EurekaLog 6.0.14 Application: ------------------------------------------------------- 1.1 Start Date : Fri, 16 Oct 2009 12:59:59 +0100 1.2 Name/Description: ModesXML.exe - (ModesXML) 1.3 Version Number : 1.2.0.148 1.4 Parameters : 1.5 Compilation Date: Thu, 8 Oct 2009 12:34:19 +0100 1.6 Up Time : 40 minutes, 45 seconds Exception: ----------------------------------------------------- 2.1 Date : Fri, 16 Oct 2009 13:40:45 +0100 2.2 Address : 00412C1C 2.3 Module Name : ModesXML.exe - (ModesXML) 2.4 Module Version: 1.2.0.148 2.5 Type : EInOutError 2.6 Message : Unable to create directory. 2.7 ID : 6247 2.8 Count : 1 2.9 Status : New 2.10 Note : User: ------------------------------------------------------- 3.1 ID : dmamw 3.2 Name : Norfolk County Council 3.3 Email : martin.warren@norfolk.gov.uk 3.4 Company : Norfolk County Council 3.5 Privileges: SeChangeNotifyPrivilege - ON SeShutdownPrivilege - OFF SeUndockPrivilege - ON SeCreateGlobalPrivilege - ON Active Controls: ---------------------------------------- 4.1 Form Class : TdlgSaveSubset 4.2 Form Text : Save subset to file 4.3 Control Class: TBitBtn 4.4 Control Text : OK Computer: -------------------------------------------------------------------------------------- 5.1 Name : CS65392 5.2 Total Memory : 1014 Mb 5.3 Free Memory : 496 Mb 5.4 Total Disk : 74.5 Gb 5.5 Free Disk : 14.66 Gb 5.6 System Up Time: 1 hour, 4 minutes, 35 seconds 5.7 Processor : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz 5.8 Display Mode : 1280 x 1024, 32 bit 5.9 Display DPI : 96 5.10 Video Card : Intel(R) Q965/Q963 Express Chipset Family (driver 6.14.10.4642) 5.11 Printer : HP Color LaserJet 2500 PCL 6 (driver 4.14.0.18) Operating System: ------------------------------------ 6.1 Type : Microsoft Windows XP 6.2 Build # : 2600 6.3 Update : Service Pack 2 6.4 Language: English 6.5 Charset : 0 Network: --------------------------------- 7.1 IP Address: 010.108.162.067 7.2 Submask : 255.255.255.000 7.3 Gateway : 010.108.162.001 7.4 DNS 1 : 073.000.001.012 7.5 DNS 2 : 073.000.001.014 7.6 DHCP : ON Custom Information: --------------------------------------------------------------------------------------------------------------------- 8.1 Server Type : Remote 8.2 StyleSheetPath : \\ncu3mx02.norfolk.gov.uk\resources\stylesheets\ 8.3 ResourcePath : \\ncu3mx02.norfolk.gov.uk\resources\ 8.4 DataPath : \ 8.5 DTDPath : \\ncu3mx02.norfolk.gov.uk\resources\dtds\ 8.6 ServerName : ncu3mx02 8.7 ServerPort : 16000 8.8 AppDataFolder : C:\Documents and Settings\dmamw\Application Data\ModesXML\ 8.9 AppTempFolder : C:\Documents and Settings\dmamw\Application Data\ModesXML\Temp\ 8.10 Transport : nxWinsockModes 8.11 Logged in user : dmamw 8.12 Server version : 2.0701 (ModesXML@ncu3mx02) 8.13 Uptime : 7.20:36:10 8.14 Sessions : 15 8.15 Databases : 18 8.16 Transaction Contexts : 18 8.17 Cursors : 111 8.18 Statements : 0 8.19 Folders : 4 8.20 Tables : 28 8.21 Block Cache Available (Recently / Frequently): 1,047,552 ( 1,045,556 / 1,996 ) kbyte 8.22 Block Cache Used (Recently / Frequently) : 1,004,948 ( 1,004,948 / 0 ) kbyte 8.23 Block Cache Tracked (Recently / Frequently) : 28 ( 28 / 0 ) kbyte 8.24 Block Cache Miss Recently Used : 238,144 8.25 Block Cache Miss Frequently Used : 0 8.26 Block Cache Hit Recently Used : 566,517,209 8.27 Block Cache Hit Frequently Used : 0 8.28 Block Cache Eviction Recently Used : 0 8.29 Block Cache Eviction Frequently Used : 0 8.30 Transaction Commit : 4,657 8.31 Transaction Commit Nested : 121,116 8.32 Transaction Rollback : 10 8.33 Transaction Rollback Nested : 24,879 8.34 Blocks Read : 238,144 8.35 Blocks Written : 123,978 8.36 Temporary Storage in use : 0 kbyte 8.37 Registered User Name : MX0083 8.38 Registered Institution : Norfolk Museums and Archaeology Service 8.39 Max. number of screens : 35 8.40 Number of users