EurekaLog 6.0.14 Application: ------------------------------------------------------- 1.1 Start Date : Tue, 26 Jan 2010 10:52:00 +0000 1.2 Name/Description: ModesXML.exe - (ModesXML) 1.3 Version Number : 1.2.0.167 1.4 Parameters : 1.5 Compilation Date: Tue, 19 Jan 2010 18:26:49 +0000 1.6 Up Time : 1 minute, 44 seconds Exception: ----------------------------------------------------- 2.1 Date : Tue, 26 Jan 2010 10:53:44 +0000 2.2 Address : 0042EC50 2.3 Module Name : ModesXML.exe - (ModesXML) 2.4 Module Version: 1.2.0.167 2.5 Type : EStringListError 2.6 Message : List index out of bounds (-1). 2.7 ID : 707E 2.8 Count : 1 2.9 Status : New 2.10 Note : User: ------------------------------------------------------- 3.1 ID : dmamw 3.2 Name : Norfolk County Council 3.3 Email : martin.warren@norfolk.gov.uk 3.4 Company : Norfolk County Council 3.5 Privileges: SeChangeNotifyPrivilege - ON SeShutdownPrivilege - OFF SeUndockPrivilege - ON SeCreateGlobalPrivilege - ON Active Controls: ------------------------------------------------------------------------------------------------- 4.1 Form Class : TfrmMain.UnicodeClass 4.2 Form Text : ModesXML - [Application: Object records. File: Norwich cultural collections] 4.3 Control Class: TPageControl 4.4 Control Text : Computer: -------------------------------------------------------------------------------------- 5.1 Name : CS65392 5.2 Total Memory : 1014 Mb 5.3 Free Memory : 417 Mb 5.4 Total Disk : 74.5 Gb 5.5 Free Disk : 13.6 Gb 5.6 System Up Time: 5 days, 1 hour, 31 minutes, 31 seconds 5.7 Processor : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz 5.8 Display Mode : 1280 x 1024, 32 bit 5.9 Display DPI : 96 5.10 Video Card : Intel(R) Q965/Q963 Express Chipset Family (driver 6.14.10.4642) 5.11 Printer : HP Color LaserJet 2500 PCL 6 (driver 4.14.0.18) Operating System: ------------------------------------ 6.1 Type : Microsoft Windows XP 6.2 Build # : 2600 6.3 Update : Service Pack 2 6.4 Language: English 6.5 Charset : 0 Network: --------------------------------- 7.1 IP Address: 010.108.162.067 7.2 Submask : 255.255.255.000 7.3 Gateway : 010.108.162.001 7.4 DNS 1 : 010.107.176.128 7.5 DNS 2 : 010.107.176.134 7.6 DHCP : ON Custom Information: --------------------------------------------------------------------------------------------------------------------- 8.1 Server Type : Remote 8.2 StyleSheetPath : \\ncu3mx02.norfolk.gov.uk\resources\stylesheets\ 8.3 ResourcePath : \\ncu3mx02.norfolk.gov.uk\resources\ 8.4 DataPath : \ 8.5 DTDPath : \\ncu3mx02.norfolk.gov.uk\resources\dtds\ 8.6 ServerName : ncu3mx02 8.7 ServerPort : 16000 8.8 AppDataFolder : C:\Documents and Settings\dmamw\Application Data\ModesXML\ 8.9 AppTempFolder : C:\Documents and Settings\dmamw\Application Data\ModesXML\Temp\ 8.10 Application : Object 8.11 FileName : Norwich cultural 8.12 FileIndex : Identity number 8.13 SplitMode : False 8.14 EditMode : True 8.15 ActiveLeftTab : grid 8.16 LeftTabStylesheet : Accession register grid 8.17 ActiveRightTab : N/A 8.18 RightTabStylesheet : N/A 8.19 Transport : nxWinsockModes 8.20 Logged in user : dmamw 8.21 Server version : 2.0701 (ModesXML@ncu3mx02) 8.22 Uptime : 4.14:33:00 8.23 Sessions : 35 8.24 Databases : 45 8.25 Transaction Contexts : 45 8.26 Cursors : 277 8.27 Statements : 0 8.28 Folders : 5 8.29 Tables : 35 8.30 Block Cache Available (Recently / Frequently): 1,047,552 ( 1,045,556 / 1,996 ) kbyte 8.31 Block Cache Used (Recently / Frequently) : 84,704 ( 84,704 / 0 ) kbyte 8.32 Block Cache Tracked (Recently / Frequently) : 36 ( 36 / 0 ) kbyte 8.33 Block Cache Miss Recently Used : 835,877 8.34 Block Cache Miss Frequently Used : 0 8.35 Block Cache Hit Recently Used : 536,895,085 8.36 Block Cache Hit Frequently Used : 0 8.37 Block Cache Eviction Recently Used : 16 8.38 Block Cache Eviction Frequently Used : 0 8.39 Transaction Commit : 16,088 8.40 Transaction Commit Nested : 24,269 8.41 Transaction Rollback : 6 8.42 Transaction Rollback Nested : 1,734 8.43 Blocks Read : 835,877 8.44 Blocks Written : 2,259,973 8.45 Temporary Storage in use : 48 kbyte 8.46 Registered User Name : MX0083 8.47 