EurekaLog 6.0.14 Application: ------------------------------------------------------- 1.1 Start Date : Mon, 7 Dec 2009 12:39:35 +0000 1.2 Name/Description: ModesXML.exe - (ModesXML) 1.3 Version Number : 1.2.0.154 1.4 Parameters : 1.5 Compilation Date: Mon, 30 Nov 2009 10:00:21 +0000 1.6 Up Time : 2 minutes, 12 seconds Exception: --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 2.1 Date : Mon, 7 Dec 2009 12:41:48 +0000 2.2 Address : 0042F3EC 2.3 Module Name : ModesXML.exe - (ModesXML) 2.4 Module Version: 1.2.0.154 2.5 Type : EFCreateError 2.6 Message : Cannot create file "S:\Staff\ASC\Projects\Probate\DatabaseEnquiriesTraining.pdf". The process cannot access the file because it is being used by another process. 2.7 ID : 1DA2 2.8 Count : 1 2.9 Status : New 2.10 Note : User: ------------------------------------------------------- 3.1 ID : dul0ajg 3.2 Name : ITS 3.3 Email : a.j.gray@durham.ac.uk 3.4 Company : University of Durham 3.5 Privileges: SeChangeNotifyPrivilege - ON SeSecurityPrivilege - OFF SeBackupPrivilege - OFF SeRestorePrivilege - OFF SeSystemtimePrivilege - OFF SeShutdownPrivilege - OFF SeRemoteShutdownPrivilege - OFF SeTakeOwnershipPrivilege - OFF SeDebugPrivilege - OFF SeSystemEnvironmentPrivilege - OFF SeSystemProfilePrivilege - OFF SeProfileSingleProcessPrivilege - OFF SeIncreaseBasePriorityPrivilege - OFF SeLoadDriverPrivilege - ON SeCreatePagefilePrivilege - OFF SeIncreaseQuotaPrivilege - OFF SeUndockPrivilege - ON SeManageVolumePrivilege - OFF SeImpersonatePrivilege - ON SeCreateGlobalPrivilege - ON Active Controls: ------------------------------------------------------------------------------------------------------- 4.1 Form Class : TfrmMain.UnicodeClass 4.2 Form Text : ModesXML - [Application: ModesXML help files. File: Documentation for NEI project] 4.3 Control Class: TWPViewPDF 4.4 Control Text : Computer: ------------------------------------------------------------------------------- 5.1 Name : C5LIB-02 5.2 Total Memory : 2001 Mb 5.3 Free Memory : 1286 Mb 5.4 Total Disk : 1.95 Gb 5.5 Free Disk : 0.43 Gb 5.6 System Up Time: 3 hours, 27 minutes, 25 seconds 5.7 Processor : Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz 5.8 Display Mode : 1152 x 864, 32 bit 5.9 Display DPI : 96 5.10 Video Card : Intel(R) Q35 Express Chipset Family (driver 6.14.10.4837) 5.11 Printer : HP LaserJet P2015 Series PCL 6 (driver 6.0.6001.22127) Operating System: ------------------------------------ 6.1 Type : Microsoft Windows XP 6.2 Build # : 2600 6.3 Update : Service Pack 3 6.4 Language: English 6.5 Charset : 0 Network: --------------------------------- 7.1 IP Address: 129.234.109.005 7.2 Submask : 255.255.255.000 7.3 Gateway : 129.234.109.254 7.4 DNS 1 : 129.234.004.013 7.5 DNS 2 : 129.234.004.009 7.6 DHCP : OFF Custom Information: ------------------------------------------------------------------------------------------------------- 8.1 Server Type : Remote 8.2 StyleSheetPath : S:\Guest\Modes\stylesheets\ 8.3 ResourcePath : S:\Guest\Modes\ 8.4 DataPath : \ 8.5 DTDPath : S:\Guest\Modes\dtds\ 8.6 ServerName : lewis.dur.ac.uk 8.7 ServerPort : 16000 8.8 AppDataFolder : \\stevens\dul0ajg\application_data\ModesXML\ 8.9 AppTempFolder : \\stevens\dul0ajg\application_data\ModesXML\Temp\ 8.10 Application : Help 8.11 FileName : Probate documentation 8.12 FileIndex : id 8.13 SplitMode : False 8.14 EditMode : True 8.15 ActiveLeftTab : pdf 8.16 LeftTabStylesheet : Print single formatted page 8.17 ActiveRightTab : N/A 8.18 RightTabStylesheet : N/A 8.19 Transport : nxWinsockModes 8.20 Logged in user : dul0ajg 8.21 Server version : 2.0701 (ModesXML@lewis.dur.ac.uk) 8.22 Uptime : 38.13:45:29 8.23 Sessions : 15 8.24 Databases : 19 8.25 Transaction Contexts : 19 8.26 Cursors : 117 8.27 Statements : 0 8.28 Folders : 8 8.29 Tables : 28 8.30 Block Cache Available (Recently / Frequently): 523,264 ( 521,268 / 1,996 ) kbyte 8.31 Block Cache Used (Recently / Frequently) : 22,404 ( 22,404 / 0 ) kbyte 8.32 Block Cache Tracked (Recently / Frequently) : 40 ( 40 / 0 ) kbyte 8.33 Block Cache Miss Recently Used : 396,108 8.34 Block Cache Miss Frequently Used : 0 8.35 Block Cache Hit Recently Used : 363,134,133 8.36 Block Cache Hit Frequently Used : 0 8.37 Block Cache Eviction Recently Used : 0 8.38 Block Cache Eviction Frequently Used : 0 8.39 Transaction Commit : 2,761 8.40 Transaction Commit Nested : 3,153 8.41 Transaction Rollback : 4 8.42 Transaction Rollback Nested : 0 8.43 Blocks Read : 396,108 8.44 Blocks Written : 6,132 8.45 Temporary Storage in use : 0 kbyte 8.46 Registered User Name : Durham University Library 8.47 Registered Institution : Durham University Library 8.48 Max. number of screens : 9 8.49 Number of users logged on : 2 8.50 User wmnx47 : 129.234.108.22 8.51 User dul0ajg : 129.234.109.5 Call Stack Information: ------------------------------------------------------------------------------------------------------------- |Address |Module |Unit |Class |Procedure/Method |Line | ------------------------------------------------------------------------------------------------------------- |Running Thread: ID=4040; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------| |008387B5|ModesXML.exe|DDSnippets.pas | |CopyFile |428[7] | |00838778|ModesXML.exe|DDSnippets.pas | |CopyFile |421[0] | |00CB684B|ModesXML.exe|fdisplay.pas |TfrmDisplay |actExportLeftExecute |10025[80]| |008B5D7A|ModesXML.exe|dxBar.pas |TCustomdxBarControl |WMLButtonUp |27189[24]| |008B5C74|ModesXML.exe|dxBar.pas |TCustomdxBarControl |WMLButtonUp |27165[0] | |008BB25A|ModesXML.exe|dxBar.pas |TdxBarControl |WMLButtonUp |29997[38]| |7E42B3C6|user32.dll | | |CallNextHookEx | | |00557EC4|ModesXML.exe|TntForms.pas | |GetMessageForNT |783[10] | |008B8188|ModesXML.exe|dxBar.pas |TCustomdxBarControl |GetEquivalentParentBar |28344[0] | |008B73ED|ModesXML.exe|dxBar.pas |TCustomdxBarControl |CanProcessMouseMessage |27885[6] | |008B6944|ModesXML.exe|dxBar.pas |TCustomdxBarControl |WndProc |27540[52]| |008B66E8|ModesXML.exe|dxBar.pas |TCustomdxBarControl |WndProc |27488[0] | |008BDDFF|ModesXML.exe|dxBar.pas |TdxBarControl |WndProc |31403[52]| |7E4196C2|user32.dll | | |DispatchMessageA | | |7E4196B8|user32.dll | | |DispatchMessageA | | |00CE27E4|ModesXML.exe|ModesXML.dpr | | |177[19] | |7C90DCB8|ntdll.dll | | |ZwSetInformationThread | | |-----------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=2152; Priority=0; Class= | |-----------------------------------------------------------------------------------------------------------| |7C90DF48|ntdll.dll | | |NtWaitForMultipleObjects| | |7C90DDA8|ntdll.dll | | |ZwSetTimer | | |7C8095D8|kernel32.dll| | |WaitForMultipleObjectsEx| | |7C80A110|kernel32.dll| | |WaitForMultipleObjects | | |7C80A0FD|kernel32.dll| | |WaitForMultipleObjects | | |0061033B|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1837[2] | |00610328|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1835[0] | |00610272|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1811[29] | |00610150|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1782[0] | |0060FF47|ModesXML.exe|nxsrFileImplWin32.pas | |FlushThreadProc |1723[17] | |-----------------------------------------------------------------------------------------------------------| |Calling Thread: ID=4040; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------| |00CE26A3|ModesXML.exe|ModesXML.dpr | | |158[0] | |7C90DCB8|ntdll.dll | | |ZwSetInformationThread | | |-----------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=2676; Priority=15; Class=TnxHeartbeatThread | |-----------------------------------------------------------------------------------------------------------| |7C90DF58|ntdll.dll | | |ZwWaitForSingleObject | | |7C802550|kernel32.dll| | |WaitForSingleObjectEx | | |7C80253D|kernel32.dll| | |WaitForSingleObject | | |7C802530|kernel32.dll| | |WaitForSingleObject | | |006A7D7D|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |InnerExecute |2218[3] | |005D8694|ModesXML.exe|nxllThread.pas |TnxInitThread |DoExecute |704[14] | |005D84B1|ModesXML.exe|nxllThread.pas |TnxThread |Execute |507[3] | |-----------------------------------------------------------------------------------------------------------| |Calling Thread: ID=4040; Priority=0; Class=; [Main] | |-----------------------------------------------------------------------------------------------------------| |005D839B|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |418[1] | |005D8398|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |417[0] | |005D8598|ModesXML.exe|nxllThread.pas |TnxInitThread |AfterConstruction |667[1] | |006A7C7B|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2191[7] | |006A7B70|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2184[0] | |006AB8AE|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3914[30] | |006AB7BC|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3884[0] | |006B4A85|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |scStarting |1612[1] | |004B7F6F|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1945[38] | |7C912D19|ntdll.dll | | |LdrUnlockLoaderLock | | |004B8245|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scShouldFollowTransition|1995[6] | |004B7C30|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scDependentStateChange |1843[9] | |004B79BF|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1763[4] | |004B7978|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1759[0] | |006A40EE|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2019[1] | |006A40D8|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2018[0] | |006B476A|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |nxcNotification |1561[1] | |004B6E63|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcNotifyDependents |1314[10] | |004B8341|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scStateChanging |2050[6] | |004B7E6B|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1921[14] | |7C901000|ntdll.dll | | |RtlEnterCriticalSection | | |7C912CC9|ntdll.dll | | |LdrLockLoaderLock | | |004926B0|ModesXML.exe|nxllUtils.pas | |nxCmpPtr |526[1] | |00490777|ModesXML.exe|nxllList.pas |TnxSortedList |slCompare |712[1] | |0049070A|ModesXML.exe|nxllList.pas |TnxSortedList |Find |689[7] | |00490527|ModesXML.exe|nxllList.pas |TnxSortedList |Add |645[5] | |0048F258|ModesXML.exe|nxllSync.pas |TnxPadlock |Unlock |372[1] | |00490AA6|ModesXML.exe|nxllList.pas |TnxListPadlock |EndWrite |878[1] | |004907B9|ModesXML.exe|nxllList.pas |TnxListSyncAccess |Add |724[4] | |00490780|ModesXML.exe|nxllList.pas |TnxListSyncAccess |Add |720[0] | |004B6A72|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcAddDependent |1189[5] | |005EBABB|ModesXML.exe|nxdb.pas |TnxBaseSession |nxcAddDependent |5135[4] | |004B6B00|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcAddDependingOn |1198[5] | |004B7C5F|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetActive |1867[2] | |008FF6EB|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |433[74] | |008FF150|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |359[0] | |009020BC|ModesXML.exe|dmUser.pas |TuserDm |Login |847[2] | |0090208C|ModesXML.exe|dmUser.pas |TuserDm |Login |845[0] | |00CE2760|ModesXML.exe|ModesXML.dpr | | |169[11] | |7C90DCB8|ntdll.dll | | |ZwSetInformationThread | | ------------------------------------------------------------------------------------------------------------- Modules Information: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |Handle |Name |Description |Version |Size |Modified |Path | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |00400000|ModesXML.exe |ModesXML |1.2.0.154 |12572672|2009-11-30 10:05:48|J:\modes\MXML\Client | |018F0000|Normaliz.dll |Unicode Normalization