logged on : 2 8.41 User dmssg : 10.107.164.139 8.42 User dmamw : 10.108.162.67 Call Stack Information: ------------------------------------------------------------------------------------------------------------------- |Address |Module |Unit |Class |Procedure/Method |Line | ------------------------------------------------------------------------------------------------------------------- |Running Thread: ID=3348; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------------| |00BD91F5|ModesXML.exe|dSaveSubset.pas |TdlgSaveSubset |btnOKClick |69[1] | |7E41BFFB|user32.dll | | |NotifyWinEvent | | |7E41F891|user32.dll | | |CallNextHookEx | | |7C90F1CB|ntdll.dll | | |RtlMultiByteToUnicodeN | | |7C90F0A5|ntdll.dll | | |RtlAnsiStringToUnicodeString | | |7C90D9BF|ntdll.dll | | |NtFindAtom | | |7E41F658|user32.dll | | |CallWindowProcA | | |7E41F642|user32.dll | | |CallWindowProcA | | |7E41C660|user32.dll | | |CallWindowProcW | | |7E41C64A|user32.dll | | |CallWindowProcW | | |005540BC|ModesXML.exe|TntControls.pas |TWinControlTrap |DefWin32Proc |611[25] | |7E41F891|user32.dll | | |CallNextHookEx | | |0086EE13|ModesXML.exe|cxContainer.pas | |ApplicationCallWndProcHookProc|5940[13] | |7C90F1CB|ntdll.dll | | |RtlMultiByteToUnicodeN | | |7C90F0A5|ntdll.dll | | |RtlAnsiStringToUnicodeString | | |7E41F85B|user32.dll | | |CallNextHookEx | | |00898E7D|ModesXML.exe|dxBar.pas | |dxBarWndProcHook |13542[30]| |7E41B8FE|user32.dll | | |SendMessageW | | |7E41B8BA|user32.dll | | |SendMessageW | | |7E41F658|user32.dll | | |CallWindowProcA | | |7E41F642|user32.dll | | |CallWindowProcA | | |7E41F85B|user32.dll | | |CallNextHookEx | | |005570F4|ModesXML.exe|TntForms.pas | |GetMessageForNT |783[10] | |7E4194DA|user32.dll | | |GetCapture | | |7E4196C2|user32.dll | | |DispatchMessageA | | |7E4196B8|user32.dll | | |DispatchMessageA | | |00C02C85|ModesXML.exe|fdisplay.pas |TfrmDisplay |SaveSubsetToFile |5673[6] | |00C02C10|ModesXML.exe|fdisplay.pas |TfrmDisplay |SaveSubsetToFile |5667[0] | |00C025DB|ModesXML.exe|fdisplay.pas |TfrmDisplay |SaveSubset |5593[2] | |00C025D4|ModesXML.exe|fdisplay.pas |TfrmDisplay |SaveSubset |5591[0] | |00C074F5|ModesXML.exe|fdisplay.pas |TfrmDisplay |actSaveSubsetToFileExecute |7574[1] | |00C074F0|ModesXML.exe|fdisplay.pas |TfrmDisplay |actSaveSubsetToFileExecute |7573[0] | |00C31035|ModesXML.exe|fmain.pas |TfrmMain |actSaveSubsetToFileExecute |1431[2] | |00554268|ModesXML.exe|TntControls.pas |TWinControlTrap |WindowProc |672[19] | |7E41C660|user32.dll | | |CallWindowProcW | | |7E41C64A|user32.dll | | |CallWindowProcW | | |00553EBC|ModesXML.exe|TntControls.pas |TWinControlTrap |Win32Proc |560[12] | |7E4196C2|user32.dll | | |DispatchMessageA | | |7E4196B8|user32.dll | | |DispatchMessageA | | |00C38AD1|ModesXML.exe|ModesXML.dpr | | |175[17] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | |-----------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=4088; Priority=0; Class= | |-----------------------------------------------------------------------------------------------------------------| |7C90E9A9|ntdll.dll | | |ZwWaitForMultipleObjects | | |7C90E787|ntdll.dll | | |ZwSetTimer | | |7C80952A|kernel32.dll| | |WaitForMultipleObjectsEx | | |7C80A070|kernel32.dll| | |WaitForMultipleObjects | | |7C80A05D|kernel32.dll| | |WaitForMultipleObjects | | |0060E9CF|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1837[2] | |0060E9BC|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1835[0] | |0060E906|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1811[29] | |0060E7E4|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1782[0] | |0060E5DB|ModesXML.exe|nxsrFileImplWin32.pas | |FlushThreadProc |1723[17] | |-----------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=3348; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------------| |00C389AF|ModesXML.exe|ModesXML.dpr | | |158[0] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | |-----------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=3448; Priority=15; Class=TnxHeartbeatThread | |-----------------------------------------------------------------------------------------------------------------| |7C90E9BE|ntdll.dll | | |NtWaitForSingleObject | | |7C802540|kernel32.dll| | |WaitForSingleObjectEx | | |7C80252D|kernel32.dll| | |WaitForSingleObject | | |7C802520|kernel32.dll| | |WaitForSingleObject | | |006A6411|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |InnerExecute |2218[3] | |005D6D28|ModesXML.exe|nxllThread.pas |TnxInitThread |DoExecute |704[14] | |005D6B45|ModesXML.exe|nxllThread.pas |TnxThread |Execute |507[3] | |-----------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=3348; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------------| |005D6A2F|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |418[1] | |005D6A2C|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |417[0] | |005D6C2C|ModesXML.exe|nxllThread.pas |TnxInitThread |AfterConstruction |667[1] | |006A630F|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2191[7] | |006A6204|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2184[0] | |006A9F42|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3914[30] | |006A9E50|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3884[0] | |006B3119|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |scStarting |1612[1] | |004B7277|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1945[38] | |7C913229|ntdll.dll | | |LdrUnlockLoaderLock | | |004B754D|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scShouldFollowTransition |1995[6] | |004B6F38|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scDependentStateChange |1843[9] | |004B6CC7|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1763[4] | |004B6C80|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1759[0] | |006A2782|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2019[1] | |006A276C|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2018[0] | |006B2DFE|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |nxcNotification |1561[1] | |004B616B|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcNotifyDependents |1314[10] | |004B7649|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scStateChanging |2050[6] | |004B7173|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1921[14] | |7C901005|ntdll.dll | | |RtlEnterCriticalSection | | |7C9131D7|ntdll.dll | | |LdrLockLoaderLock | | |00492604|ModesXML.exe|nxllUtils.pas | |nxCmpPtr |526[1] | |004906D3|ModesXML.exe|nxllList.pas |TnxSortedList |slCompare |712[1] | |00490666|ModesXML.exe|nxllList.pas |TnxSortedList |Find |689[7] | |00490483|ModesXML.exe|nxllList.pas |TnxSortedList |Add |645[5] | |0048F1B4|ModesXML.exe|nxllSync.pas |TnxPadlock |Unlock |372[1] | |00490A02|ModesXML.exe|nxllList.pas |TnxListPadlock |EndWrite |878[1] | |00490715|ModesXML.exe|nxllList.pas |TnxListSyncAccess |Add |724[4] | |004906DC|ModesXML.exe|nxllList.pas |TnxListSyncAccess |Add |720[0] | |004B5D7A|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcAddDependent |1189[5] | |005EA14F|ModesXML.exe|nxdb.pas |TnxBaseSession |nxcAddDependent |5135[4] | |004B5E08|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcAddDependingOn |1198[5] | |004B6F67|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetActive |1867[2] | |008FB623|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |416[74] | |008FB088|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |342[0] | |008FDD28|ModesXML.exe|dmUser.pas |TuserDm |Login |820[2] | |008FDCF8|ModesXML.exe|dmUser.pas |TuserDm |Login |818[0] | |00C38A6C|ModesXML.exe|ModesXML.dpr | | |169[11] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | ------------------------------------------------------------------------------------------------------------------- Modules Information: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |Handle |Name |Description |Version |Size |Modified |Path | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |00400000|ModesXML.exe |ModesXML |1.2.0.148 |11730432|2009-10-08 12:34:22|C:\Program Files\ModesXML\Client | |025F0000|shdoclc.dll |Shell Doc Object and Control Library |6.0.2900.2180 |549376 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |02B00000|ModesPDF.dll |WPViewPDF |1.4.1.0 |1108352 |2007-07-13 11:52:24|C:\Program Files\ModesXML\Client | |031F0000|XfoInterface41.dll |XfoInterface |4.1.2007.704 |225280 |2007-07-04 14:04:30|C:\Program Files\ModesXML\Client\AHFO4_1 | |03230000|pthreadVSE2.dll | |2.2.0.0 |86071 |2005-04-08 16:27:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |03250000|XfoFont41.dll |XfoFont |4.1.2007.704 |147456 |2007-07-04 13:53:46|C:\Program Files\ModesXML\Client\AHFO4_1 | |03280000|XfoText41.dll |XfoText |4.1.2007.704 |86016 |2007-07-04 13:54:00|C:\Program Files\ModesXML\Client\AHFO4_1 | |036B0000|XfoHyphen41.dll |XfoHyphen |4.1.2007.704 |81920 |2007-07-04 14:00:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |03770000|XfoTrans41.dll |XfoTrans |4.1.2007.704 |110592 |2007-07-04 14:02:52|C:\Program Files\ModesXML\Client\AHFO4_1 | |03830000|XfoEngine41.dll |XfoEngine |4.1.2007.704 |1523712 |2007-07-04 14:02:48|C:\Program Files\ModesXML\Client\AHFO4_1 | |039B0000|XfoDMC41.dll |XfoDMC |4.1.2007.704 |360448 |2007-07-04 13:52:58|C:\Program Files\ModesXML\Client\AHFO4_1 | |03C10000|AHFont20.dll | | |987136 |2007-07-04 13:53:40|C:\Program Files\ModesXML\Client\AHFO4_1 | |03D10000|XfoCommon41.dll |XfoCommon |4.1.2007.704 |909312 |2007-07-04 13:53:32|C:\Program Files\ModesXML\Client\AHFO4_1 | |03E00000|XfoGraphic41.dll |XfoGraphic |4.1.2007.704 |1765376 |2007-07-04 14:00:14|C:\Program Files\ModesXML\Client\AHFO4_1 | |03FC0000|PDFToolPage10.dll | | |749568 |2007-07-04 13:53:56|C:\Program Files\ModesXML\Client\AHFO4_1 | |04080000|AHGraphic20.dll | | |811008 |2007-06-29 22:40:04|C:\Program Files\ModesXML\Client\AHFO4_1 | |04150000|PDFExplorer21.dll | | |1118208 |2007-07-04 13:54:06|C:\Program Files\ModesXML\Client\AHFO4_1 | |04270000|PDFRes10.dll | | |3731456 |2007-07-04 13:54:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |04600000|XfoHyphenCH41.dll |XfoHyphenCH |4.1.2007.704 |835584 |2007-07-04 14:00:40|C:\Program Files\ModesXML\Client\AHFO4_1 | |046D0000|XfoGdiCtl41.dll |XfoGdiCtl |4.1.2007.704 |266240 |2007-07-04 14:04:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |04720000|XfoRender41.dll |XfoRender |4.1.2007.704 |2420736 |2007-07-04 14:04:10|C:\Program Files\ModesXML\Client\AHFO4_1 | |04980000|PDFCreator25.dll | | |1253376 |2007-07-04 14:03:00|C:\Program Files\ModesXML\Client\AHFO4_1 | |04AC0000|PDFLinearizer11.dll| | |708608 |2007-07-04 14:03:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |04B80000|SVGCreator41.dll |SVGCreator |4.1.2007.704 |434176 |2007-07-04 14:03:06|C:\Program Files\ModesXML\Client\AHFO4_1 | |05B70000|mshtml.dll |Microsoft (R) HTML Viewer |6.0.2900.3157 |3058688 |2007-06-14 19:09:20|C:\WINDOWS\system32 | |10000000|XfoComCtl41.dll |XfoComCtl |4.1.2007.704 |90112 |2007-07-04 14:04:32|C:\Program Files\ModesXML\Client\AHFO4_1 | |10100000|lgscroll.dll |Logitech Scroll Enabler (UNICODE) |3.15.231.0 |44544 |2006-10-25 17:13:44|C:\Program Files\Logitech\SetPoint | |20000000|xpsp2res.dll |Service Pack 2 Messages |5.1.2600.2180 |2897920 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |4A800000|icuuc34.dll |IBM ICU Common DLL |3.4.1.0 |819200 |2006-07-18 13:33:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |4A900000|icuin34.dll |IBM ICU I18N DLL |3.4.1.0 |696320 |2006-07-18 13:33:20|C:\Program