extremepilot Posted June 5, 2009 Share Posted June 5, 2009 I used the INCREDIBLE sticky on how to generate a dmp, and it generated two, unfortunately each one is about 200mb so I wont upload, but here are the bits that I THINK SHOULD help solve the problem:FIRST .DMP:Microsoft ® Windows Debugger Version 6.11.0001.404 X86Copyright © Microsoft Corporation. All rights reserved.Loading Dump File [C:\Users\Boris\Desktop\PID-2168__EXPLORER.EXE__1st_chance_Process_Shut_Down__full_0ec4_2009-06-04_20-02-31-198_0878.dmp]User Mini Dump File with Full Memory: Only application data is availableComment: '1st_chance_Process_Shut_Down_exception_in_EXPLORER.EXE_running_on_IRENE-PC'Symbol search path is: *** Invalid ******************************************************************************** Symbol loading may be unreliable without a symbol search path. ** Use .symfix to have the debugger choose a symbol path. ** After setting your symbol path, use .reload to refresh symbol locations. *****************************************************************************Executable search path is: Windows Vista Version 6000 MP (2 procs) Free x86 compatibleProduct: WinNt, suite: SingleUserTS PersonalMachine Name:Debug session time: Thu Jun 4 20:02:31.000 2009 (GMT-4)System Uptime: 0 days 0:41:12.684Process Uptime: 0 days 0:22:40.000....................................................................................................................................................................................Loading unloaded module list..........................................................eax=000000c0 ebx=00000002 ecx=049ffd88 edx=00000000 esi=00000000 edi=00000000eip=77860f34 esp=049ffca4 ebp=049ffd40 iopl=0 nv up ei pl zr na pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - ntdll!KiFastSystemCallRet:77860f34 c3 retSECOND .DMP:Microsoft ® Windows Debugger Version 6.11.0001.404 X86Copyright © Microsoft Corporation. All rights reserved.Loading Dump File [C:\Users\Boris\Desktop\PID-2168__EXPLORER.EXE__2nd_chance_UnknownException__full_0ec4_2009-06-04_20-01-58-134_0878.dmp]User Mini Dump File with Full Memory: Only application data is availableComment: '2nd_chance_UnknownException_exception_in_EXPLORER.EXE_running_on_IRENE-PC'Symbol search path is: *** Invalid ******************************************************************************** Symbol loading may be unreliable without a symbol search path. ** Use .symfix to have the debugger choose a symbol path. ** After setting your symbol path, use .reload to refresh symbol locations. *****************************************************************************Executable search path is: Windows Vista Version 6000 MP (2 procs) Free x86 compatibleProduct: WinNt, suite: SingleUserTS PersonalMachine Name:Debug session time: Thu Jun 4 20:01:59.000 2009 (GMT-4)System Uptime: 0 days 0:41:04.066Process Uptime: 0 days 0:22:08.000....................................................................................................................................................................................Loading unloaded module list..........................................................This dump file has an exception of interest stored in it.The stored exception information can be accessed via .ecxr.(878.2fc): Unknown exception - code c06d007e (first/second chance not available)eax=0947e6b8 ebx=00000000 ecx=00000001 edx=00000000 esi=098292bc edi=00000000eip=7640b09e esp=0947e6b8 ebp=0947e708 iopl=0 nv up ei pl nz ac pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll - kernel32!RaiseException+0x58:7640b09e c9 leavePLEASE HELP !! Thanks in advance! Link to comment Share on other sites More sharing options...
extremepilot Posted June 5, 2009 Author Share Posted June 5, 2009 if this helps, event viewer says the app is explorer.exe, and the faulting module is kernel32.dll Link to comment Share on other sites More sharing options...
PC_LOAD_LETTER Posted June 5, 2009 Share Posted June 5, 2009 Do not crosspost. especially when it isnt even relative to this forum. Topic closed Link to comment Share on other sites More sharing options...
cluberti Posted June 5, 2009 Share Posted June 5, 2009 if this helps, event viewer says the app is explorer.exe, and the faulting module is kernel32.dllThat means nothing - kernel32 is only pointed to because it was in the top of the stack. If you look closely, you'll see it is there because the RaiseException function used to let you know a process is crashing is in kernel32.dll. You HAVE to at least see the stack and look at memory to be able to tell what's happening. I've posted in the other post more information. Link to comment Share on other sites More sharing options...
Recommended Posts