DLL |6.0.5441.0 |23552 |2006-06-29 07:05:44|C:\WINDOWS\system32 | |02C60000|xpsp2res.dll |Service Pack 2 Messages |5.1.2600.5512 |2897920 |2008-04-13 17:39:24|C:\WINDOWS\system32 | |037C0000|ModesPDF.dll |WPViewPDF |1.4.1.0 |1108352 |2007-07-13 09:52:24|J:\modes\MXML\Client | |04410000|XfoInterface41.dll |XfoInterface |4.1.2007.704 |225280 |2007-07-04 11:04:30|D:\ModesXML\Client\AHFO4_1 | |04450000|pthreadVSE2.dll | |2.2.0.0 |86071 |2005-04-08 13:27:02|D:\ModesXML\Client\AHFO4_1 | |04470000|XfoEngine41.dll |XfoEngine |4.1.2007.704 |1523712 |2007-07-04 11:02:48|D:\ModesXML\Client\AHFO4_1 | |045F0000|XfoFont41.dll |XfoFont |4.1.2007.704 |147456 |2007-07-04 10:53:46|D:\ModesXML\Client\AHFO4_1 | |04620000|AHFont20.dll | | |987136 |2007-07-04 10:53:40|D:\ModesXML\Client\AHFO4_1 | |04720000|XfoDMC41.dll |XfoDMC |4.1.2007.704 |360448 |2007-07-04 10:52:58|D:\ModesXML\Client\AHFO4_1 | |04780000|XfoText41.dll |XfoText |4.1.2007.704 |86016 |2007-07-04 10:54:00|D:\ModesXML\Client\AHFO4_1 | |04A10000|XfoCommon41.dll |XfoCommon |4.1.2007.704 |909312 |2007-07-04 10:53:32|D:\ModesXML\Client\AHFO4_1 | |04B00000|XfoGraphic41.dll |XfoGraphic |4.1.2007.704 |1765376 |2007-07-04 11:00:14|D:\ModesXML\Client\AHFO4_1 | |04CC0000|PDFToolPage10.dll | | |749568 |2007-07-04 10:53:56|D:\ModesXML\Client\AHFO4_1 | |04D80000|AHGraphic20.dll | | |811008 |2007-06-29 19:40:04|D:\ModesXML\Client\AHFO4_1 | |04E50000|PDFExplorer21.dll | | |1118208 |2007-07-04 10:54:06|D:\ModesXML\Client\AHFO4_1 | |04F70000|PDFRes10.dll | | |3731456 |2007-07-04 10:54:02|D:\ModesXML\Client\AHFO4_1 | |05300000|XfoHyphen41.dll |XfoHyphen |4.1.2007.704 |81920 |2007-07-04 11:00:22|D:\ModesXML\Client\AHFO4_1 | |05320000|XfoHyphenCH41.dll |XfoHyphenCH |4.1.2007.704 |835584 |2007-07-04 11:00:40|D:\ModesXML\Client\AHFO4_1 | |053F0000|XfoTrans41.dll |XfoTrans |4.1.2007.704 |110592 |2007-07-04 11:02:52|D:\ModesXML\Client\AHFO4_1 | |05410000|XfoGdiCtl41.dll |XfoGdiCtl |4.1.2007.704 |266240 |2007-07-04 11:04:22|D:\ModesXML\Client\AHFO4_1 | |05460000|XfoRender41.dll |XfoRender |4.1.2007.704 |2420736 |2007-07-04 11:04:10|D:\ModesXML\Client\AHFO4_1 | |056C0000|PDFCreator25.dll | | |1253376 |2007-07-04 11:03:00|D:\ModesXML\Client\AHFO4_1 | |05800000|PDFLinearizer11.dll | | |708608 |2007-07-04 11:03:02|D:\ModesXML\Client\AHFO4_1 | |058C0000|SVGCreator41.dll |SVGCreator |4.1.2007.704 |434176 |2007-07-04 11:03:06|D:\ModesXML\Client\AHFO4_1 | |068C0000|Audiodev.dll |Portable Media Devices Shell Extension |5.2.5721.5145 |276992 |2006-10-18 20:47:08|C:\WINDOWS\system32 | |08610000|shdocvw.dll |Shell Doc Object and Control Library |6.0.2900.5512 |1499136 |2008-04-14 00:12:06|C:\WINDOWS\system32 | |10000000|XfoComCtl41.dll |XfoComCtl |4.1.2007.704 |90112 |2007-07-04 11:04:32|D:\ModesXML\Client\AHFO4_1 | |10930000|PortableDeviceApi.dll|Windows Portable Device API Components |5.2.5721.5145 |284160 |2006-10-18 20:47:18|C:\WINDOWS\system32 | |11C70000|WMASF.DLL |Windows Media ASF DLL |11.0.5721.5238 |222720 |2007-10-27 16:40:30|C:\WINDOWS\system32 | |15110000|WMVCore.DLL |Windows Media Playback/Authoring DLL |11.0.5721.5265 |2458112 |2009-05-20 03:56:52|C:\WINDOWS\system32 | |16210000|wpdshext.dll |Portable Devices Shell Extension |5.2.5721.5145 |2603008 |2006-10-18 20:47:22|C:\WINDOWS\system32 | |20000000|xpsp3res.dll |Service Pack 3 Messages |5.1.2600.5512 |689152 |2008-04-13 17:39:26|C:\WINDOWS\system32 | |3D930000|wininet.dll |Internet Extensions for Win32 |7.0.6000.16915 |832512 |2009-08-29 07:36:28|C:\WINDOWS\system32 | |3DFD0000|iertutil.dll |Run time utility for Internet Explorer |7.0.6000.16915 |268288 |2009-08-29 07:36:26|C:\WINDOWS\system32 | |3E1C0000|ieframe.dll |Internet Explorer |7.0.6000.16915 |6067200 |2009-08-29 07:36:26|C:\WINDOWS\system32 | |4A800000|icuuc34.dll |IBM ICU Common DLL |3.4.1.0 |819200 |2006-07-18 10:33:22|D:\ModesXML\Client\AHFO4_1 | |4A900000|icuin34.dll |IBM ICU I18N DLL |3.4.1.0 |696320 |2006-07-18 10:33:20|D:\ModesXML\Client\AHFO4_1 | |4AD00000|icudt34.dll |ICU Data DLL |3.4.1.0 |8876032 |2006-07-18 10:33:20|D:\ModesXML\Client\AHFO4_1 | |4EC50000|gdiplus.dll |Microsoft GDI+ |5.2.6001.22319 |1748992 |2009-08-13 13:55:04|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df | |593F0000|wiashext.dll |Imaging Devices Shell Folder UI |5.1.2600.5512 |589312 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |5AD70000|UxTheme.dll |Microsoft UxTheme Library |6.0.2900.5512 |218624 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |5B860000|NETAPI32.dll |Net Win32 API DLL |5.1.2600.5694 |337408 |2008-10-15 16:34:24|C:\WINDOWS\system32 | |5D090000|comctl32.dll |Common Controls Library |5.82.2900.5512 |617472 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |5EDD0000|olepro32.dll | |5.1.2600.5512 |84992 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |605D0000|mslbui.dll |LangageBar Add In |5.1.2600.5512 |25088 |2008-04-14 00:12:00|C:\WINDOWS\system32 | |61880000|oleacc.dll |Active Accessibility Core Component |7.0.2600.5884 |220160 |2009-10-08 14:57:00|C:\WINDOWS\system32 | |662B0000|hnetcfg.dll |Home Networking Configuration Manager |5.1.2600.5512 |344064 |2008-04-14 00:11:54|C:\WINDOWS\system32 | |68200000|KM160U.DLL |KONICA MINOLTA BUSINESS TECHNOLOGIES,INC : User Interface DLL|0.3.0.1 |636560 |2005-01-12 00:20:00|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3 | |682A0000|KM160C.DLL |KONICA MINOLTA BUSINESS TECHNOLOGIES,INC : UI Core |0.2.0.0 |222880 |2005-01-12 00:20:00|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3 | |68C40000|KM160L.DLL |KONICA MINOLTA BUSINESS TECHNOLOGIES,INC : Language Resource |0.3.0.0 |36144 |2005-01-12 00:20:00|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3 | |69B10000|msxml4.dll |MSXML 4.0 SP 2 |4.20.9870.0 |1286152 |2008-09-30 16:43:34|C:\WINDOWS\system32 | |710F0000|UNIDRVUI.DLL |UniDriver User Interface |0.3.6001.22127 |744960 |2009-02-25 17:41:10|C:\WINDOWS\System32\spool\DRIVERS\W32X86\3 | |71A50000|mswsock.dll |Microsoft Windows Sockets 2.0 Service Provider |5.1.2600.5625 |245248 |2008-06-20 17:46:58|C:\WINDOWS\system32 | |71A90000|wshtcpip.dll |Windows Sockets Helper DLL |5.1.2600.5512 |19456 |2008-04-14 00:12:10|C:\WINDOWS\System32 | |71AA0000|WS2HELP.dll |Windows Socket 2.0 Helper for Windows NT |5.1.2600.5512 |19968 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |71AB0000|WS2_32.dll |Windows Socket 2.0 32-Bit DLL |5.1.2600.5512 |82432 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |71AD0000|wsock32.dll |Windows Socket 32-Bit DLL |5.1.2600.5512 |22528 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |71B20000|mpr.dll |Multiple Provider Router DLL |5.1.2600.5512 |59904 |2008-04-14 00:11:58|C:\WINDOWS\system32 | |71BF0000|SAMLIB.dll |SAM Library DLL |5.1.2600.5512 |64000 |2008-04-14 00:12:04|C:\WINDOWS\System32 | |71C10000|ntlanman.dll |Microsoft® Lan Manager |5.1.2600.5512 |44032 |2008-04-14 00:12:02|C:\WINDOWS\System32 | |71C80000|NETRAP.dll |Net Remote Admin Protocol DLL |5.1.2600.5512 |11776 |2008-04-14 00:12:02|C:\WINDOWS\System32 | |71C90000|NETUI1.dll |NT LM UI Common Code - Networking classes |5.1.2600.5512 |245760 |2008-04-14 00:12:02|C:\WINDOWS\System32 | |71CD0000|NETUI0.dll |NT LM UI Common Code - GUI Classes |5.1.2600.5512 |80896 |2008-04-14 00:12:02|C:\WINDOWS\System32 | |72D10000|msacm32.drv |Microsoft Sound Mapper |5.1.2600.0 |20480 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |72D20000|wdmaud.drv |WDM Audio driver mapper |5.1.2600.5512 |23552 |2008-04-14 00:12:46|C:\WINDOWS\system32 | |73000000|winspool.drv |Windows Spooler Driver |5.1.2600.5512 |146432 |2008-04-14 00:12:46|C:\WINDOWS\system32 | |73B30000|mscms.dll |Microsoft Color Matching System DLL |5.1.2600.5627 |74240 |2008-06-24 16:43:16|C:\WINDOWS\system32 | |73B50000|avifil32.dll |Microsoft AVI File support library |5.1.2600.5827 |84992 |2009-06-10 14:13:30|C:\WINDOWS\system32 | |73BA0000|sti.dll |Still Image Devices client DLL |5.1.2600.5512 |68096 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |73BC0000|DCIMAN32.DLL |DCI Manager |5.1.2600.5512 |8704 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |74720000|MSCTF.dll |MSCTF Server DLL |5.1.2600.5512 |297984 |2008-04-14 00:11:58|C:\WINDOWS\system32 | |74AE0000|CFGMGR32.dll |Configuration Manager Forwarder DLL |5.1.2600.5512 |16896 |2008-04-14 00:09:06|C:\WINDOWS\system32 | |74D90000|USP10.dll |Uniscribe Unicode script processor |1.420.2600.5512 |406016 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |754D0000|CRYPTUI.dll |Microsoft Trust UI Provider |5.131.2600.5512 |512512 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |755C0000|msctfime.ime |Microsoft Text Frame Work Service IME |5.1.2600.5512 |177152 |2008-04-14 00:10:06|C:\WINDOWS\system32 | |75A70000|MSVFW32.dll |Microsoft Video for Windows DLL |5.1.2600.5512 |121344 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |75F60000|drprov.dll |Microsoft Terminal Server Network Provider |5.1.2600.5512 |14336 |2008-04-14 00:11:52|C:\WINDOWS\System32 | |75F70000|davclnt.dll |Web DAV Client DLL |5.1.2600.5512 |25088 |2008-04-14 00:11:52|C:\WINDOWS\System32 | |75F80000|browseui.dll |Shell Browser UI Library |6.0.2900.5512 |1025024 |2008-04-14 00:11:50|C:\WINDOWS\system32 | |76080000|MSVCP60.dll |Microsoft (R) C++ Runtime Library |6.2.3104.0 |413696 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |76380000|msimg32.dll |GDIEXT Client DLL |5.1.2600.5512 |4608 |2008-04-14 00:12:00|C:\WINDOWS\system32 | |76390000|IMM32.DLL |Windows XP IMM32 API Client DLL |5.1.2600.5512 |110080 |2008-04-14 00:11:54|C:\WINDOWS\system32 | |763B0000|comdlg32.dll |Common Dialogs DLL |6.0.2900.5512 |276992 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |76600000|CSCDLL.dll |Offline Network Agent |5.1.2600.5512 |101888 |2008-04-14 00:11:52|C:\WINDOWS\System32 | |76980000|LINKINFO.dll |Windows Volume Tracking |5.1.2600.5512 |19968 |2008-04-14 00:11:56|C:\WINDOWS\system32 | |76990000|ntshrui.dll |Shell extensions for sharing |5.1.2600.5512 |143360 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |769C0000|USERENV.dll |Userenv |5.1.2600.5512 |727040 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |76B20000|ATL.DLL |ATL Module for Windows XP (Unicode) |3.5.2284.2 |58880 |2009-07-17 19:01:06|C:\WINDOWS\system32 | |76B40000|winmm.dll |MCI API DLL |5.1.2600.5512 |176128 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |76BF0000|PSAPI.DLL |Process Status Helper |5.1.2600.5512 |23040 |2008-04-14 00:12:04|C:\WINDOWS\system32 | |76C30000|WINTRUST.dll |Microsoft Trust Verification APIs |5.131.2600.5512 |176640 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |76C90000|IMAGEHLP.dll |Windows NT Image Helper |5.1.2600.5512 |144384 |2008-04-14 00:11:54|C:\WINDOWS\system32 | |76F20000|DNSAPI.dll |DNS Client API DLL |5.1.2600.5625 |147968 |2008-06-20 17:46:58|C:\WINDOWS\system32 | |76F60000|WLDAP32.dll |Win32 LDAP API DLL |5.1.2600.5512 |172032 |2008-04-14 00:12:10|C:\WINDOWS\system32 | |76FB0000|winrnr.dll |LDAP RnR Provider DLL |5.1.2600.5512 |16896 |2008-04-14 00:12:10|C:\WINDOWS\System32 | |76FC0000|rasadhlp.dll |Remote Access AutoDial Helper |5.1.2600.5512 |7680 |2008-04-14 00:12:04|C:\WINDOWS\system32 | |76FD0000|CLBCATQ.DLL | |2001.12.4414.700|498688 |2008-04-14 00:11:50|C:\WINDOWS\system32 | |77050000|COMRes.dll | |2001.12.4414.700|792064 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |77120000|oleaut32.dll | |5.1.2600.5512 |551936 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |773D0000|comctl32.dll |User Experience Controls Library |6.0.2900.5512 |1054208 |2008-04-14 00:12:52|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83| |774E0000|ole32.dll |Microsoft OLE for Windows |5.1.2600.5512 |1287168 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |77920000|SETUPAPI.dll |Windows Setup API |5.1.2600.5512 |985088 |2008-04-14 04:42:06|C:\WINDOWS\system32 | |77A20000|cscui.dll |Client Side Caching UI |5.1.2600.5512 |326656 |2008-04-14 00:11:52|C:\WINDOWS\System32 | |77A80000|CRYPT32.dll |Crypto API32 |5.131.2600.5512 |599040 |2008-04-14 00:11:52|C:\WINDOWS\system32 | |77B20000|MSASN1.dll |ASN.1 Runtime APIs |5.1.2600.5875 |58880 |2009-09-04 21:03:36|C:\WINDOWS\system32 | |77B40000|appHelp.dll |Application Compatibility Client Library |5.1.2600.5512 |125952 |2008-04-14 00:11:50|C:\WINDOWS\system32 | |77BD0000|midimap.dll |Microsoft MIDI Mapper |5.1.2600.5512 |18944 |2008-04-14 00:11:58|C:\WINDOWS\system32 | |77BE0000|MSACM32.dll |Microsoft ACM Audio Filter |5.1.2600.5512 |71680 |2008-04-14 00:11:58|C:\WINDOWS\system32 | |77C00000|version.dll |Version Checking and File Installation Libraries |5.1.2600.5512 |18944 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |77C10000|msvcrt.dll |Windows NT CRT DLL |7.0.2600.5512 |343040 |2008-04-14 00:12:02|C:\WINDOWS\system32 | |77DD0000|advapi32.dll |Advanced Windows 32 Base API |5.1.2600.5755 |617472 |2009-02-09 12:10:48|C:\WINDOWS\system32 | |77E70000|RPCRT4.dll |Remote Procedure Call Runtime |5.1.2600.5795 |585216 |2009-04-15 14:51:26|C:\WINDOWS\system32 | |77F10000|GDI32.dll |GDI Client DLL |5.1.2600.5698 |286720 |2008-10-23 12:36:14|C:\WINDOWS\system32 | |77F60000|SHLWAPI.dll |Shell Light-weight Utility Library |6.0.2900.5512 |474112 |2008-04-14 00:12:06|C:\WINDOWS\system32 | |77FE0000|Secur32.dll |Security Support Provider Interface |5.1.2600.5834 |56832 |2009-06-25 08:25:26|C:\WINDOWS\system32 | |7C340000|MSVCR71.dll |Microsoft® C Runtime Library |7.10.3052.4 |348160 |2004-04-20 07:58:04|D:\ModesXML\Client\AHFO4_1 | |7C800000|kernel32.dll |Windows NT BASE API Client DLL |5.1.2600.5781 |989696 |2009-03-21 14:06:58|C:\WINDOWS\system32 | |7C900000|ntdll.dll |NT Layer DLL |5.1.2600.5755 |714752 |2009-02-09 12:10:48|C:\WINDOWS\system32 | |7C9C0000|shell32.dll |Windows Shell Common Dll |6.0.2900.5622 |8461312 |2008-06-17 19:02:20|C:\WINDOWS\system32 | |7E410000|user32.dll |Windows XP USER API Client DLL |5.1.2600.5512 |578560 |2008-04-14 00:12:08|C:\WINDOWS\system32 | |7E720000|SXS.DLL |Fusion 2.5 |5.1.2600.5512 |713216 |2008-04-14 00:12:08|C:\WINDOWS\system32 | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Processes Information: -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |ID |Name |Description |Version |Memory |Priority|Threads|Path | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |4 |System | | |253952 |Normal |86 | | |284 |svchost.exe |Generic Host Process for Win32 Services|5.1.2600.5512 |4472832 |Normal |6 |C:\WINDOWS\system32 | |344 |WinVNC4.exe |VNC Server Enterprise Edition for Win32|4.4.3.16583 |4198400 |Normal |5 |C:\Program Files\RealVNC\VNC4 | |520 |Mcshield.exe |On-Access Scanner service |14.1.0.515 |30642176|High |39 |C:\Program Files\McAfee\VirusScan Enterprise | |724 |smss.exe | | |425984 |Normal |3 |\SystemRoot\System32 | |812 |winlogon.exe | | |6590464 |High |18 |C:\WINDOWS\system32 | |860 |services.exe |Services and Controller app |5.1.2600.5755 |5562368 |Normal |16 |C:\WINDOWS\system32 | |872 |lsass.exe |LSA Shell (Export Version) |5.1.2600.5512 |2437120 |Normal |23 |C:\WINDOWS\system32 | |924 |ctfmon.exe |CTF Loader |5.1.2600.5512 |4087808 |Normal |1 |C:\WINDOWS\system32 | |1028|hkcmd.exe |hkcmd Module |6.14.10.4837 |3424256 |Normal |2 |C:\WINDOWS\system32 | |1052|svchost.exe |Generic Host Process for Win32 Services|5.1.2600.5512 |5128192 |Normal |17 |C:\WINDOWS\system32 | |1204|svchost.exe |Generic Host Process for Win32 Services|5.1.2600.5512 |31739904|Normal |76 |C:\WINDOWS\System32 | |1372|Explorer.EXE |Windows Explorer |6.0.2900.5512 |20635648|Normal |22 |C:\WINDOWS | |1464|spoolsv.exe |Spooler SubSystem App |5.1.2600.5512 |8495104 |Normal |11 |C:\WINDOWS\system32 | |1680|EngineServer.exe |McAfee Engine Service |14.1.0.515 |42430464|Normal |6 |C:\Program Files\McAfee\VirusScan Enterprise | |1804|FrameworkService.exe|Framework Service |3.6.0.608 |11218944|Normal |27 |C:\Program Files\McAfee\Common Framework | |1864|VsTskMgr.exe |Task Manager |8.7.0.767 |1994752 |Normal |20 |C:\Program Files\McAfee\VirusScan Enterprise | |1920|MDM.EXE |Machine Debug Manager |7.10.3077.0 |2924544 |Normal |5 |C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG| |1972|mfevtps.exe |McAfee Process Validation Service |14.1.0.615 |520192 |Normal |6 |C:\WINDOWS\system32 | |1996|NMSAccessU.exe | | |1912832 |Normal |2 |C:\Program Files\CDBurnerXP | |2252|UdaterUI.exe |Common User Interface |3.6.0.608 |3846144 |Normal |6 |C:\Program Files\McAfee\Common Framework | |2300|OUTLOOK.EXE |Microsoft Office Outlook |12.0.6514.5000|67788800|Normal |40 |C:\Program Files\Microsoft Office 2007\Office12 | |2636|AcroRd32.exe |Adobe Reader 9.1 |9.1.0.163 |44150784|Normal |7 |C:\Program Files\Adobe\Reader 9.0\Reader | |2656|McTray.exe |McAfee Security Agent Taskbar Extension|1.0.0.127 |2523136 |Normal |1 |C:\Program Files\McAfee\Common Framework | |3300|proquota.exe |ProQuota |5.1.2600.5512 |3014656 |Normal |2 |C:\WINDOWS\system32 | |3428|ModesXML.exe |ModesXML |1.2.0.154 |79396864|Normal |19 |J:\modes\MXML\Client | |3708|iexplore.exe |Internet Explorer |7.0.6000.16915|94126080|Normal |33 |C:\Program Files\Internet Explorer | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- Assembler Information: ----------------------------------------------------------------- 0042F3CA mov eax, [ebp-$1C] 0042F3CD mov [ebp-$0C], eax 0042F3D0 mov byte ptr [ebp-$08], $0B 0042F3D4 lea eax, [ebp-$14] 0042F3D7 push eax 0042F3D8 push $01 0042F3DA mov ecx, [$D2CCA8] 0042F3E0 mov dl, $01 0042F3E2 mov eax, dword ptr [EFCreateError] 0042F3E7 call -$000160A8 0042F3EC call -$0002A17D ; <-- EXCEPTION 0042F3F1 jmp +$63 0042F3F3 movzx edx, di 0042F3F6 mov eax, esi 0042F3F8 call -$0001C9DD 0042F3FD mov ecx, eax 0042F3FF xor edx, edx 0042F401 mov eax, ebx 0042F403 call -$000001C8 0042F408 cmp dword ptr [ebx+$04], +$00 0042F40C jnl +$48 Registers: ----------------------------- EAX: 7E918FF0 EDI: 7FBCFFFF EBX: 7FBCACF0 ESI: 7EAB5368 ECX: 00000000 ESP: 0012FA4C EDX: 0042F3F1 EIP: 0042F3EC Stack: Memory Dump: ------------------ --------------------------------------------------------------------------- 0012FA4C: 0012FA98 0042F3EC: E8 83 5E FD FF EB 63 0F B7 D7 8B C6 E8 23 36 FE ..^...c......#6. 0012FA50: 004051A8 0042F3FC: FF 8B C8 33 D2 8B C3 E8 38 FE FF FF 83 7B 04 00 ...3....8....{.. 0012FA54: 0012FA88 0042F40C: 7D 48 8D 55 E0 8B C6 E8 0C 3D FE FF 8B 45 E0 89 }H.U.....=...E.. 0012FA58: 7FB98A60 0042F41C: 45 EC C6 45 F0 0B E8 75 97 FD FF 8D 55 DC E8 89 E..E...u....U... 0012FA5C: 7FBCACF0 0042F42C: 94 FE FF 8B 45 DC 89 45 F4 C6 45 F8 0B 8D 45 EC ....E..E..E...E. 0012FA60: 00429301 0042F43C: 50 6A 01 8B 0D E4 B0 D2 00 B2 01 A1 14 84 42 00 Pj............B. 0012FA64: 00000000 0042F44C: E8 F3 9E FE FF E8 1E 5E FD FF 33 C0 5A 59 59 64 .......^..3.ZYYd 0012FA68: 00000000 0042F45C: 89 10 68 78 F4 42 00 8D 45 DC BA 04 00 00 00 E8 ..hx.B..E....... 0012FA6C: 00000000 0042F46C: D4 64 FD FF C3 E9 02 5D FD FF EB EB 8B C3 80 7D .d.....].......} 0012FA70: 00000000 0042F47C: FF 00 74 0F E8 1B 59 FD FF 64 8F 05 00 00 00 00 ..t...Y..d...... 0012FA74: 7EF9E548 0042F48C: 83 C4 0C 8B C3 5F 5E 5B 8B E5 5D C2 08 00 8B C0 ....._^[..]..... 0012FA78: 0042930B 0042F49C: 53 56 E8 0D 59 FD FF 8B DA 8B F0 8B 46 04 85 C0 SV..Y.......F... 0012FA7C: 7EAB5248 0042F4AC: 7C 05 E8 8D 36 FE FF 8B D3 80 E2 FC 8B C6 E8 01 |...6........... 0012FA80: 7EAB530B 0042F4BC: 55 FD FF 84 DB 7E 07 8B C6 E8 CE 58 FD FF 5E 5B U....~.....X..^[ 0012FA84: 00404D52 0042F4CC: C3 8D 40 00 89 50 04 89 48 08 C3 90 53 56 57 8B ..@..P..H...SVW. 0012FA88: 0012FAB0 0042F4DC: D8 8B 7B 0C 85 FF 7C 24 85 C9 7C 20 8B 73 08 2B ..{...|$..| .s.+