cluberti

You don't necessarily want to do that for any zone other than the required zone(s), and I'm guessing that's 1 (Local Intranet) and 2 (Trusted Sites). There's discussion about which zone is which, and what almost all of those values mean, in KB182569.

Radiohead - Videotape

Yes, in a nutshell, that is how it works.

This script seems to work fine on my Win7 VMs - it ended up being a bit more complex than I would have liked, but it needed to handle scenarios where WMI didn't work or no paging file existed on the system.

Description: VBscript to modify or delete the paging file from a Windows system via WMI or direct registry edit. Programming Language: VBScript Usage: Remove the .txt extension from the attached file, and either run from cscript or double-click the .vbs. '// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ '// '// NAME: setpagefile.vbs '// '// Original: http://www.cluberti.com/blog '// Last Update: 16th June 2010 '// '// Comment: VBS example file for use in configuring the paging file on Windows '// '// NOTE: Provided as-is - usage of this source assumes that you are at the '// very least familiar with the vbscript language being used and '// the tools used to create and debug this file. '// '// In other words, if you break it, you get to keep the pieces. '// '// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Option Explicit Dim strComputer, strPageFileSizeInput, strPageFileNameInput, strInput Dim objWMIService, objStaticPageFileItem, objDynamicPageFileItem, objShellApp Dim colStaticPageFileItems, colDynamicPageFileItems, isRunning, execOutput, gErrData, bRebootNeeded, bNoStaticPageFile, bNoPageFile '// Ensure that cscript is the engine used to run this script: RunMeWithCScript() On Error Resume Next '// Configure our variables: strComputer = "." bRebootNeeded = False bNoStaticPageFile = True bNoPageFile = True Set objShellApp = CreateObject("WScript.Shell") Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") '// Win32_PageFile is deprecated - it still (mostly) works, but Win32_PageFileSetting is not deprecated, so use that: Set colStaticPageFileItems = objWMIService.ExecQuery("SELECT * FROM Win32_PageFileSetting",,48) Set colDynamicPageFileItems = objWMIService.ExecQuery("SELECT * FROM Win32_PageFileUsage",,48) '// Execute the ChangePagingFile sub: ChangePagingFile() '// Check execution of ChangePagingFile(), and handle when "system managed" is set, or no paging file exists: If bRebootNeeded = True Then RebootSystem() Else '// Can't use WMI to create a paging file when it is "system managed" or none exists - handle this condition: If bNoStaticPageFile = True Then CheckForDynamicPagingFile() If bNoPageFile = False Then WScript.Quit Else If bNoPageFile = True Then WScript.Echo "No paging file found." WScript.Echo "" strPageFileNameInput = UserInput("Enter new pagefile name (full path and filename) - leave blank to use C:\pagefile.sys: ") strPageFileSizeInput = UserInput("Enter new pagefile size (in MB) - leave blank to keep the system with no paging file: ") '// Check to see if the user left the input blank, otherwise set up a paging file: If Not strPageFileSizeInput = "" Then If strPageFileNameInput = "" Then strPageFileNameInput = "C:\pagefile.sys" End If WScript.Echo "New pagefile file will be: " & strPageFileNameInput WScript.Echo "New pagefile size will be: " & strPageFileSizeInput & "MB" bNoStaticPageFile = False '// Change the registry to add paging file information: objShellApp.Exec("reg add ""HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"" /v PagingFiles /t REG_MULTI_SZ /d """ & strPageFileNameInput & " " & strPageFileSizeInput & " " & strPageFileSizeInput & """ /f") '// Check the return to make sure we succeeded - otherwise, tell the user why we didn't: If Not Err.Number = 0 Then gErrData = gErrData & vbCrLf & "Error writing to registry - reason: " & Err.Number & " - " & Err.Description WScript.Echo gErrData Err.Clear Else WScript.Echo "Registry edit to add " & strPageFileNameInput & " as size " & strPageFileSizeInput & "MB was successful." bRebootNeeded = True End If '// If we've made changes that have succeeded, we need to reboot - otherwise, do nothing: If bRebootNeeded = True Then RebootSystem() Else WScript.Echo "No changes made that require a reboot. Exiting script." End If Else WScript.Echo "You have elected to continue with no paging file. Exiting script." End If Else WScript.Echo "No changes made that require a reboot. Exiting script." End If End If End If End If Sub ChangePagingFile() For Each objStaticPageFileItem In colStaticPageFileItems '// There's a static paging file - use WMI to make changes: bNoStaticPageFile = False bNoPageFile = False WScript.Echo " --------------------------" WScript.Echo " Current PageFile Details" WScript.Echo " --------------------------" WScript.Echo "Name: " & objStaticPageFileItem.Name WScript.Echo "InitialSize: " & objStaticPageFileItem.InitialSize WScript.Echo "MaximumSize: " & objStaticPageFileItem.MaximumSize WScript.Echo "" '// Get user input: strInput = UserInput("Enter new pagefile size (in MB) - leave blank to delete existing paging file: ") '// If the user entered a value, configure the new paging file size: If Not strInput = "" Then WScript.Echo "New pagefile size will be: " & strInput & "MB" WScript.Echo "" objStaticPageFileItem.InitialSize = strInput objStaticPageFileItem.MaximumSize = strInput