149fcfc shell32!CloseWindowsDialog+0x51 (FPO: [Non-Fpo])
0149fce8 010341ff 0001009c 000001fa 010460f8 shell32!ExitWindowsDialog+0x2a (FPO: [Non-Fpo])
0149fcfc 01026668 0001009c 00000000 00000111 explorer!CTray::_DoExitWindows+0x86 (FPO: [Non-Fpo])
0149fd30 0101c43e 000001fa 00000111 010460f8 explorer!CTray::_Command+0x2da (FPO: [Non-Fpo])
0149fde8 01001b5c 00040038 00000111 000001fa explorer!CTray::v_WndProc+0x981 (FPO: [Non-Fpo])
0149fe0c 7e418734 00040038 00000111 000001fa explorer!CImpWndProc::s_WndProc+0x65 (FPO: [Non-Fpo])
0149fe38 7e418816 01001b1d 00040038 00000111 user32!InternalCallWinProc+0x28
0149fea0 7e4189cd 000a04a0 01001b1d 00040038 user32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
0149ff00 7e418a10 0149ff28 00000000 0149ff44 user32!DispatchMessageWorker+0x306 (FPO: [Non-Fpo])
0149ff10 01001a35 0149ff28 00000000 010460f8 user32!DispatchMessageW+0xf (FPO: [Non-Fpo])
0149ff44 0100ffd1 00000000 0149ffb4 77f76f42 explorer!CTray::_MessageLoop+0xd9 (FPO: [Non-Fpo])
0149ff50 77f76f42 010460f8 0000005c 00000000 explorer!CTray::MainThreadProc+0x29 (FPO: [Non-Fpo])
0149ffb4 7c80b713 00000000 0000005c 00000000 shlwapi!WrapperThreadProc+0x94 (FPO: [Non-Fpo])
0149ffec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])

Top address is bogus, does not exist (hence the crash):

0:001> dd 0x3e6c530
03e6c530  ???????? ???????? ???????? ????????
03e6c540  ???????? ???????? ???????? ????????
03e6c550  ???????? ???????? ???????? ????????
03e6c560  ???????? ???????? ???????? ????????
03e6c570  ???????? ???????? ???????? ????????
03e6c580  ???????? ???????? ???????? ????????
03e6c590  ???????? ???????? ???????? ????????
03e6c5a0  ???????? ???????? ???????? ????????

Going back 1 frame in the stack, let's unassemble the caller:

0:001> u msgina!CDimmedWindow::Create msgina!CDimmedWindow::Create+0x12
msgina!CDimmedWindow::Create:
759983fa 8bff			mov	 edi,edi
759983fc 55			  push	ebp
759983fd 8bec			mov	 ebp,esp
759983ff 51			  push	ecx
75998400 51			  push	ecx
75998401 53			  push	ebx
75998402 56			  push	esi
75998403 57			  push	edi
75998404 8bf1			mov	 esi,ecx
75998406 ff1528139775	call	dword ptr [msgina!_imp__IsDebuggerPresent (75971328)]

IsDebuggerPresent is the function being called, and it is imported, so let's see where it goes:

0:001> dds msgina!_imp__IsDebuggerPresent
75971328  7c813123 kernel32!IsDebuggerPresent

Now let's unassemble the function in kernel32...

0:001> u kernel32!IsDebuggerPresent
kernel32!IsDebuggerPresent:
7c813123 e908946587	  jmp	 03e6c530
7c813128 cc			  int	 3
7c813129 8b4030		  mov	 eax,dword ptr [eax+30h]
7c81312c 0fb64002		movzx   eax,byte ptr [eax+2]
7c813130 c3			  ret
7c813131 90			  nop
7c813132 90			  nop
7c813133 90			  nop

The jmp instruction is the hook, and the address (0x03e6c530) is why we go boom.

We can verify the memory-resident version of the kernel32.dll module with the copy on disk (provided courtesy of the symbols server):

0:001> !chkimg -d kernel32.dll
	7c813123-7c813128  6 bytes - kernel32!IsDebuggerPresent
	[ 64 a1 18 00 00 00:e9 08 94 65 87 cc ]
6 errors : kernel32.dll (7c813123-7c813128)

So 6 bytes in kernel32.dll have been modified by something, and there is the next question - what's hooking that OS function?

Checked the other loaded modules (this only works for those we have symbols for, so genuine Microsoft Windows modules):

0:001> !for_each_module !chkimg @#ModuleName
8 errors : uxtheme (5ad8a69c-5ad8a6a3)
10 errors : user32 (7e42384e-7e4595c1)
6 errors : kernel32 (7c813123-7c813128)

The uxtheme.dll hack I guess is the "allow use of unsigned themes" 3rd party crack:

0:001> !chkimg -d uxtheme.dll
	5ad8a69c-5ad8a6a3  8 bytes - uxtheme!CThemeSignature::Verify+5
	[ 81 ec 88 00 00 00 a1 18:33 f6 8b c6 c9 c2 08 00 ]
8 errors : uxtheme.dll (5ad8a69c-5ad8a6a3)

0:001> u 5ad8a69c 5ad8a6a3
uxtheme!CThemeSignature::Verify+0x5:
5ad8a69c 33f6			xor	 esi,esi
5ad8a69e 8bc6			mov	 eax,esi
5ad8a6a0 c9			  leave
5ad8a6a1 c20800		  ret	 8

