Start_Here.exe (15960/14360) - ========== 25/03/2011 - 14:07:06 ========== Start_Here.exe (15960/14360) - ---->InitInstance: unique instance. Continue... Start_Here.exe (15960/14360) - InitInstance: starting... Start_Here.exe (15960/14360) - ---->InitInstance: SetOSType is OK Start_Here.exe (15960/14360) - ---->InitInstance: CD is original Start_Here.exe (15960/14360) - IsManagerInstalled: Entry... Start_Here.exe (15960/14360) - InstallAndStartManager: system directory is C:\Windows\system32 Start_Here.exe (15960/14360) - InstallAndStartManager: m_szMgrInstPath is C:\Windows\system32 Start_Here.exe (15960/14360) - StartManager: starting HCPS Manager with full filename C:\Windows\system32\HCPSMng.exe HCPSMng.exe (15872/15112) - ========== 25/03/2011 - 14:07:10 ========== HCPSMng.exe (15872/15112) - ---->InitInstance: unique instance. Continue... HCPSMng.exe (15872/15112) - InitInstance: Manager started HCPSMng.exe (15872/15112) - InitInstance: current directory is C:\Windows\system32 HCPSMng.exe (15872/15112) - DetectOS: start of function. HCPSMng.exe (15872/15112) - DetectOS: dwMajorVersion = 6, dwMinorVersion = 1 HCPSMng.exe (15872/15112) - DetectOS: invalid NT code in osvi.dwMajorVersion. HCPSMng.exe (15872/15112) - InitInstance: creating window HCPSMng.exe (15872/15112) - <----InitGPT: start of function HCPSMng.exe (15872/15112) - <----InitGPT: creating map file for connection HCPSMng.exe (15872/15112) - <----InitGPT: creating event for write to map file HCPSMng.exe (15872/15112) - <----InitGPT: finished successfully HCPSMng.exe (15872/15112) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPSTool.dll HCPSMng.exe (15872/15112) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPS98Tool.dll HCPSMng.exe (15872/15112) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPSST.dll HCPSMng.exe (15872/15112) - <----InstallHook: started HCPSMng.exe (15872/15112) - C:\Windows\system32\HCPSTool.dll HCPSMng.exe (15872/15112) - <----InstallHook: Hooking NT HCPSMng.exe (15872/15112) - <----InstallHook: m_pfnInstallHook = 0x10008F60, (bActivate = 0x1, hwndServer = 0x3F04A4 m_hmodHook98 = 0x0, m_bW2XP = 0x1, dwOSVersion=6, m_pfnInit98Lib = 0x0); HCPSMng.exe (15872/15112) - <----InstallHook: finished successfully HCPSMng.exe (15872/15112) - InitInstance: registering as service HCPSMng.exe (15872/15112) - InitInstance:Manager started successfully Start_Here.exe (15960/14360) - ---->StartManager: create process finished successfully Start_Here.exe (15960/14360) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (15960/14360) - ---->InitInstance: going to create session. Start_Here.exe (15960/14360) - InitSession: MMF name is MMF_HCPS_SessID15960 Start_Here.exe (15960/14360) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (15960/14360) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (15960/14360) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (15960/14360) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (15960/14360) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (15960/14360) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (15960/14360) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (15960/14360) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (15960/14360) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (15960/14360) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (15960/14360) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (15960/14360) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (15960/14360) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (15960/14360) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (15960/14360) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (15960/14360) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (15960/14360) - InitSession: m_hRdMtx: 0x00000154 m_hWrtMtx: 0x00000158 m_hMMFEvt: 0x00000160 m_h2ndPartEvt: 0x0000015C Start_Here.exe (15960/14360) - ---->IsMgrHasIt: start of function Start_Here.exe (15960/14360) - ---->StartTransaction: start of function Start_Here.exe (15960/14360) - ---->StartTransaction: sending message to manager Start_Here.exe (15960/14360) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15960 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15960 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000144 waits while client will connect to pipe... HCPSMng.exe (15872/15112) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (15960/14360) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x00000168, nBytes = 132 Start_Here.exe (15960/14360) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: session not found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function HCPSMng.exe (15872/15112) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (15960/14360) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (15960/14360) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (15960/14360) - ---->AskMgrToCreateSession: start of function Start_Here.exe (15960/14360) - ---->StartTransaction: start of function Start_Here.exe (15960/14360) - ---->StartTransaction: sending message to manager Start_Here.exe (15960/14360) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnCrtSession: start of function--------------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15960 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15960 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000154 waits while client will connect to pipe... HCPSMng.exe (15872/15112) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (15960/14360) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (15960/14360) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x00000168, nBytes = 132 Start_Here.exe (15960/14360) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (15960/14360) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (15960/14360) - ---->StartTransaction: function finished with successfully Start_Here.exe (15960/14360) - ---->AskMgrToCreateSession: second part of transaction 8, dwInBuffMinimum = 40624 Start_Here.exe (15960/14360) - ---->StartTransaction: start of function HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000154 waits while client will connect to pipe... Start_Here.exe (15960/14360) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (15960/14360) - ---->StartTransaction: Writing to MMF buffer, hMMF = 0x00000168, nBytes = 41648 Start_Here.exe (15960/14360) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (15960/14360) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----OnCrtSession: Read finished OK HCPSMng.exe (15872/15112) - <----OnCrtSession: Template.dwCb = 41648, m_CurrPT.m_dwRules=1, Template.m_szContentPath=F:\, Template.m_szLoaderPath=F:\ HCPSMng.exe (15872/15112) - <----OnCrtSession: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV HCPSMng.exe (15872/15112) - <----OnCrtSession: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe HCPSMng.exe (15872/15112) - <----InitSession: WINDOWS EXPLORER ADDED