objStaticPageFileItem.Put_ bRebootNeeded = True WScript.Echo " --------------------------" WScript.Echo " New PageFile Details" WScript.Echo " --------------------------" WScript.Echo "Name: " & objStaticPageFileItem.Name WScript.Echo "InitialSize: " & objStaticPageFileItem.InitialSize WScript.Echo "MaximumSize: " & objStaticPageFileItem.MaximumSize WScript.Echo "" WScript.Echo "A reboot is needed for this change to take effect." '// If the user left the input blank, delete the paging file - note that Delete and DeleteEx from Win32_PagingFile are deprecated, and '// while they'll return 0 on Windows 7, they don't actually delete the paging file. Using reg add instead, as it works just fine: Else WScript.Echo "Deleting paging file: " & objStaticPageFileItem.Name objShellApp.Exec("reg add ""HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"" /v PagingFiles /t REG_MULTI_SZ /d """" /f") '// Check the return to make sure we succeeded - otherwise, tell the user why we didn't: If Not Err.Number = 0 Then gErrData = gErrData & vbCrLf & "Error writing to registry - reason: " & Err.Number & " - " & Err.Description WScript.Echo gErrData Err.Clear Else WScript.Echo "Registry edit to remove " & objStaticPageFileItem.Name & " was successful." bRebootNeeded = True End If End If Next End Sub Sub CheckForDynamicPagingFile() For Each objDynamicPageFileItem In colDynamicPageFileItems '// There's a paging file - use WMI to make changes: bNoPageFile = False WScript.Echo "Paging file is configured for 'System managed size'" WScript.Echo "" WScript.Echo " --------------------------" WScript.Echo " Current PageFile Details" WScript.Echo " --------------------------" WScript.Echo "Name: " & objDynamicPageFileItem.Name WScript.Echo "Size: " & objDynamicPageFileItem.AllocatedBaseSize WScript.Echo "Current Usage: " & objDynamicPageFileItem.CurrentUsage WScript.Echo "" WScript.Echo "" strPageFileNameInput = UserInput("Enter new pagefile name (full path and filename) - leave blank to use C:\pagefile.sys: ") strPageFileSizeInput = UserInput("Enter new pagefile size (in MB) - leave blank to remove the paging file: ") '// Check to see if the user left the input blank, otherwise set up a paging file: If Not strPageFileSizeInput = "" Then If strPageFileNameInput = "" Then strPageFileNameInput = "C:\pagefile.sys" End If WScript.Echo "New pagefile file will be: " & strPageFileNameInput WScript.Echo "New pagefile size will be: " & strPageFileSizeInput & "MB" bNoStaticPageFile = False '// Change the registry to add paging file information: objShellApp.Exec("reg add ""HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"" /v PagingFiles /t REG_MULTI_SZ /d """ & strPageFileNameInput & " " & strPageFileSizeInput & " " & strPageFileSizeInput & """ /f") '// Check the return to make sure we succeeded - otherwise, tell the user why we didn't: If Not Err.Number = 0 Then gErrData = gErrData & vbCrLf & "Error writing to registry - reason: " & Err.Number & " - " & Err.Description WScript.Echo gErrData Err.Clear Else WScript.Echo "Registry edit to add " & strPageFileNameInput & " as size " & strPageFileSizeInput & "MB was successful." bRebootNeeded = True End If '// If we've made changes that have succeeded, we need to reboot - otherwise, do nothing: If bRebootNeeded = True Then RebootSystem() WScript.Quit Else WScript.Echo "No changes made that require a reboot. Exiting script." WScript.Quit End If '// If the user left the input blank, delete the paging file - note that Delete and DeleteEx from Win32_PagingFile are deprecated, and '// while they'll return 0 on Windows 7, they don't actually delete the paging file. Using reg add instead, as it works just fine: Else WScript.Echo "Deleting paging file: " & objDynamicPageFileItem.Name objShellApp.Exec("reg add ""HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"" /v PagingFiles /t REG_MULTI_SZ /d """" /f") '// Check the return to make sure we succeeded - otherwise, tell the user why we didn't: If Not Err.Number = 0 Then gErrData = gErrData & vbCrLf & "Error writing to registry - reason: " & Err.Number & " - " & Err.Description WScript.Echo gErrData Err.Clear Else WScript.Echo "Registry edit to remove " & objDynamicPageFileItem.Name & " was successful." bRebootNeeded = True End If End If Next End Sub Sub RebootSystem() WScript.Echo "The system will reboot in 5 seconds..." Set isRunning = objShellApp.Exec("shutdown /r /t 5 /f /d p:2:4") '// As long as shutdown.exe is running, wait: Do While isRunning.Status = 0 WScript.Sleep 100 execOutput = isRunning.StdOut.ReadAll Loop End Sub Function UserInput(strInput) WScript.StdOut.Write strInput & " " UserInput = WScript.StdIn.ReadLine End Function On Error GoTo 0 Sub RunMeWithCScript() Dim ScriptEngine, engineFolder, Args, arg, scriptName, argString, scriptCommand ScriptEngine = UCase(Mid(WScript.FullName, InstrRev(WScript.FullName, "\") + 1)) engineFolder = Left(WScript.FullName, InstrRev(WScript.FullName, "\")) argString = "" If ScriptEngine = "WSCRIPT.EXE" Then Dim Shell Set Shell = CreateObject("WScript.Shell") Set Args = WScript.Arguments For Each arg in Args If InStr(arg, " ") > 0 Then arg = """" & arg & """" argString = argString & " " & Arg Next scriptCommand = "cmd.exe /k " & engineFolder & "cscript.exe """ & WScript.ScriptFullName & """" & argString Shell.Run scriptCommand, , False WScript.Quit Else Exit Sub End If End Sub setpagefile.vbs.txt