The user32.dll hack looks like more hooking, and possibly to the same not-present module as the IsDebuggerPresent hook:

0:001> !chkimg -d user32.dll
	7e42384e-7e423852  5 bytes - user32!ChangeDisplaySettingsExA
	[ 8b ff 55 8b ec:e9 dd e6 a4 85 ]
	7e4595bd-7e4595c1  5 bytes - user32!ChangeDisplaySettingsExW (+0x35d6f)
	[ 8b ff 55 8b ec:e9 9e 89 a1 85 ]
10 errors : user32.dll (7e42384e-7e4595c1)

0:001> u 7e42384e 7e423852
user32!ChangeDisplaySettingsExA:
7e42384e e9dde6a485	  jmp	 03e71f30

0:001> u 7e4595bd 7e4595c1
user32!ChangeDisplaySettingsExW:
7e4595bd e99e89a185	  jmp	 03e71f60

So 3 Microsoft modules are modified from their original content - are the binaries on disk hacked, or is there something memory resident which is hooking them at load time?

Other than uxtheme.dll, have you replaced any DLLs manually?
Does the crash occur in Safe Mode?

I would recommend running RootkitRevealer and doing a full virus scan if you can't think of any software you have installed which might be hooking the functions for checking for an attached debugger (sometimes used by game cracks to prevent copy protection from detecting a debugger is attached when reverse-engineering, or by emulation software) and also the one for changing the display settings (which seems like a very odd function to hook).

http://technet.microsoft.com/en-us/sysinte...s/bb897445.aspx

[Mr Snrub]

Also, could you open a command prompt and enter the following commands, then copy the contents of t.txt and paste here:

cd \
dir asfsipc.dll /s > t.txt

(After pasting you can delete t.txt)

This module is dated 1999, so pre-dates XP, I am interested to know where it is located in case it was installed by a 3rd party program.

[zan2828]

As you requested:

Volume in drive C is Stuff
Volume Serial Number is E8A6-DB4E

Directory of C:\WINDOWS\system32

12/20/1999 01:16 PM 15,360 asfsipc.dll
1 File(s) 15,360 bytes

Total Files Listed:
1 File(s) 15,360 bytes
0 Dir(s) 50,379,988,992 bytes free



uxtheme.dll is the only system dll I have replaced, and I can confirm that the crashes existed prior to my replacing it. I have two other systems with modified uxtheme.dll and the problem does not occur.

As for game emulation or cracks, I dont have anything of the sort installed. I'll try out your suggestions. Thank you so much though for narrowing it down.

Just wondering: from which dump were you able to extract all this information?

This post has been edited by zan2828: 07 June 2008 - 02:25 PM

[Mr Snrub]

All that information came from the second chance dump from explorer.exe.
The location of the DLL doesn't give much away - anything could have installed it to system32 (I was interested to see if it happened to be under %ProgramFiles%).

I was half expecting something like a no-cd stub exe for something, or emulation software like Daemon Tools which install kernel drivers which we wouldn't see a trace of in a user-mode dump...

Let us know if Rootkit Revealer turns up anything - if it says everything looks clean then we may need a kernel dump to see if there are any hooks in there too.

[zan2828]

HKLM\SECURITY\Policy\Secrets\SAC* 5/28/2008 7:34 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 5/28/2008 7:34 PM 0 bytes Key name contains embedded nulls (*)
C:\Documents and Settings\Billy Lau\Local Settings\Application Data\Mozilla\Firefox\Profiles\g34fzsyr.default\Cache\C6935067d01 6/7/2008 8:09 PM 50.26 KB Hidden from Windows API.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 6/7/2008 8:05 PM 64.00 KB Visible in Windows API, but not in MFT or directory index.

output of rootkit scan. does anything look suspicious?

[Mr Snrub]

Looks okay to me - first 2 are a couple of seed/secret related keys, last one is the log file used by Windows Update.
Not sure why something in a Firefox profile would be hidden from the Windows API, but hopefully nothing executable cached in there anyway.

Time to take a complete memory dump so we can take a look in the kernel:
http://www.msfn.org/...mps-t90244.html

If you zip up the MEMORY.DMP file produced manually, plus your copies of KERNEL32.DLL and USER32.DLL we should be able to see if the binaries on disk have been modified or if something in memory is hooking them at load time.

[cluberti]

Amen. Took the weekend off, and look what happens .

[zan2828]

I seemed to have finally solved the problem, although it may just be hiding itself momentarily, like problems seem to do.

I re-installed my Nvidia drivers to fix a completely unrelated problem, and explorer.exe has not crashed on shutdown for two days now. This goes perfectly with what you mentioned about the display setting function being hooked by something.

In addition, the error messages that appear in the event viewer are nearly identical to the ones mentioned in this thread: http://forums.nvidia...php?t61227.html

If I do not post back, it means that my problem has indeed been fixed. Thank you all very much for your help.

[zan2828]

Well I'm back because the problem is back.

I have the complete system dump and 2 dll's ready, problem is finding a suitable place to upload this beast of a file (rar is 1.3 gig). Any suggestions?