HCPSMng.exe (15872/15112) - <----InitSession: creating event for write to map file HCPSMng.exe (15872/15112) - <----OnCrtSession: New session added&enabled HCPSMng.exe (15872/15112) - <----OnCrtSession: Writing result HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function HCPSMng.exe (15872/15112) - <----OnCrtSession: WritePartConnect returned OK Start_Here.exe (15960/14360) - ---->StartTransaction: function finished with successfully Start_Here.exe (15960/14360) - ---->InitInstance: going to Start CD. Start_Here.exe (15960/14360) - ---->StartCD: started HCPSMng.exe (15872/15112) - <----UpdateGPT: m_GlobalTemplate.dwCb = 719416, m_GlobalTemplate.dwUpdateCnt = 1, m_GlobalTemplate.m_dwCRC32=1712003411, m_GlobalTemplate.m_dwRules=0 HCPSMng.exe (15872/15112) - <----UpdateGPT: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV HCPSMng.exe (15872/15112) - <----UpdateGPT: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe, WinWord.exe, Excel.exe HCPSMng.exe (15872/15112) - <----UpdateGPT: Content pathes: HCPSMng.exe (15872/15112) - F:\ HCPSMng.exe (15872/15112) - <----UpdateGPT: SendGPT successed HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----OnCrtSession: Polling thread creation. HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (15872/15112) - <----OnCrtSession: Polling thread created OK. HCPSMng.exe (15872/15848) - CMgrWnd::DevicePollingThread - now running... HCPSMng.exe (15872/15112) - <----OnCrtSession: finished--------------------- Start_Here.exe (15960/14360) - ExitInstance: Loader is out of existence. Bye! HCPSMng.exe (15872/15848) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (15872/15112) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15848) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - OnMediaChange: F:\ HCPSMng.exe (15872/15112) - OnMediaChange: Disable session HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. Start_Here.exe (13812/13720) - ========== 25/03/2011 - 14:11:10 ========== Start_Here.exe (13812/13720) - ---->InitInstance: unique instance. Continue... Start_Here.exe (13812/13720) - InitInstance: starting... Start_Here.exe (13812/13720) - ---->InitInstance: SetOSType is OK Start_Here.exe (13812/13720) - ---->InitInstance: CD is original Start_Here.exe (13812/13720) - IsManagerInstalled: Entry... Start_Here.exe (13812/13720) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (13812/13720) - ---->InitInstance: going to create session. Start_Here.exe (13812/13720) - InitSession: MMF name is MMF_HCPS_SessID13812 Start_Here.exe (13812/13720) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (13812/13720) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (13812/13720) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (13812/13720) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (13812/13720) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (13812/13720) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (13812/13720) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (13812/13720) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (13812/13720) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (13812/13720) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (13812/13720) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (13812/13720) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (13812/13720) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (13812/13720) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (13812/13720) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (13812/13720) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (13812/13720) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (13812/13720) - ---->IsMgrHasIt: start of function Start_Here.exe (13812/13720) - ---->StartTransaction: start of function Start_Here.exe (13812/13720) - ---->StartTransaction: sending message to manager Start_Here.exe (13812/13720) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID13812 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx13812 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000170 waits while client will connect to pipe... HCPSMng.exe (15872/15112) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (13812/13720) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (13812/13720) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (13812/13720) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (13812/13720) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnIsSessionExist: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function HCPSMng.exe (15872/15112) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (13812/13720) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (13812/13720) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (13812/13720) - ---->EnableSecureSession: start of function Start_Here.exe (13812/13720) - ---->StartTransaction: start of function Start_Here.exe (13812/13720) - ---->StartTransaction: sending message to manager Start_Here.exe (13812/13720) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID13812 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx13812 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000180 waits while client will connect to pipe... HCPSMng.exe (15872/15112) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (13812/13720) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (13812/13720) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (13812/13720) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnEnableSession: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (13812/13720) - ---->StartTransaction: function finished with successfully HCPSMng.exe (15872/15112) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 0, path=, SessId is 0x00 0x00 Start_Here.exe (13812/13720) - ---->InitInstance: going to Start CD. HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (13812/13720) - ---->StartCD: started HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (13812/13720) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (15872/15112) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (15872/15112) - <----OnEnableSession: updating current language. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (15872/15112) - <----OnEnableSession: finished HCPSMng.exe (15872/11024) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (13812/13720) - ExitInstance: Loader is out of existence. Bye! Start_Here.exe (14376/15500) - ========== 25/03/2011 - 14:12:01 ========== Start_Here.exe (14376/15500) - ---->InitInstance: unique instance. Continue... Start_Here.exe (14376/15500) - InitInstance: starting... Start_Here.exe (14376/15500) - ---->InitInstance: SetOSType is OK Start_Here.exe (14376/15500) - ---->InitInstance: CD is original Start_Here.exe (14376/15500) - IsManagerInstalled: Entry... Start_Here.exe (14376/15500) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (14376/15500) - ---->InitInstance: going to create session. Start_Here.exe (14376/15500) - InitSession: MMF name is MMF_HCPS_SessID14376 Start_Here.exe (14376/15500) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (14376/15500) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (14376/15500) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (14376/15500) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (14376/15500) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (14376/15500) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (14376/15500) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (14376/15500) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (14376/15500) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (14376/15500) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (14376/15500) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (14376/15500) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (14376/15500) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (14376/15500) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (14376/15500) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (14376/15500) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (14376/15500) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (14376/15500) - ---->IsMgrHasIt: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: sending message to manager Start_Here.exe (14376/15500) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID14376 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx14376 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x000001A0 waits while client will connect to pipe... Start_Here.exe (14376/15500) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (14376/15500) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (14376/15500) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnIsSessionExist: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: function finished with successfully HCPSMng.exe (15872/15112) - <----OnIsSessionExist: finished. Start_Here.exe (14376/15500) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (14376/15500) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (14376/15500) - ---->EnableSecureSession: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: sending message to manager Start_Here.exe (14376/15500) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID14376 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx14376 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x000001B0 waits while client will connect to pipe... HCPSMng.exe (15872/15112) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (14376/15500) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (14376/15500) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (14376/15500) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (14376/15500) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnEnableSession: session found HCPSMng.exe (15872/15112) - <----OnEnableSession: session already enabled HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (14376/15500) - ---->StartTransaction: function finished with successfully HCPSMng.exe (15872/15112) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (14376/15500) - ---->EnableSecureSession: finished with result 1 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 0, path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (14376/15500) - ---->InitInstance: going to Start CD. HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (14376/15500) - ---->StartCD: started HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (14376/15500) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (15872/15112) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (15872/15112) - <----OnEnableSession: updating current language. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (15872/15112) - <----OnEnableSession: finished HCPSMng.exe (15872/12728) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (14376/15500) - ExitInstance: Loader is out of existence. Bye! HCPSMng.exe (15872/12728) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (15872/15112) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/11024) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (15872/12728) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (15872/11024) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - OnMediaChange: F:\ HCPSMng.exe (15872/15112) - OnMediaChange: Disable session HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - OnMediaChange: F:\ HCPSMng.exe (15872/15112) - OnMediaChange: Disable session HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. Start_Here.exe (15724/16120) - ========== 25/03/2011 - 14:23:30 ========== Start_Here.exe (15724/16120) - ---->InitInstance: unique instance. Continue... Start_Here.exe (15724/16120) - InitInstance: starting... Start_Here.exe (15724/16120) - ---->InitInstance: SetOSType is OK Start_Here.exe (15724/16120) - ---->InitInstance: CD is original Start_Here.exe (15724/16120) - IsManagerInstalled: Entry... Start_Here.exe (15724/16120) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (15724/16120) - ---->InitInstance: going to create session. Start_Here.exe (15724/16120) - InitSession: MMF name is MMF_HCPS_SessID15724 Start_Here.exe (15724/16120) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (15724/16120) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (15724/16120) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (15724/16120) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (15724/16120) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (15724/16120) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (15724/16120) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (15724/16120) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (15724/16120) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (15724/16120) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (15724/16120) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (15724/16120) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (15724/16120) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (15724/16120) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (15724/16120) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (15724/16120) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (15724/16120) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (15724/16120) - ---->IsMgrHasIt: start of function Start_Here.exe (15724/16120) - ---->StartTransaction: start of function Start_Here.exe (15724/16120) - ---->StartTransaction: sending message to manager Start_Here.exe (15724/16120) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15724 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15724 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x000001C8 waits while client will connect to pipe... Start_Here.exe (15724/16120) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (15724/16120) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (15724/16120) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnIsSessionExist: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function