To get multiple copies of Windows XP or Vista, you had to buy an OEM x Pack (x = 3, 5, 10, 30, 100, etc). They were all cheaper than buying separate OEM licenses, but the 3, 5, and 10 pack discounts were so very minuscule over separate OEM licenses as to be not much worth it. Windows 7 was sold in a "family pack", or 3 copies of Win7 Home Premium at a pretty decent discount, but that was a short-lived program. You can still find them on eBay, but I can't imagine you'd save anything bidding on eBay versus buying 3 separate Win7 Home Premium licenses.

A boot critical device would be a kernel filter driver needed by a security / encryption package, or a RAID or SCSI driver that Windows would need to boot your hardware, etc. Any driver that considers itself boot-critical is a boot critical device, though - I've seen some synaptics touchpad drivers install themselves as boot-critical... they're not, but they install that way!

A quick search turns up literally thousands of links on how to do this, and I'm sure at least a few are relevant.

Agreed. I used to have luck with 1.0 and 1.1 from svcpack.ini with only minor modification, but since 2.0 it just doesn't work - too much of Windows is still not ready yet, and .net 2.0 (and even 1.1, if doing straight from source) require too much of Windows to be installed and running to work. I would second the recommendation of using RunOnceEx to install .NET after installation of Windows is complete.

Unfortunately, it's really hard to say for certain - without a live debugger attached to the system, the only thing we can look at are crash dumps - whatever problem occurred, it happens before the dmp so we can only make educated guesses. It could be the drivers you removed, it could be that they interact with another driver on the system, etc. You'll have to do your own trial and error on this one.

It's in the process of being fleshed out and cleaned up - it was sort of on-topic by the end, but not really. Once it's cleaned up by the parties involved, it'll be re-opened.