Files\ModesXML\Client\AHFO4_1 | |4AD00000|icudt34.dll |ICU Data DLL |3.4.1.0 |8876032 |2006-07-18 13:33:20|C:\Program Files\ModesXML\Client\AHFO4_1 | |4EC50000|gdiplus.dll |Microsoft GDI+ |5.1.3102.2180 |1712128 |2004-08-04 13:00:00|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82 | |5AD70000|UxTheme.dll |Microsoft UxTheme Library |6.0.2900.2180 |218624 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |5B860000|NETAPI32.dll |Net Win32 API DLL |5.1.2600.3462 |332800 |2008-10-15 17:57:56|C:\WINDOWS\system32 | |5D090000|comctl32.dll |Common Controls Library |5.82.2900.2982 |617472 |2006-08-25 16:45:58|C:\WINDOWS\system32 | |5EDD0000|olepro32.dll | |5.1.2600.2180 |83456 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |662B0000|hnetcfg.dll |Home Networking Configuration Manager |5.1.2600.2180 |344064 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |69B10000|msxml4.dll |MSXML 4.0 SP 2 |4.20.9848.0 |1275392 |2007-05-08 15:03:04|C:\WINDOWS\system32 | |6FA00000|sophos_detoured.dll|Sophos Buffer Overrun Protection |1.0.0.4030 |195072 |2009-09-03 08:37:26|C:\Program Files\Sophos\Sophos Anti-Virus | |71A50000|mswsock.dll |Microsoft Windows Sockets 2.0 Service Provider |5.1.2600.2180 |245248 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71A90000|wshtcpip.dll |Windows Sockets Helper DLL |5.1.2600.2180 |19968 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |71AA0000|WS2HELP.dll |Windows Socket 2.0 Helper for Windows NT |5.1.2600.2180 |19968 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71AB0000|WS2_32.dll |Windows Socket 2.0 32-Bit DLL |5.1.2600.2180 |82944 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71AD0000|wsock32.dll |Windows Socket 32-Bit DLL |5.1.2600.2180 |22528 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71B20000|mpr.dll |Multiple Provider Router DLL |5.1.2600.2180 |59904 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71BF0000|SAMLIB.dll |SAM Library DLL |5.1.2600.2180 |64000 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |71C10000|ntlanman.dll |Microsoft® Lan Manager |5.1.2600.2180 |43520 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |71C80000|NETRAP.dll |Net Remote Admin Protocol DLL |5.1.2600.2180 |12288 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |71C90000|NETUI1.dll |NT LM UI Common Code - Networking classes |5.1.2600.2180 |245760 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |71CD0000|NETUI0.dll |NT LM UI Common Code - GUI Classes |5.1.2600.2180 |80896 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |72D10000|msacm32.drv |Microsoft Sound Mapper |5.1.2600.0 |20480 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |72D20000|wdmaud.drv |WDM Audio driver mapper |5.1.2600.2180 |23552 |2004-08-04 00:56:58|C:\WINDOWS\system32 | |73000000|winspool.drv |Windows Spooler Driver |5.1.2600.2180 |146432 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |732E0000|RICHED32.DLL |Wrapper Dll for Richedit 1.0 |5.1.2600.0 |3584 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |73B30000|mscms.dll |Microsoft Color Matching System DLL |5.1.2600.2709 |74240 |2005-06-29 02:46:00|C:\WINDOWS\system32 | |73B50000|avifil32.dll |Microsoft AVI File support library |5.1.2600.2180 |84992 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |73BA0000|sti.dll |Still Image Devices client DLL |5.1.2600.2180 |67584 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |73BC0000|DCIMAN32.DLL |DCI Manager |5.1.2600.2180 |8704 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |746C0000|msls31.dll |Microsoft Line Services library file |3.10.349.0 |146432 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |74720000|MSCTF.dll |MSCTF Server DLL |5.1.2600.2180 |294400 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |74AE0000|CFGMGR32.dll |Configuration Manager Forwarder DLL |5.1.2600.2180 |16896 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |74C80000|oleacc.dll |Active Accessibility Core Component |4.2.5406.0 |163328 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |74D90000|USP10.dll |Uniscribe Unicode script processor |1.420.2600.2180 |406528 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |74E30000|RICHED20.DLL |Rich Text Edit Control, v3.0 |5.30.23.1228 |433152 |2006-11-27 15:54:06|C:\WINDOWS\system32 | |754D0000|CRYPTUI.dll |Microsoft Trust UI Provider |5.131.2600.2180 |512512 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |75A70000|MSVFW32.dll |Microsoft Video for Windows DLL |5.1.2600.2180 |120832 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |75CF0000|MLANG.dll |Multi Language Support DLL |6.0.2900.2180 |586240 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |75E90000|SXS.DLL |Fusion 2.5 |5.1.2600.3019 |713216 |2006-10-19 14:56:32|C:\WINDOWS\system32 | |75F60000|drprov.dll |Microsoft Terminal Server Network Provider |5.1.2600.2180 |14336 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |75F70000|davclnt.dll |Web DAV Client DLL |5.1.2600.2180 |24576 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |75F80000|browseui.dll |Shell Browser UI Library |6.0.2900.3157 |1023488 |2007-06-14 19:09:18|C:\WINDOWS\system32 | |76080000|MSVCP60.dll |Microsoft (R) C++ Runtime Library |6.2.3104.0 |413696 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76380000|msimg32.dll |GDIEXT Client DLL |5.1.2600.2180 |4608 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |763B0000|comdlg32.dll |Common Dialogs DLL |6.0.2900.2180 |276992 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76600000|CSCDLL.dll |Offline Network Agent |5.1.2600.2180 |101888 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |76990000|ntshrui.dll |Shell extensions for sharing |5.1.2600.2180 |143872 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |769C0000|USERENV.dll |Userenv |5.1.2600.2180 |723456 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76B20000|ATL.DLL |ATL Module for Windows XP (Unicode) |3.5.2284.0 |58880 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76B40000|winmm.dll |MCI API DLL |5.1.2600.2180 |176128 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76BF0000|PSAPI.DLL |Process Status Helper |5.1.2600.2180 |23040 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76C30000|WINTRUST.dll |Microsoft Trust Verification APIs |5.131.2600.2180 |176640 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76C90000|IMAGEHLP.dll |Windows NT Image Helper |5.1.2600.2180 |144384 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76F20000|DNSAPI.dll |DNS Client API DLL |5.1.2600.2938 |148480 |2006-06-26 18:37:10|C:\WINDOWS\system32 | |76F60000|WLDAP32.dll |Win32 LDAP API DLL |5.1.2600.2180 |172032 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |76FB0000|winrnr.dll |LDAP RnR Provider DLL |5.1.2600.2180 |16896 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |76FC0000|rasadhlp.dll |Remote Access AutoDial Helper |5.1.2600.2938 |8192 |2006-06-26 18:37:10|C:\WINDOWS\system32 | |76FD0000|CLBCATQ.DLL | |2001.12.4414.308|498688 |2005-07-26 05:39:44|C:\WINDOWS\system32 | |77050000|COMRes.dll | |2001.12.4414.258|792064 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77120000|oleaut32.dll | |5.1.2600.3139 |549376 |2007-05-17 12:28:06|C:\WINDOWS\system32 | |771B0000|wininet.dll |Internet Extensions for Win32 |6.0.2900.3164 |658944 |2007-06-26 15:09:10|C:\WINDOWS\system32 | |773D0000|comctl32.dll |User Experience Controls Library |6.0.2900.2982 |1054208 |2006-08-25 16:45:56|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03| |774E0000|ole32.dll |Microsoft OLE for Windows |5.1.2600.2726 |1285120 |2005-07-26 05:39:48|C:\WINDOWS\system32 | |77690000|NTMARTA.DLL |Windows NT MARTA provider |5.1.2600.2180 |118784 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77920000|SETUPAPI.dll |Windows Setup API |5.1.2600.2938 |985088 |2006-06-26 18:51:30|C:\WINDOWS\system32 | |77A20000|cscui.dll |Client Side Caching UI |5.1.2600.2180 |326656 |2004-08-04 13:00:00|C:\WINDOWS\System32 | |77A80000|CRYPT32.dll |Crypto API32 |5.131.2600.2180 |597504 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77B20000|MSASN1.dll |ASN.1 Runtime APIs |5.1.2600.2180 |57344 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77B40000|appHelp.dll |Application Compatibility Client Library |5.1.2600.2180 |126976 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77BD0000|midimap.dll |Microsoft MIDI Mapper |5.1.2600.2180 |18944 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77BE0000|MSACM32.dll |Microsoft ACM Audio Filter |5.1.2600.2180 |71680 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77C00000|version.dll |Version Checking and File Installation Libraries|5.1.2600.2180 |18944 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77C10000|msvcrt.dll |Windows NT CRT DLL |7.0.2600.2180 |343040 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77DD0000|advapi32.dll |Advanced Windows 32 Base API |5.1.2600.2180 |616960 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77E70000|RPCRT4.dll |Remote Procedure Call Runtime |5.1.2600.2180 |581120 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |77F10000|GDI32.dll |GDI Client DLL |5.1.2600.3159 |282112 |2007-06-19 14:31:20|C:\WINDOWS\system32 | |77F60000|SHLWAPI.dll |Shell Light-weight Utility Library |6.0.2900.3157 |474112 |2007-06-14 19:09:20|C:\WINDOWS\system32 | |77FE0000|Secur32.dll |Security Support Provider Interface |5.1.2600.2180 |55808 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |78130000|MSVCR80.dll |Microsoft® C Runtime Library |8.0.50727.163 |626688 |2006-06-05 14:14:28|C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb | |7C340000|MSVCR71.dll |Microsoft® C Runtime Library |7.10.3052.4 |348160 |2004-04-20 10:58:04|C:\Program Files\ModesXML\Client\AHFO4_1 | |7C420000|MSVCP80.dll |Microsoft® C++ Runtime Library |8.0.50727.163 |548864 |2006-06-05 14:14:28|C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb | |7C800000|kernel32.dll |Windows NT BASE API Client DLL |5.1.2600.3119 |984576 |2007-04-16 16:52:54|C:\WINDOWS\system32 | |7C900000|ntdll.dll |NT Layer DLL |5.1.2600.2180 |708096 |2004-08-04 13:00:00|C:\WINDOWS\system32 | |7C9C0000|shell32.dll |Windows Shell Common Dll |6.0.2900.3051 |8453632 |2006-12-19 22:52:18|C:\WINDOWS\system32 | |7E1E0000|urlmon.dll |OLE32 Extensions for Win32 |6.0.2900.3157 |615424 |2007-06-14 19:09:20|C:\WINDOWS\system32 | |7E290000|shdocvw.dll |Shell Doc Object and Control Library |6.0.2900.3157 |1494528 |2007-06-14 19:09:20|C:\WINDOWS\system32 | |7E410000|user32.dll |Windows XP USER API Client DLL |5.1.2600.3099 |577536 |2007-03-08 16:36:28|C:\WINDOWS\system32 | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Processes Information: ----------------------------------------------------------------------------------------------------------------------------------------------------------- |ID |Name |Description |Version |Memory |Priority|Threads|Path | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |696 |svchost.exe |Generic Host Process for Win32 Services |5.1.2600.2180|3358720 |Normal |2 |C:\WINDOWS\System32 | |756 |svchost.exe |Generic Host Process for Win32 Services |5.1.2600.2180|3338240 |Normal |2 |C:\WINDOWS\System32 | |1032|smax4pnp.exe |SMax4PNP |6.0.0.61 |4759552 |Normal |3 |C:\Program Files\Analog Devices\Core | |1100|KHALMNPR.EXE |Logitech KHAL Main Process |3.1.206.0 |5120000 |Normal |15 |C:\Program Files\Common Files\Logitech\khalshared| |1188|igfxpers.exe |persistence Module |3.0.0.4642 |3309568 |Normal |3 |C:\WINDOWS\system32 | |2372|DrgToDsc.exe |Drag To Disc Application |9.0.0.53 |6303744 |Normal |4 |C:\Program Files\Roxio\Drag-to-Disc | |2456|OUTLOOK.EXE |Microsoft Office Outlook |11.0.5510.0 |23896064|Normal |16 |C:\Program Files\Microsoft Office\OFFICE11 | |2460|SetPoint.exe |Logitech SetPoint Event Manager (UNICODE) |3.15.231.0 |8658944 |Normal |3 |C:\Program Files\Logitech\SetPoint | |2536|hkcmd.exe |hkcmd Module |3.0.0.4642 |3358720 |Normal |2 |C:\WINDOWS\system32 | |2748|ModesXML.exe |ModesXML |1.2.0.148 |45244416|Normal |14 |C:\Program Files\ModesXML\Client | |3116|PDVDDXSrv.exe|CyberLink PowerCinema Resident Program |4.5.0.0 |5894144 |Normal |2 |C:\Program Files\CyberLink\PowerDVD DX | |3320|SCFTray.exe |Sophos Client Firewall Tray icon |1.5.0.193 |4685824 |Normal |7 |C:\Program Files\Sophos\Sophos Client Firewall | |3532|ctfmon.exe |CTF Loader |5.1.2600.2180|4173824 |Normal |1 |C:\WINDOWS\system32 | |3724|Explorer.EXE |Windows Explorer |6.0.2900.3156|19959808|Normal |10 |C:\WINDOWS | |3760|ALMon.exe |Component to show AutoUpdate's GUI elements.|3.11.56.190 |339968 |Normal |5 |C:\Program Files\Sophos\AutoUpdate | |3996|PNAMAIN.EXE |Citrix Applications |11.0.0.5357 |8118272 |Normal |5 |C:\Program Files\Citrix\ICA Client | ----------------------------------------------------------------------------------------------------------------------------------------------------------- Assembler Information: ----------------------------------------------------------------- 00412BF7 mov bl, $01 00412BF9 cmp dword ptr [ebp-$04], +$00 00412BFD jnz +$22 00412BFF mov ecx, [$C826C4] 00412C05 mov dl, $01 00412C07 mov eax, dword ptr [EInOutError] 00412C0C call +$000066E7 00412C11 mov edx, eax 00412C13 mov dword ptr [edx+$0C], $00000003 ; ''... 00412C1A mov eax, edx 00412C1C call -$0000D9AD ; <-- EXCEPTION 00412C21 lea edx, [ebp-$08] 00412C24 mov eax, [ebp-$04] 00412C27 call +$000073BC 00412C2C mov edx, [ebp-$08] 00412C2F lea eax, [ebp-$04] 00412C32 call -$0000D27F 00412C37 mov eax, [ebp-$04] 00412C3A call -$0000D033 00412C3F cmp eax, +$03 00412C42 jl +$4D Registers: ----------------------------- EAX: 7ED8EC20 EDI: 0012F188 EBX: 7F9A0301 ESI: 004D5290 ECX: 00000000 ESP: 0012EFC0 EDX: 00412C21 EIP: 00412C1C Stack: Memory Dump: ------------------ --------------------------------------------------------------------------- 0012EFC0: 0012EFE8 00412C1C: E8 53 26 FF FF 8D 55 F8 8B 45 FC E8 BC 73 00 00 .S&...U..E...s.. 0012EFC4: 004051A8 00412C2C: 8B 55 F8 8D 45 FC E8 81 2D FF FF 8B 45 FC E8 CD .U..E...-...E... 0012EFC8: 0012EFE0 00412C3C: 2F FF FF 83 F8 03 7C 4D 8B 45 FC E8 64 FF FF FF /.....|M.E..d... 0012EFCC: 7F9A0370 00412C4C: 84 C0 75 41 8D 55 F4 8B 45 FC E8 71 03 00 00 8B ..uA.U..E..q.... 0012EFD0: 00000000 00412C5C: 45 F4 8B 55 FC E8 F2 30 FF FF 74 29 8D 55 F0 8B E..U...0..t).U.. 0012EFD4: 00000000 00412C6C: 45 FC E8 59 03 00 00 8B 45 F0 E8 59 FF FF FF 84 E..Y....E..Y.... 0012EFD8: 00000000 00412C7C: C0 74 0C 8B 45 FC E8 B9 0B 00 00 84 C0 75 04 33 .t..E........u.3 0012EFDC: 00000000 00412C8C: DB EB 02 B3 01 33 C0 5A 59 59 64 89 10 68 B3 2C .....3.ZYYd..h., 0012EFE0: 0012F004 00412C9C: 41 00 8D 45 F0 BA 04 00 00 00 E8 99 2C FF FF C3 A..E........,... 0012EFE4: 00BD91FA 00412CAC: E9 C7 24 FF FF EB EB 8B C3 5B 8B E5 5D C3 8B C0 ..$......[..]... 0012EFE8: 0012F308 00412CBC: 55 8B EC 83 C4 EC 53 8B D8 8D 45 F4 50 6A 00 6A U.....S...E.Pj.j 0012EFEC: 004051A8 00412CCC: 00 53 E8 A1 5E FF FF 85 C0 74 26 8D 45 EC 50 8D .S..^....t&.E.P. 0012EFF0: 0012F004 00412CDC: 45 F4 50 E8 78 5D FF FF 85 C0 74 15 8D 45 FC 50 E.P.x]....t..E.P 0012EFF4: 7FA4F570 00412CEC: 8D 45 FE 50 8D 45 EC 50 E8 5B 5D FF FF 85 C0 75 .E.P.E.P.[]....u 0012EFF8: 00000000 00412CFC: 07 C7 45 FC FF FF FF FF 8B 45 FC 5B 8B E5 5D C3 ..E......E.[..]. 0012EFFC: 00000000 00412D0C: 55 8B EC 83 C4 EC 53 56 89 55 FC 8B F0 33 DB 8D U.....SV.U...3..