HCPSMng.exe (15872/15112) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (15724/16120) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (15724/16120) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (15724/16120) - ---->EnableSecureSession: start of function Start_Here.exe (15724/16120) - ---->StartTransaction: start of function Start_Here.exe (15724/16120) - ---->StartTransaction: sending message to manager Start_Here.exe (15724/16120) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15724 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15724 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x000001D8 waits while client will connect to pipe... Start_Here.exe (15724/16120) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (15724/16120) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (15724/16120) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnEnableSession: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (15724/16120) - ---->StartTransaction: function finished with successfully HCPSMng.exe (15872/15112) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 0, path=, SessId is 0x00 0x00 Start_Here.exe (15724/16120) - ---->InitInstance: going to Start CD. HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (15724/16120) - ---->StartCD: started HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (15724/16120) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (15872/15112) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (15872/15112) - <----OnEnableSession: updating current language. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (15872/15112) - <----OnEnableSession: finished HCPSMng.exe (15872/15784) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (15724/16120) - ExitInstance: Loader is out of existence. Bye! Start_Here.exe (15576/10784) - ========== 25/03/2011 - 14:24:22 ========== Start_Here.exe (15576/10784) - ---->InitInstance: unique instance. Continue... Start_Here.exe (15576/10784) - InitInstance: starting... Start_Here.exe (15576/10784) - ---->InitInstance: SetOSType is OK Start_Here.exe (15576/10784) - ---->InitInstance: CD is original Start_Here.exe (15576/10784) - IsManagerInstalled: Entry... Start_Here.exe (15576/10784) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (15576/10784) - ---->InitInstance: going to create session. Start_Here.exe (15576/10784) - InitSession: MMF name is MMF_HCPS_SessID15576 Start_Here.exe (15576/10784) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (15576/10784) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (15576/10784) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (15576/10784) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (15576/10784) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (15576/10784) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (15576/10784) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (15576/10784) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (15576/10784) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (15576/10784) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (15576/10784) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (15576/10784) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (15576/10784) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (15576/10784) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (15576/10784) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (15576/10784) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (15576/10784) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (15576/10784) - ---->IsMgrHasIt: start of function Start_Here.exe (15576/10784) - ---->StartTransaction: start of function Start_Here.exe (15576/10784) - ---->StartTransaction: sending message to manager Start_Here.exe (15576/10784) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15576 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15576 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x000001F8 waits while client will connect to pipe... Start_Here.exe (15576/10784) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (15576/10784) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (15576/10784) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (15576/10784) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnIsSessionExist: session found HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function HCPSMng.exe (15872/15112) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (15576/10784) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (15576/10784) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (15576/10784) - ---->EnableSecureSession: start of function Start_Here.exe (15576/10784) - ---->StartTransaction: start of function Start_Here.exe (15576/10784) - ---->StartTransaction: sending message to manager Start_Here.exe (15576/10784) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (15872/15112) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (15872/15112) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (15872/15112) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID15576 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx15576 HCPSMng.exe (15872/15112) - <----ReadPartConnect: Manager hMMF = 0x00000208 waits while client will connect to pipe... Start_Here.exe (15576/10784) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (15576/10784) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (15576/10784) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (15576/10784) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (15872/15112) - <----ReadPartConnect: finished successfully. HCPSMng.exe (15872/15112) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (15872/15112) - <----OnEnableSession: session found HCPSMng.exe (15872/15112) - <----OnEnableSession: session already enabled HCPSMng.exe (15872/15112) - <----WritePartConnect: start of function Start_Here.exe (15576/10784) - ---->StartTransaction: function finished with successfully HCPSMng.exe (15872/15112) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (15576/10784) - ---->EnableSecureSession: finished with result 1 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 0, path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (15576/10784) - ---->InitInstance: going to Start CD. HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (15576/10784) - ---->StartCD: started HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (15576/10784) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (15872/15112) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (15872/15112) - <----OnEnableSession: updating current language. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (15872/15112) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (15872/15112) - <----OnEnableSession: finished HCPSMng.exe (15872/16068) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (15576/10784) - ExitInstance: Loader is out of existence. Bye! HCPSMng.exe (15872/16068) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (15872/15112) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15784) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (15872/15784) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/16068) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - OnMediaChange: F:\ HCPSMng.exe (15872/15112) - OnMediaChange: Disable session HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: started... HCPSMng.exe (15872/15112) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (15872/15112) - <----UpdateSessLst: removing session from list. HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (15872/15112) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (15872/15112) - CMgrWnd::DisableSession: ended. HCPSMng.exe (15872/15112) - CMgrWnd::WindowProc - before InstallHook HCPSMng.exe (15872/15112) - <----InstallHook: started Start_Here.exe (1312/4564) - ========== 25/03/2011 - 15:18:53 ========== Start_Here.exe (1312/4564) - ---->InitInstance: unique instance. Continue... Start_Here.exe (1312/4564) - InitInstance: starting... Start_Here.exe (1312/4564) - ---->InitInstance: SetOSType is OK Start_Here.exe (1312/4564) - ---->InitInstance: CD is original Start_Here.exe (1312/4564) - IsManagerInstalled: Entry... Start_Here.exe (1312/4564) - IsManagerStarted: atom not found Start_Here.exe (1312/4564) - ---->InitInstance: Manager is not started, so starting it. Start_Here.exe (1312/4564) - StartManager: starting HCPS Manager with full filename C:\Windows\system32\HCPSMng.exe HCPSMng.exe (4172/1524) - ========== 25/03/2011 - 15:18:56 ========== HCPSMng.exe (4172/1524) - ---->InitInstance: unique instance. Continue... HCPSMng.exe (4172/1524) - InitInstance: Manager started HCPSMng.exe (4172/1524) - InitInstance: current directory is C:\Windows\system32 HCPSMng.exe (4172/1524) - DetectOS: start of function. HCPSMng.exe (4172/1524) - DetectOS: dwMajorVersion = 6, dwMinorVersion = 1 HCPSMng.exe (4172/1524) - DetectOS: invalid NT code in osvi.dwMajorVersion. HCPSMng.exe (4172/1524) - InitInstance: creating window HCPSMng.exe (4172/1524) - <----InitGPT: start of function HCPSMng.exe (4172/1524) - <----InitGPT: creating map file for connection HCPSMng.exe (4172/1524) - <----InitGPT: creating event for write to map file HCPSMng.exe (4172/1524) - <----InitGPT: finished successfully HCPSMng.exe (4172/1524) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPSTool.dll HCPSMng.exe (4172/1524) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPS98Tool.dll HCPSMng.exe (4172/1524) - <----InstallDLLs: Installing DLL C:\Windows\system32\HCPSST.dll HCPSMng.exe (4172/1524) - <----InstallHook: started HCPSMng.exe (4172/1524) - C:\Windows\system32\HCPSTool.dll HCPSMng.exe (4172/1524) - <----InstallHook: Hooking NT HCPSMng.exe (4172/1524) - <----InstallHook: m_pfnInstallHook = 0x10008F60, (bActivate = 0x1, hwndServer = 0x220388 m_hmodHook98 = 0x0, m_bW2XP = 0x1, dwOSVersion=6, m_pfnInit98Lib = 0x0); HCPSMng.exe (4172/1524) - <----InstallHook: finished successfully HCPSMng.exe (4172/1524) - InitInstance: registering as service HCPSMng.exe (4172/1524) - InitInstance:Manager started successfully Start_Here.exe (1312/4564) - ---->StartManager: create process finished successfully Start_Here.exe (1312/4564) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (1312/4564) - ---->InitInstance: Manager started successfully. Start_Here.exe (1312/4564) - ---->InitInstance: going to create session. Start_Here.exe (1312/4564) - InitSession: MMF name is MMF_HCPS_SessID1312 Start_Here.exe (1312/4564) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (1312/4564) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (1312/4564) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (1312/4564) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (1312/4564) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (1312/4564) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (1312/4564) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (1312/4564) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (1312/4564) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (1312/4564) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (1312/4564) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (1312/4564) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (1312/4564) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (1312/4564) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (1312/4564) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (1312/4564) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (1312/4564) - InitSession: m_hRdMtx: 0x000000D0 m_hWrtMtx: 0x00000154 m_hMMFEvt: 0x0000015C m_h2ndPartEvt: 0x00000158 Start_Here.exe (1312/4564) - ---->IsMgrHasIt: start of function Start_Here.exe (1312/4564) - ---->StartTransaction: start of function Start_Here.exe (1312/4564) - ---->StartTransaction: sending message to manager Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID1312 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx1312 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x00000144 waits while client will connect to pipe... HCPSMng.exe (4172/1524) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (1312/4564) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (1312/4564) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x00000164, nBytes = 132 Start_Here.exe (1312/4564) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. HCPSMng.exe (4172/1524) - <----OnIsSessionExist: session not found HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function HCPSMng.exe (4172/1524) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (1312/4564) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (1312/4564) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (1312/4564) - ---->AskMgrToCreateSession: start of function Start_Here.exe (1312/4564) - ---->StartTransaction: start of function Start_Here.exe (1312/4564) - ---->StartTransaction: sending message to manager Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnCrtSession: start of function--------------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID1312 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx1312 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x00000154 waits while client will connect to pipe... HCPSMng.exe (4172/1524) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (1312/4564) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (1312/4564) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x00000164, nBytes = 132 Start_Here.exe (1312/4564) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function HCPSMng.exe (4172/1524) - <----OnCrtSession: second part of function--------------------- Start_Here.exe (1312/4564) - ---->StartTransaction: function finished with successfully HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 41648, dwInBuffMinimum = 40624 Start_Here.exe (1312/4564) - ---->AskMgrToCreateSession: second part of transaction Start_Here.exe (1312/4564) - ---->StartTransaction: start of function Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x00000154 waits while client will connect to pipe... Start_Here.exe (1312/4564) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (1312/4564) - ---->StartTransaction: Writing to MMF buffer, hMMF = 0x00000164, nBytes = 41648 Start_Here.exe (1312/4564) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (1312/4564) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. HCPSMng.exe (4172/1524) - <----OnCrtSession: Read finished OK HCPSMng.exe (4172/1524) - <----OnCrtSession: Template.dwCb = 41648, m_CurrPT.m_dwRules=1, Template.m_szContentPath=F:\, Template.m_szLoaderPath=F:\ HCPSMng.exe (4172/1524) - <----OnCrtSession: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV HCPSMng.exe (4172/1524) - <----OnCrtSession: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe HCPSMng.exe (4172/1524) - <----InitSession: WINDOWS EXPLORER ADDED HCPSMng.exe (4172/1524) - <----InitSession: creating event for write to map file HCPSMng.exe (4172/1524) - <----OnCrtSession: New session added&enabled HCPSMng.exe (4172/1524) - <----OnCrtSession: Writing result HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function HCPSMng.exe (4172/1524) - <----OnCrtSession: WritePartConnect returned OK Start_Here.exe (1312/4564) - ---->StartTransaction: function finished with successfully Start_Here.exe (1312/4564) - ---->InitInstance: going to Start CD. HCPSMng.exe (4172/1524) - <----UpdateGPT: m_GlobalTemplate.dwCb = 719416, m_GlobalTemplate.dwUpdateCnt = 1, m_GlobalTemplate.m_dwCRC32=1712003411, m_GlobalTemplate.m_dwRules=0 Start_Here.exe (1312/4564) - ---->StartCD: started HCPSMng.exe (4172/1524) - <----UpdateGPT: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (1312/4564) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (4172/1524) - <----UpdateGPT: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe, WinWord.exe, Excel.exe HCPSMng.exe (4172/1524) - <----UpdateGPT: Content pathes: HCPSMng.exe (4172/1524) - F:\ HCPSMng.exe (4172/1524) - <----UpdateGPT: SendGPT successed HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----OnCrtSession: Polling thread creation. HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (4172/672) - CMgrWnd::DevicePollingThread - now running... HCPSMng.exe (4172/1524) - <----OnCrtSession: Polling thread created OK. HCPSMng.exe (4172/1524) - <----OnCrtSession: finished--------------------- Start_Here.exe (1312/4564) - ExitInstance: Loader is out of existence. Bye! Start_Here.exe (2716/4352) - ========== 25/03/2011 - 15:26:05 ========== Start_Here.exe (2716/4352) - ---->InitInstance: unique instance. Continue... Start_Here.exe (2716/4352) - InitInstance: starting... Start_Here.exe (2716/4352) - ---->InitInstance: SetOSType is OK Start_Here.exe (2716/4352) - ---->InitInstance: CD is original Start_Here.exe (2716/4352) - IsManagerInstalled: Entry... Start_Here.exe (2716/4352) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (2716/4352) - ---->InitInstance: going to create session. Start_Here.exe (2716/4352) - InitSession: MMF name is MMF_HCPS_SessID2716 Start_Here.exe (2716/4352) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (2716/4352) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (2716/4352) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (2716/4352) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (2716/4352) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (2716/4352) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (2716/4352) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (2716/4352) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (2716/4352) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (2716/4352) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (2716/4352) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (2716/4352) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (2716/4352) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (2716/4352) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (2716/4352) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (2716/4352) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (2716/4352) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (2716/4352) - ---->IsMgrHasIt: start of function Start_Here.exe (2716/4352) - ---->StartTransaction: start of function Start_Here.exe (2716/4352) - ---->StartTransaction: sending message to manager HCPSMng.exe (4172/1524) - <----OnIsSessionExist: start of function--------------- Start_Here.exe (2716/4352) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID2716 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx2716 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x00000174 waits while client will connect to pipe... HCPSMng.exe (4172/1524) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (2716/4352) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (2716/4352) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (2716/4352) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnIsSessionExist: session found HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function HCPSMng.exe (4172/1524) - <----OnIsSessionExist: finished. finished with successfully Start_Here.exe (2716/4352) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (2716/4352) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (2716/4352) - ---->EnableSecureSession: start of function Start_Here.exe (2716/4352) - ---->StartTransaction: start of function Start_Here.exe (2716/4352) - ---->StartTransaction: sending message to manager Start_Here.exe (2716/4352) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID2716 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx2716 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x00000184 waits while client will connect to pipe... Start_Here.exe (2716/4352) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (2716/4352) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (2716/4352) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnEnableSession: session found HCPSMng.exe (4172/1524) - <----OnEnableSession: session already enabled HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function Start_Here.exe (2716/4352) - ---->StartTransaction: function finished with successfully HCPSMng.exe (4172/1524) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 0, path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (2716/4352) - ---->InitInstance: going to Start CD. HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (2716/4352) - ---->StartCD: started HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (2716/4352) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (4172/1524) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (4172/1524) - <----OnEnableSession: updating current language. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (4172/1524) - <----OnEnableSession: finished HCPSMng.exe (4172/2952) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (2716/4352) - ExitInstance: Loader is out of existence. Bye! HCPSMng.exe (4172/2952) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (4172/1524) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/672) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/2952) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/672) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. HCPSMng.exe (4172/1524) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. HCPSMng.exe (4172/1524) - OnMediaChange: F:\ HCPSMng.exe (4172/1524) - OnMediaChange: Disable session HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. Start_Here.exe (5064/4904) - ========== 25/03/2011 - 15:30:49 ========== Start_Here.exe (5064/4904) - ---->InitInstance: unique instance. Continue... Start_Here.exe (5064/4904) - InitInstance: starting... Start_Here.exe (5064/4904) - ---->InitInstance: SetOSType is OK Start_Here.exe (5064/4904) - ---->InitInstance: CD is original Start_Here.exe (5064/4904) - IsManagerInstalled: Entry... Start_Here.exe (5064/4904) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (5064/4904) - ---->InitInstance: going to create session. Start_Here.exe (5064/4904) - InitSession: MMF name is MMF_HCPS_SessID5064 Start_Here.exe (5064/4904) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (5064/4904) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (5064/4904) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (5064/4904) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (5064/4904) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (5064/4904) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (5064/4904) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (5064/4904) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (5064/4904) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (5064/4904) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (5064/4904) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (5064/4904) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (5064/4904) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (5064/4904) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (5064/4904) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (5064/4904) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (5064/4904) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (5064/4904) - ---->IsMgrHasIt: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: sending message to manager Start_Here.exe (5064/4904) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID5064 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx5064 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x0000019C waits while client will connect to pipe... HCPSMng.exe (4172/1524) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (5064/4904) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (5064/4904) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. result from Manager... HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnIsSessionExist: session found HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: function finished with successfully HCPSMng.exe (4172/1524) - <----OnIsSessionExist: finished. Start_Here.exe (5064/4904) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (5064/4904) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (5064/4904) - ---->EnableSecureSession: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: sending message to manager Start_Here.exe (5064/4904) - ---->StartTransaction: Waiting for CreateMMF... ------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID5064 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx5064 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x000001AC waits while client will connect to pipe... Start_Here.exe (5064/4904) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (5064/4904) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (5064/4904) - ---->StartTransaction: WriteFile finished successfully. Start_Here.exe (5064/4904) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnEnableSession: session found HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function Start_Here.exe (5064/4904) - ---->StartTransaction: function finished with successfully HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 0, path=, SessId is 0x00 0x00 Start_Here.exe (5064/4904) - ---->EnableSecureSession: finished with result 1 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 1, path=, SessId is 0x00 0x00 Start_Here.exe (5064/4904) - ---->InitInstance: going to Start CD. HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (5064/4904) - ---->StartCD: started HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 Start_Here.exe (5064/4904) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (4172/1524) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (4172/1524) - <----OnEnableSession: updating current language. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (4172/1524) - <----OnEnableSession: finished HCPSMng.exe (4172/4836) - CMgrWnd::DevicePollingThread - now running... Start_Here.exe (5064/4904) - ExitInstance: Loader is out of existence. Bye! Start_Here.exe (4756/5060) - ========== 25/03/2011 - 15:33:02 ========== Start_Here.exe (4756/5060) - ---->InitInstance: unique instance. Continue... Start_Here.exe (4756/5060) - InitInstance: starting... Start_Here.exe (4756/5060) - ---->InitInstance: SetOSType is OK Start_Here.exe (4756/5060) - ---->InitInstance: CD is original Start_Here.exe (4756/5060) - IsManagerInstalled: Entry... Start_Here.exe (4756/5060) - IsManagerStarted: testing for process (2000+/9X) Start_Here.exe (4756/5060) - ---->InitInstance: going to create session. Start_Here.exe (4756/5060) - InitSession: MMF name is MMF_HCPS_SessID4756 Start_Here.exe (4756/5060) - ---->CreateSessionID: sessID=0x7D 0xF4 0x4B 0xC6 0xC1 0xB6 0x94 0x78 Start_Here.exe (4756/5060) - 0x83 0x61 0x82 0xA1 0xB2 0x66 0x05 0xA4 Start_Here.exe (4756/5060) - 0x6F 0x3D 0x0F 0x99 0xEA 0x5C 0x43 0x8B Start_Here.exe (4756/5060) - 0xE5 0x3D 0xEF 0x58 0x8B 0xDA 0xAA 0xB4 Start_Here.exe (4756/5060) - 0xC7 0xB7 0x22 0xE2 0x90 0xEC 0x13 0x9A Start_Here.exe (4756/5060) - 0x00 0xAA 0x66 0xB4 0x39 0x8E 0x4C 0x8E Start_Here.exe (4756/5060) - 0x1C 0x18 0xDD 0x0F 0xE8 0x43 0xEE 0x68 Start_Here.exe (4756/5060) - 0xED 0xC3 0x7D 0x4F 0xC8 0xC2 0x11 0x21 Start_Here.exe (4756/5060) - 0x5F 0x6E 0x7D 0x4F 0xC6 0xC9 0xFC 0x5D Start_Here.exe (4756/5060) - 0x2E 0x00 0xC6 0x74 0x59 0x0F 0x2A 0xD6 Start_Here.exe (4756/5060) - 0xAB 0x49 0xAB 0x86 0xE1 0x37 0x71 0xBF Start_Here.exe (4756/5060) - 0x93 0xF4 0x8B 0x47 0x80 0xBC 0xC4 0x25 Start_Here.exe (4756/5060) - 0x94 0x31 0x14 0xEA 0xD6 0xF9 0x4B 0xD2 Start_Here.exe (4756/5060) - 0x88 0x92 0x2F 0xD8 0x4C 0xD8 0xEF 0x25 Start_Here.exe (4756/5060) - 0x6D 0x24 0xB8 0x7D 0x9D 0x23 0x4D 0x4B Start_Here.exe (4756/5060) - 0xCE 0x00 0x26 0x34 0x77 0x97 0xF3 0x5A Start_Here.exe (4756/5060) - InitSession: m_hRdMtx: 0x00000138 m_hWrtMtx: 0x000001BC m_hMMFEvt: 0x000001C0 m_h2ndPartEvt: 0x000001C4 Start_Here.exe (4756/5060) - ---->IsMgrHasIt: start of function Start_Here.exe (4756/5060) - ---->StartTransaction: start of function Start_Here.exe (4756/5060) - ---->StartTransaction: sending message to manager Start_Here.exe (4756/5060) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnIsSessionExist: start of function--------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 132, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID4756 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx4756 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x000001CC waits while client will connect to pipe... Start_Here.exe (4756/5060) - ---->StartTransaction: Connecting to pipe... rite to MMF Start_Here.exe (4756/5060) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 132 Start_Here.exe (4756/5060) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. Start_Here.exe (4756/5060) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnIsSessionExist: session found HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function HCPSMng.exe (4172/1524) - <----OnIsSessionExist: finished. Start_Here.exe (4756/5060) - ---->StartTransaction: function finished with successfully Start_Here.exe (4756/5060) - CreatePolicyTemplate: Extensions: , GIF, HTML, JPG, MOV, RTF, WAV Start_Here.exe (4756/5060) - CreatePolicyTemplate: Processes: , ppview32.exe, pptview.exe, wordview.exe, wordpad.exe, wmplayer.exe, winamp.exe, realplay.exe, quicktimeplayer.exe, qt32.exe, qt.exe, powerpnt.exe, notepad.exe, netscape.exe, mspaint.exe, mshta.exe, mplayer2.exe, kodakprv.exe, iexplore.exe, firefox.exe, ezdicom.exe, explorer.exe, divx player.exe, dicomworks.exe, acrord32.exe, acroread.exe, acrobat.exe, acdsee7.exe, acdsee6.exe, acdsee5.exe Start_Here.exe (4756/5060) - ---->EnableSecureSession: start of function Start_Here.exe (4756/5060) - ---->StartTransaction: start of function Start_Here.exe (4756/5060) - ---->StartTransaction: sending message to manager Start_Here.exe (4756/5060) - ---->StartTransaction: Waiting for CreateMMF... HCPSMng.exe (4172/1524) - <----OnEnableSession: start of function-------------------- HCPSMng.exe (4172/1524) - <----ReadPartConnect: start of function, dwInBufSize = 652, dwInBuffMinimum = 0 HCPSMng.exe (4172/1524) - <----ReadPartConnect: MMF name is MMF_HCPS_SessID4756 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Mutex for write is HCPS_wrtMtx4756 HCPSMng.exe (4172/1524) - <----ReadPartConnect: Manager hMMF = 0x000001DC waits while client will connect to pipe... HCPSMng.exe (4172/1524) - <----ReadPartConnect: waiting while client will write to MMF Start_Here.exe (4756/5060) - ---->StartTransaction: Connecting to pipe... Start_Here.exe (4756/5060) - ---->StartTransaction: Writing to MMF SessionID, hMMF = 0x000001C8, nBytes = 652 Start_Here.exe (4756/5060) - ---->StartTransaction: WriteFile finished successfully. HCPSMng.exe (4172/1524) - <----ReadPartConnect: finished successfully. Start_Here.exe (4756/5060) - ---->StartTransaction: Waiting for returned result from Manager... HCPSMng.exe (4172/1524) - <----SearchQueueForSessId: session 0 found. HCPSMng.exe (4172/1524) - <----OnEnableSession: session found HCPSMng.exe (4172/1524) - <----OnEnableSession: session already enabled HCPSMng.exe (4172/1524) - <----WritePartConnect: start of function Start_Here.exe (4756/5060) - ---->StartTransaction: function finished with successfully HCPSMng.exe (4172/1524) - <----UpdateSessPaths: path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 0, path=F:\, SessId is 0x7D 0xF4 Start_Here.exe (4756/5060) - ---->InitInstance: going to Start CD. =, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 2, path=, SessId is 0x00 0x00 Start_Here.exe (4756/5060) - ---->StartCD: started HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 3, path=, SessId is 0x00 0x00 Start_Here.exe (4756/5060) - ---->StartCD: starting EXE file start.exe with cmd line HCPSMng.exe (4172/1524) - <----UpdateSessPaths: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: overwrite CPT with index 0, path = HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 2, path=, SessId is 0x00 0x00 Start_Here.exe (4756/5060) - ExitInstance: Loader is out of existence. Bye! HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessPaths: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----OnEnableSession: updating path in GPT. HCPSMng.exe (4172/1524) - <----OnEnableSession: sending Broadcast UWM_HCPS_CHANGED_CD. HCPSMng.exe (4172/1524) - <----OnEnableSession: updating current language. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread creation. HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread started successfully. HCPSMng.exe (4172/1524) - <----OnEnableSession: Polling thread created OK. HCPSMng.exe (4172/4160) - CMgrWnd::DevicePollingThread - now running... HCPSMng.exe (4172/1524) - <----OnEnableSession: finished HCPSMng.exe (4172/4836) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (4172/1524) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/4160) - CMgrWnd::DevicePollingThread - polling event (Disable Session) HCPSMng.exe (4172/4836) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/4160) - CMgrWnd::DevicePollingThread - just before selftermination HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=F:\, SessId is 0x7D 0xF4 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. HCPSMng.exe (4172/1524) - CMgrWnd::OnDisableSession - polling event (Disable Session) received HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. HCPSMng.exe (4172/1524) - OnMediaChange: F:\ HCPSMng.exe (4172/1524) - OnMediaChange: Disable session HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: started... HCPSMng.exe (4172/1524) - <----StartStopPollingThread: Polling Thread finished successfully. HCPSMng.exe (4172/1524) - <----UpdateSessLst: removing session from list. HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: before index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: overwrite CPT with index 0. HCPSMng.exe (4172/1524) - <----UpdateCPTNode: finished, event signaled HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 0, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 1, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 2, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 3, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - <----UpdateSessLst: after index 4, path=, SessId is 0x00 0x00 HCPSMng.exe (4172/1524) - CMgrWnd::DisableSession: ended. HCPSMng.exe (4172/1524) - CMgrWnd::WindowProc - before InstallHook HCPSMng.exe (4172/1524) - <----InstallHook: started HCPSMng.exe (4172/1524) - <----InstallHook: finished successfully HCPSMng.exe (4172/1524) - CMgrWnd::WindowProc - InstallHook finished successfully HCPSMng.exe (4172/1524) - CMgrWnd::WindowProc - FreeLibrary finished successfully HCPSMng.exe (4172/1524) - CMgrWnd::WindowProc called