This compiled and ran just fine: Option Explicit Dim strComputer, strChassis Dim objWMIService, objInstance, objResults, objItem Dim bIsLaptop, bIsDesktop, bIsServer, bIsVirtual, sAssetTag, objShellApp, isRunning bIsLaptop = False bIsDesktop = False bIsServer = False bIsVirtual = False RunMeWithCScript() strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") Set objResults = objWMIService.ExecQuery( _ "SELECT * FROM Win32_SystemEnclosure",,48) For Each objInstance in objResults If objInstance.ChassisTypes(0) = 12 or objInstance.ChassisTypes(0) = 21 Then ' Ignore docking stations Else If Not IsNull(objInstance.SMBIOSAssetTag) Then sAssetTag = Trim(objInstance.SMBIOSAssetTag) End If Select Case objInstance.ChassisTypes(0) Case "2" bIsVirtual = True Case "8", "9", "10", "11", "12", "14", "18", "21" bIsLaptop = True Case "3", "4", "5", "6", "7", "15", "16" bIsDesktop = True Case "23" bIsServer = True Case Else ' Do nothing End Select End If Next If bIsVirtual = False Then Set objShellApp = CreateObject("WScript.Shell") Set isRunning = objShellApp.Exec("msiexec /i C:\WINDOWS\Clara.msi /passive /norestart") End If Sub RunMeWithCScript() Dim ScriptEngine, engineFolder, Args, arg, scriptName, argString, scriptCommand ScriptEngine = UCase(Mid(WScript.FullName, InstrRev(WScript.FullName, "\") + 1)) engineFolder = Left(WScript.FullName, InstrRev(WScript.FullName, "\")) argString = "" 'WScript.Echo ScriptEngine If ScriptEngine = "WSCRIPT.EXE" Then Dim Shell Set Shell = CreateObject("WScript.Shell") Set Args = WScript.Arguments For Each arg in Args 'loop though argument array as a collection to rebuild argument string If InStr(arg, " ") > 0 Then arg = """" & arg & """" 'If the argument contains a space wrap it in double quotes argString = argString & " " & Arg Next 'Create a persistent command prompt for the cscript output window and call the script with its original arguments scriptCommand = "cmd.exe /k " & engineFolder & "cscript.exe """ & WScript.ScriptFullName & """" & argString Shell.Run scriptCommand, , False WScript.Quit Else Exit Sub 'Already Running with Cscript Exit this Subroutine End If End Sub

It isn't so much a hack as it is a physical access problem - the keys for a running encrypted volume have to be stored *somewhere* in memory, and due to the design of Windows, they'll very likely be in the paging file. If you can get access to a running system with any encryption software (not just bitlocker) to run this, then you have physical access to the system already - decryption of the disk at that point is the least of one's problems. Bitlocker (or any other encryption package) won't protect you if someone has physical access to the system that the drive is encrypted on, and the keys are stored locally. If you're really worried about losing your machine and the data on it, don't let the firewire ports be enabled in the BIOS, and this hack can't work. That'll leave brute-force password key decryption as the only option, and that could take the attacker a very, very long time. Nothing's foolproof if it runs on the machine, especially security software. It's just there to make the task of data theft harder, not impossible .

