Microsoft (R) Windows Debugger Version 6.11.0001.402 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\pchealth\ERRORREP\UserDumps\winlogon.exe.20090212-012133-00.hdmp] User Mini Dump File: Only registers, stack and portions of memory are available Symbol search path is: SRV*c:\symbols*http//:msdl.microsoft.com/download/symbols;SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible Product: WinNt, suite: SingleUserTS Machine Name: Debug session time: Wed Feb 11 19:21:34.000 2009 (GMT-6) System Uptime: not available Process Uptime: 0 days 7:09:06.000 ................................................................ ............. Loading unloaded module list .............. SYMSRV: c:\symbols*http//:msdl.microsoft.com/download/symbols needs a downstream store This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (354.150): Access violation - code c0000005 (first/second chance not available) eax=c0000005 ebx=80070000 ecx=0193bdcc edx=00000000 esi=000009dc edi=00000000 eip=7c90e4f4 esp=01939c5c ebp=01939cc0 iopl=0 nv up ei ng nz ac pe cy cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297 SYMSRV: c:\symbols*http//:msdl.microsoft.com/download/symbols needs a downstream store ntdll!KiFastSystemCallRet: 7c90e4f4 c3 ret 0:025> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Module load completed but symbols could not be loaded for odbcint.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for WgaLogon.dll - *** WARNING: Unable to verify checksum for ati2evxx.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for ati2evxx.dll - *** ERROR: Module load completed but symbols could not be loaded for xpsp2res.dll *** WARNING: Unable to verify checksum for SASWINLO.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for SASWINLO.dll - *** ERROR: Module load completed but symbols could not be loaded for avgrsstx.dll ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* FAULTING_IP: uxtheme!_imp__CryptDestroyHash+0 5ad71010 ac lods byte ptr [esi] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 5ad71010 (uxtheme!_imp__CryptDestroyHash) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00040000 Attempt to read from address 00040000 DEFAULT_BUCKET_ID: INVALID_POINTER_READ PROCESS_NAME: winlogon.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 00040000 READ_ADDRESS: 00040000 FOLLOWUP_IP: uxtheme!_imp__CryptDestroyHash+0 5ad71010 ac lods byte ptr [esi] NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 00000150 PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ LAST_CONTROL_TRANSFER: from 7e44f460 to 5ad71010 STACK_TEXT: 0193f8b0 7e44f460 00040000 00000000 0193f8c8 uxtheme!_imp__CryptDestroyHash 0193f8d8 7e42ce7c 0060db58 00000081 00000000 user32!fnHkINLPCWPSTRUCTA+0x4f 0193f908 7c90e453 0193f918 00000084 00000084 user32!__fnINLPCREATESTRUCT+0x8b 0193f998 7e42e389 7e42e34f 00010101 00008002 ntdll!KiUserCallbackDispatcher+0x13 0193fe3c 7e426423 00010101 00008002 0193fea0 user32!NtUserCreateWindowEx+0xc 0193ff14 7e42683e 75970000 00008002 0000007c user32!InternalCreateDialog+0x5bc 0193ff38 7e41ea84 75970000 759a36d0 00000000 user32!CreateDialogIndirectParamAorW+0x33 0193ff64 75975a25 75970000 00000992 00000000 user32!CreateDialogParamW+0x49 0193ffb4 7c80b713 00141258 00000000 00000000 msgina!StatusMessageThread+0x46 0193ffec 00000000 759759df 00141258 00000000 kernel32!BaseThreadStart+0x37 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: uxtheme!_imp__CryptDestroyHash+0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: uxtheme IMAGE_NAME: uxtheme.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4802a11e STACK_COMMAND: ~25s; .ecxr ; kb FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_uxtheme.dll!_imp__CryptDestroyHash BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_uxtheme!_imp__CryptDestroyHash+0 WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/winlogon_exe/5_1_2600_5512/48027549/uxtheme_dll/6_0_2900_5512/4802a11e/c0000005/00001010.htm?Retriage=1 Followup: MachineOwner --------- 0:025> lmvm uxtheme start end module name 5ad70000 5ada8000 uxtheme (pdb symbols) c:\websymbols\uxtheme.pdb\E99E16308F094767B1F07FB5C3E5E2462\uxtheme.pdb Loaded symbol image file: uxtheme.dll Mapped memory image file: c:\websymbols\uxtheme.dll\4802A11E38000\uxtheme.dll Image path: C:\WINDOWS\system32\uxtheme.dll Image name: uxtheme.dll Timestamp: Sun Apr 13 19:11:10 2008 (4802A11E) CheckSum: 0004533D ImageSize: 00038000 File version: 6.0.2900.5512 Product version: 6.0.2900.5512 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: UxTheme.dll OriginalFilename: UxTheme.dll ProductVersion: 6.00.2900.5512 FileVersion: 6.00.2900.5512 (xpsp.080413-2105) FileDescription: Microsoft UxTheme Library LegalCopyright: © Microsoft Corporation. All rights reserved.