Ah, now it makes more sense with the full dump! I can see the exception record: 1: kd> .exr 0xfffff880038b4b38 ExceptionAddress: 0000000076e0548f (ntdll!RtlLookupFunctionEntry+0x000000000000006f) ExceptionCode: c0000006 (In-page I/O error) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 0000000000000000 Parameter[1]: 000007fefcd6d8a8 Parameter[2]: 00000000c000000e Inpage operation failed at 000007fefcd6d8a8, due to I/O error 00000000c000000e // Not an allocated memory address: 1: kd> dc 000007fefcd6d8a8 L1 000007fe`fcd6d8a8 ???????? ???? // The actual error that occurred: 1: kd> !error c000000e Error code: (NTSTATUS) 0xc000000e (3221225486) - A device which does not exist was specified. // Pretty messy crash stack: 1: kd> kb RetAddr : Args to Child : Call Site fffff800`02e4bc72 : 00000000`000000f4 00000000`00000003 fffffa80`07e0f6a0 fffffa80`07e0f980 : nt!KeBugCheckEx fffff800`02df90a3 : ffffffff`ffffffff fffffa80`08021060 fffffa80`07e0f6a0 fffffa80`07e0f6a0 : nt!PspCatchCriticalBreak+0x92 fffff800`02d7d69c : ffffffff`ffffffff 00000000`00000001 fffffa80`07e0f6a0 fffff6fb`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff800`02abe853 : fffffa80`07e0f6a0 fffff800`c0000006 ffffd56e`99dec200 fffffa80`08021060 : nt!NtTerminateProcess+0x20c fffff800`02abadf0 : fffff800`02af9cac fffff880`038b4b38 fffff880`038b48a0 fffff880`038b4be0 : nt!KiSystemServiceCopyEnd+0x13 fffff800`02af9cac : fffff880`038b4b38 fffff880`038b48a0 fffff880`038b4be0 00000000`00bf1770 : nt!KiServiceLinkage fffff800`02abec42 : fffff880`038b4b38 00000000`000131b0 fffff880`038b4be0 00000000`00bf1248 : nt!KiDispatchException+0x53b fffff800`02abd7ba : 00000000`00000000 00000000`000131b0 00000000`00000001 fffffa80`0801c7c0 : nt!KiExceptionDispatch+0xc2 00000000`76e0548f : 00000000`00000000 00000000`00bf1248 00000000`00bf11d0 00000000`00bf2440 : nt!KiPageFault+0x23a 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf1d90 00000000`00bf18a0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf1f18 00000000`00bf1ea0 00000000`00bf3110 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf2a60 00000000`00bf2570 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf2be8 00000000`00bf2b70 00000000`00bf3de0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf3730 00000000`00bf3240 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf38b8 00000000`00bf3840 00000000`00bf4ab0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf4400 00000000`00bf3f10 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf4588 00000000`00bf4510 00000000`00bf5780 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf50d0 00000000`00bf4be0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf5258 00000000`00bf51e0 00000000`00bf6450 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf5da0 00000000`00bf58b0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf5f28 00000000`00bf5eb0 00000000`00bf7120 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf6a70 00000000`00bf6580 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf6bf8 00000000`00bf6b80 00000000`00bf7df0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf7740 00000000`00bf7250 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf78c8 00000000`00bf7850 00000000`00bf8ac0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf8410 00000000`00bf7f20 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf8598 00000000`00bf8520 00000000`00bf9790 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf90e0 00000000`00bf8bf0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf9268 00000000`00bf91f0 00000000`00bfa460 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bf9db0 00000000`00bf98c0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bf9f38 00000000`00bf9ec0 00000000`00bfb130 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfaa80 00000000`00bfa590 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfac08 00000000`00bfab90 00000000`00bfbe00 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfb750 00000000`00bfb260 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfb8d8 00000000`00bfb860 00000000`00bfcad0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfc420 00000000`00bfbf30 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfc5a8 00000000`00bfc530 00000000`00bfd7a0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfd0f0 00000000`00bfcc00 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfd278 00000000`00bfd200 00000000`00bfe470 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfddc0 00000000`00bfd8d0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfdf48 00000000`00bfded0 00000000`00bff140 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bfea90 00000000`00bfe5a0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bfec18 00000000`00bfeba0 00000000`00bffe10 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00bff760 00000000`00bff270 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00bff8e8 00000000`00bff870 00000000`00c00ae0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c00430 00000000`00bfff40 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c005b8 00000000`00c00540 00000000`00c017b0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c01100 00000000`00c00c10 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c01288 00000000`00c01210 00000000`00c02480 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c01dd0 00000000`00c018e0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c01f58 00000000`00c01ee0 00000000`00c03150 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c02aa0 00000000`00c025b0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c02c28 00000000`00c02bb0 00000000`00c03e20 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c03770 00000000`00c03280 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c038f8 00000000`00c03880 00000000`00c04af0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c04440 00000000`00c03f50 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c045c8 00000000`00c04550 00000000`00c057c0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c05110 00000000`00c04c20 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c05298 00000000`00c05220 00000000`00c06490 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c05de0 00000000`00c058f0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c05f68 00000000`00c05ef0 00000000`00c07160 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c06ab0 00000000`00c065c0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c06c38 00000000`00c06bc0 00000000`00c07e30 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c07780 00000000`00c07290 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c07908 00000000`00c07890 00000000`00c08b00 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c08450 00000000`00c07f60 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c085d8 00000000`00c08560 00000000`00c097d0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c09120 00000000`00c08c30 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c092a8 00000000`00c09230 00000000`00c0a4a0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c09df0 00000000`00c09900 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c09f78 00000000`00c09f00 00000000`00c0b170 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0aac0 00000000`00c0a5d0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0ac48 00000000`00c0abd0 00000000`00c0be40 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0b790 00000000`00c0b2a0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0b918 00000000`00c0b8a0 00000000`00c0cb10 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0c460 00000000`00c0bf70 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0c5e8 00000000`00c0c570 00000000`00c0d7e0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0d130 00000000`00c0cc40 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0d2b8 00000000`00c0d240 00000000`00c0e4b0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0de00 00000000`00c0d910 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0df88 00000000`00c0df10 00000000`00c0f180 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0ead0 00000000`00c0e5e0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0ec58 00000000`00c0ebe0 00000000`00c0fe50 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c0f7a0 00000000`00c0f2b0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c0f928 00000000`00c0f8b0 00000000`00c10b20 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c10470 00000000`00c0ff80 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c105f8 00000000`00c10580 00000000`00c117f0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c11140 00000000`00c10c50 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c112c8 00000000`00c11250 00000000`00c124c0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c11e10 00000000`00c11920 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c11f98 00000000`00c11f20 00000000`00c13190 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c12ae0 00000000`00c125f0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c12c68 00000000`00c12bf0 00000000`00c13e60 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c137b0 00000000`00c132c0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c13938 00000000`00c138c0 00000000`00c14b30 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c14480 00000000`00c13f90 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c14608 00000000`00c14590 00000000`00c15800 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c15150 00000000`00c14c60 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c152d8 00000000`00c15260 00000000`00c164d0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c15e20 00000000`00c15930 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c15fa8 00000000`00c15f30 00000000`00c171a0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c16af0 00000000`00c16600 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c16c78 00000000`00c16c00 00000000`00c17e70 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c177c0 00000000`00c172d0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c17948 00000000`00c178d0 00000000`00c18b40 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c18490 00000000`00c17fa0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c18618 00000000`00c185a0 00000000`00c19810 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c19160 00000000`00c18c70 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c192e8 00000000`00c19270 00000000`00c1a4e0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c19e30 00000000`00c19940 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c19fb8 00000000`00c19f40 00000000`00c1b1b0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1ab00 00000000`00c1a610 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1ac88 00000000`00c1ac10 00000000`00c1be80 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1b7d0 00000000`00c1b2e0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1b958 00000000`00c1b8e0 00000000`00c1cb50 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1c4a0 00000000`00c1bfb0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1c628 00000000`00c1c5b0 00000000`00c1d820 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1d170 00000000`00c1cc80 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1d2f8 00000000`00c1d280 00000000`00c1e4f0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1de40 00000000`00c1d950 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1dfc8 00000000`00c1df50 00000000`00c1f1c0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1eb10 00000000`00c1e620 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1ec98 00000000`00c1ec20 00000000`00c1fe90 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c1f7e0 00000000`00c1f2f0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c1f968 00000000`00c1f8f0 00000000`00c20b60 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c204b0 00000000`00c1ffc0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c20638 00000000`00c205c0 00000000`00c21830 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c21180 00000000`00c20c90 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c21308 00000000`00c21290 00000000`00c22500 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c21e50 00000000`00c21960 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c21fd8 00000000`00c21f60 00000000`00c231d0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c22b20 00000000`00c22630 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c22ca8 00000000`00c22c30 00000000`00c23ea0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c237f0 00000000`00c23300 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c23978 00000000`00c23900 00000000`00c24b70 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c244c0 00000000`00c23fd0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c24648 00000000`00c245d0 00000000`00c25840 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c25190 00000000`00c24ca0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c25318 00000000`00c252a0 00000000`00c26510 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c25e60 00000000`00c25970 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c25fe8 00000000`00c25f70 00000000`00c271e0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c26b30 00000000`00c26640 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c26cb8 00000000`00c26c40 00000000`00c27eb0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c27800 00000000`00c27310 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c27988 00000000`00c27910 00000000`00c28b80 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c284d0 00000000`00c27fe0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c28658 00000000`00c285e0 00000000`00c29850 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c291a0 00000000`00c28cb0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c29328 00000000`00c292b0 00000000`00c2a520 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c29e70 00000000`00c29980 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c29ff8 00000000`00c29f80 00000000`00c2b1f0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2ab40 00000000`00c2a650 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c2acc8 00000000`00c2ac50 00000000`00c2bec0 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2b810 00000000`00c2b320 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c2b998 00000000`00c2b920 00000000`00c2cb90 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2c4e0 00000000`00c2bff0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c2c668 00000000`00c2c5f0 00000000`00c2d860 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 00000000`00000000 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2d1b0 00000000`00c2ccc0 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00444420 00000000`00c2d338 00000000`00c2d2c0 00000000`00c2e530 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 00000000`0000315c 000007fe`fcc87db8 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2de80 00000000`00c2d990 000007fe`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c2e008 00000000`00c2df90 00000000`00c2f200 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 00000000`76f17454 000007fe`0000315c 00000000`00c2dfa0 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2eb50 00000000`00c2e660 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 00000000`76e0548f : 00000000`00000000 00000000`00c2ecd8 00000000`00c2ec60 00000000`00000000 : ntdll!KiUserExceptionDispatcher+0x2e 00000000`76de5a84 : 00000000`00c30000 000007fe`fcdbe758 00000000`0000315c 0000006d`00000003 : ntdll!RtlLookupFunctionEntry+0x6f 00000000`76e1fe48 : 00000000`00c2f820 00000000`00c2f330 00000000`00000000 00000000`00000000 : ntdll!RtlDispatchException+0xf4 000007fe`fcd631b0 : 000007fe`fcdb4a04 00000000`00000000 000007fe`fcdb6e25 00000000`004bdb70 : ntdll!KiUserExceptionDispatcher+0x2e 000007fe`fcdb4a04 : 00000000`00000000 000007fe`fcdb6e25 00000000`004bdb70 00000000`004bdb70 : winsrv!UserHardError 000007fe`fcdb50f4 : 00000000`00000000 00000000`00000000 00000000`00000004 00000000`00413430 : CSRSRV!QueueHardError+0x138 00000000`76e339cb : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CSRSRV!CsrApiRequestThread+0x510 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x25 1: kd> !diskspace c: Checking Free Space for c: Failed to get Type value at 0xfffff8a000008060! Failed to find volume c:! Andre may well be onto something with that particular hotfix, so installing it is probably a good idea - the laptop is crashing because the C: drive isn't available yet, but it should have been! You also want to consider what antivirus software (or anything else that would register itself as an I/O filter driver) you are running, as well - I've seen Symantec Antivirus cause this as well, although those were XP machines. Just a thought, but something is keeping the HDD from being ready on time.

There's actually a reason it doesn't work from RunOnce after installing Windows. It is actually precisely because you have to logon once if you run setup AFTER Windows has finished installing and setup reboots the box. Running it during setup from svcpack.inf works around this particular issue, because the branding isn't done until after the "first reboot" after IE8 is installed, aka when setup finishes and reboots. If you use RunOnceEx to install IE8 (/noreboot) without ever logging on (say for example, right after Windows finishes installing), it *does* break like this, and it is for very specific reasons. If you install IE8 during setup, when Setup reboots (and iedkcs32 runs branding on first login), you've already got a reboot between setup and branding, and you also have ActiveSetup populated with IE8 data (and a reboot) and it works regardless of profile creation or not, because the issue causing the error has been "worked around" by creating the required reg keys during setup, rather than when the user first logs on. It's a specific problem with doing it this way: 1. XP install, reboot; 2. RunOnceEx installs IE8 package with /noreboot switch; 3. RunOnceEx finishes and the user logs on - branding fails, because IE8 setup hasn't completed, and the ActiveSetup registry keys are not fully populated yet.

IE8 is failing to run the command rundll32 "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP because iedkcs32.dll isn't actually an IE8 version (at least in memory) until after the machine reboots, and the ActiveSetup data doesn't populate until either you finish logging in once, or IE8 finishes installing and the machine is rebooted. Note that if you've already logged in FULLY once and then try installing IE8 from RunOnceEx, it'll actually work (because the ActiveSetup keys in the registry will be populated and have valid data), but given that you're doing this on a clean install it will fail (I tested this to be sure - if you do a full logon, then reboot and do this via RunOnce, it works without error - you're still in need of a reboot because you're running a mixed IE6/IE8 browser configuration, but the branding via iedkcs32 works without error). Thus, if you install from RunOnce with the /noreboot parameter from a fresh install, before the user has logged in, you've not only booted a system with mixed IE6 and IE8 binaries and reg entries, but you don't have a fully-populated ActiveSetup registry, and branding will fail - double-whammy. RunOnce is just not the place to install IE7 or IE8 (patches after install, yes, but not the browser itself, at least not without a reboot) from a new install - using one of the other methods that install IE8 during setup are the best way, like this one from svcpack.inf. It avoids this by avoiding the branding call failure (it doesn't appear to need to occur when installing using the above add-on due to where it's being run during setup), plus the system has technically "been rebooted" once, aka setup, so IE8 is fully installed when the system comes up for the first time.

Hard to say, but likely unrelated. Unless it's a bad video card or underpowered PSU, it's probably just dumb luck.

Is it specifically looking for that file during the install? Seems very odd that it would require the original installer for an MSP - does a procmon give any clues as to why it wants that specific file?

What tool was used to split these files? I cannot get them to recombine to extract it.

Given all the CDx folders, you might be able to copy everything from the CDx folders to the root of the DVD?

Depends on how it's being called. In the case of the procmon, it looks like DDEExec calls.

OK, couple of things: Probably points to the locations of IE7 or IE8 wherever they were installed. Shell handlers are pretty basic - they usually have a path, a ddeexec handler (if they take ddeexec calls from the shell), and sometimes a CLSID or AppID if they're COM objects. This is part of the reason Microsoft doesn't support multiple versions of IE on a machine - they can all handle the dde open call, so what is here matters quite a bit. Also, C:\Windows\IE7 is supposed to be the IE6 backup when IE7 is installed - running IE6 from here gives you a mix of IE6 binaries and IE7 .dll files from system32 (IE is not a self-contained application). This is the other reason multiple IE versions aren't supported - you don't always have *only* IE6 (or IE7, or IE8) binaries loaded, even though it might appear to be working properly. You should be able to look at these locations for a working install with the version of IE you want to use (fire up a VM if necessary), and just copy the values from those locations. Again, if you want to see what it's doing, run procmon, watch registry access, and set a filter on "path / contains / http". That should be sufficient if you want to see it happen.

Rapidshare won't let me get at part 1, and I'm not paying $7 to download a file. Mind uploading it to my FTP? I've PMed you the details.

I can tell you none of these reg values has anything to do with the issue, and procmon confirms it. It appears it's simply looking up and using the registered http handler: Date & Time: 6/11/2010 8:36:00 AM Event Class: Registry Operation: RegQueryValue Result: SUCCESS Path: HKCR\HTTP\shell\open\command\(Default) TID: 2936 Duration: 0.0000101 Type: REG_SZ Length: 70 Data: "C:\Program Files\Opera\opera.exe" Date & Time: 6/11/2010 8:36:03 AM Event Class: Registry Operation: RegQueryValue Result: SUCCESS Path: HKCR\HTTP\shell\(Default) TID: 1232 Duration: 0.0000103 Type: REG_SZ Length: 10 Data: open Date & Time: 6/11/2010 8:36:03 AM Event Class: Registry Operation: RegQueryValue Result: SUCCESS Path: HKCR\HTTP\shell\open\ddeexec\(Default) TID: 1232 Duration: 0.0000098 Type: REG_SZ Length: 10 Data: "%1" Date & Time: 6/11/2010 8:36:03 AM Event Class: Registry Operation: RegQueryValue Result: SUCCESS Path: HKCR\HTTP\shell\open\ddeexec\Application\(Default) TID: 1232 Duration: 0.0000075 Type: REG_SZ Length: 12 Data: Opera Date & Time: 6/11/2010 8:36:03 AM Event Class: Registry Operation: RegQueryValue Result: SUCCESS Path: HKCR\HTTP\shell\open\ddeexec\Topic\(Default) TID: 1232 Duration: 0.0000112 Type: REG_SZ Length: 24 Data: WWW_OpenURL Your registry says that Opera is the default handler for the HTTP protocol and shell links, so... Opera opens.

Dunno specifically - seems to be an msctfime issue. The hotfix is supposed to fix it.