Registered Institution : Norfolk Museums and Archaeology Service 8.48 Max. number of screens : 35 8.49 Number of users logged on : 5 8.50 User dmshr : 10.107.164.139 8.51 User dmtpe : 10.107.164.139 8.52 User dmcfl : 10.107.164.139 8.53 User martin : 10.107.164.139 8.54 User dmamw : 10.108.162.67 Call Stack Information: ---------------------------------------------------------------------------------------------------------------- |Address |Module |Unit |Class |Procedure/Method |Line | ---------------------------------------------------------------------------------------------------------------- |Running Thread: ID=2784; Priority=0; Class=; [Main] | |--------------------------------------------------------------------------------------------------------------| |00CB5074|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadIndexList |8473[56]| |00CB4DB8|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadIndexList |8417[0] | |00CADF51|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadSubset |5111[28]| |00CADEA4|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadSubset |5083[0] | |00CB3B14|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadSavedSubset |7926[57]| |00CB37B0|ModesXML.exe|fdisplay.pas |TfrmDisplay |LoadSavedSubset |7869[0] | |00CA451F|ModesXML.exe|fdisplay.pas |TfrmDisplay |WMLoadGrid |1732[91]| |00555038|ModesXML.exe|TntControls.pas |TWinControlTrap |WindowProc |672[19] | |7E41C660|user32.dll | | |CallWindowProcW | | |7E41C64A|user32.dll | | |CallWindowProcW | | |00554C8C|ModesXML.exe|TntControls.pas |TWinControlTrap |Win32Proc |560[12] | |7E4196C2|user32.dll | | |DispatchMessageA | | |7E4196B8|user32.dll | | |DispatchMessageA | | |00CE57D8|ModesXML.exe|ModesXML.dpr | | |178[19] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | |--------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=3348; Priority=0; Class= | |--------------------------------------------------------------------------------------------------------------| |7C90E9A9|ntdll.dll | | |ZwWaitForMultipleObjects | | |7C90E787|ntdll.dll | | |ZwSetTimer | | |7C80952A|kernel32.dll| | |WaitForMultipleObjectsEx | | |7C80A070|kernel32.dll| | |WaitForMultipleObjects | | |7C80A05D|kernel32.dll| | |WaitForMultipleObjects | | |006104F3|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1837[2] | |006104E0|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |Wait |1835[0] | |0061042A|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1811[29]| |00610308|ModesXML.exe|nxsrFileImplWin32.pas |TnxFlushThread |DoExecute |1782[0] | |006100FF|ModesXML.exe|nxsrFileImplWin32.pas | |FlushThreadProc |1723[17]| |--------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=2784; Priority=0; Class=; [Main] | |--------------------------------------------------------------------------------------------------------------| |00CE5697|ModesXML.exe|ModesXML.dpr | | |159[0] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | |--------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=3548; Priority=15; Class=TnxHeartbeatThread | |--------------------------------------------------------------------------------------------------------------| |7C90E9BE|ntdll.dll | | |NtWaitForSingleObject | | |7C802540|kernel32.dll| | |WaitForSingleObjectEx | | |7C80252D|kernel32.dll| | |WaitForSingleObject | | |7C802520|kernel32.dll| | |WaitForSingleObject | | |006A7F35|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |InnerExecute |2218[3] | |005D884C|ModesXML.exe|nxllThread.pas |TnxInitThread |DoExecute |704[14] | |005D8669|ModesXML.exe|nxllThread.pas |TnxThread |Execute |507[3] | |--------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=2784; Priority=0; Class=; [Main] | |--------------------------------------------------------------------------------------------------------------| |005D8553|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |418[1] | |005D8550|ModesXML.exe|nxllThread.pas |TnxThread |AfterConstruction |417[0] | |005D8750|ModesXML.exe|nxllThread.pas |TnxInitThread |AfterConstruction |667[1] | |006A7E33|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2191[7] | |006A7D28|ModesXML.exe|nxptBasePooledTransport.pas|TnxHeartbeatThread |Create |2184[0] | |006ABA66|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3914[30]| |006AB974|ModesXML.exe|nxptBasePooledTransport.pas|TnxBasePooledTransport|scStarting |3884[0] | |006B4C3D|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |scStarting |1612[1] | |004B7F6F|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1945[38]| |7C913229|ntdll.dll | | |LdrUnlockLoaderLock | | |004B8245|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scShouldFollowTransition |1995[6] | |004B7C30|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scDependentStateChange |1843[9] | |004B79BF|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1763[4] | |004B7978|ModesXML.exe|nxllComponent.pas |TnxStateComponent |nxcNotification |1759[0] | |006A42A6|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2019[1] | |006A4290|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |nxcNotification |2018[0] | |006B4922|ModesXML.exe|nxtwWinsockTransport.pas |TnxWinsockTransport |nxcNotification |1561[1] | |004B6E63|ModesXML.exe|nxllComponent.pas |TnxComponent |nxcNotifyDependents |1314[10]| |004B8341|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scStateChanging |2050[6] | |004B7E6B|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetState |1921[14]| |7C901005|ntdll.dll | | |RtlEnterCriticalSection | | |7C9131D7|ntdll.dll | | |LdrLockLoaderLock | | |7C809FF0|kernel32.dll| | |LoadResource | | |7C912F9B|ntdll.dll | | |RtlUnicodeToMultiByteN | | |7C91312F|ntdll.dll | | |RtlUnicodeStringToAnsiString| | |006A3EC8|ModesXML.exe|nxllTransport.pas |TnxBaseTransport |btSetServerNameRuntime |1904[5] | |004B7C5F|ModesXML.exe|nxllComponent.pas |TnxStateComponent |scSetActive |1867[2] | |00900961|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |434[75] | |009003B0|ModesXML.exe|dmUser.pas |TuserDm |ConnectToServer |359[0] | |009035B0|ModesXML.exe|dmUser.pas |TuserDm |Login |880[2] | |00903580|ModesXML.exe|dmUser.pas |TuserDm |Login |878[0] | |00CE5754|ModesXML.exe|ModesXML.dpr | | |170[11] | |7C90E64C|ntdll.dll | | |NtSetInformationThread | | ---------------------------------------------------------------------------------------------------------------- Modules Information: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |Handle |Name |Description |Version |Size |Modified |Path | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |00400000|ModesXML.exe |ModesXML |1.2.0.167 |12592640|2010-01-19 18:26:50|C:\Program Files\ModesXML\Client | |02C30000|ModesPDF.dll |WPViewPDF |1.4.1.0 |1108352 |2007-07-13 10:52:24|C:\Program Files\ModesXML\Client | |03320000|XfoInterface41.dll |XfoInterface |4.1.2007.704 |225280 |2007-07-04 13:04:30|C:\Program Files\ModesXML\Client\AHFO4_1 | |03360000|pthreadVSE2.dll | |2.2.0.0 |86071 |2005-04-08 15:27:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |03380000|XfoFont41.dll |XfoFont |4.1.2007.704 |147456 |2007-07-04 12:53:46|C:\Program Files\ModesXML\Client\AHFO4_1 | |033B0000|XfoText41.dll |XfoText |4.1.2007.704 |86016 |2007-07-04 12:54:00|C:\Program Files\ModesXML\Client\AHFO4_1 | |037E0000|XfoHyphen41.dll |XfoHyphen |4.1.2007.704 |81920 |2007-07-04 13:00:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |038A0000|XfoTrans41.dll |XfoTrans |4.1.2007.704 |110592 |2007-07-04 13:02:52|C:\Program Files\ModesXML\Client\AHFO4_1 | |03960000|XfoEngine41.dll |XfoEngine |4.1.2007.704 |1523712 |2007-07-04 13:02:48|C:\Program Files\ModesXML\Client\AHFO4_1 | |03AE0000|XfoDMC41.dll |XfoDMC |4.1.2007.704 |360448 |2007-07-04 12:52:58|C:\Program Files\ModesXML\Client\AHFO4_1 | |03D40000|AHFont20.dll | | |987136 |2007-07-04 12:53:40|C:\Program Files\ModesXML\Client\AHFO4_1 | |03E40000|XfoCommon41.dll |XfoCommon |4.1.2007.704 |909312 |2007-07-04 12:53:32|C:\Program Files\ModesXML\Client\AHFO4_1 | |03F30000|XfoGraphic41.dll |XfoGraphic |4.1.2007.704 |1765376 |2007-07-04 13:00:14|C:\Program Files\ModesXML\Client\AHFO4_1 | |040F0000|PDFToolPage10.dll | | |749568 |2007-07-04 12:53:56|C:\Program Files\ModesXML\Client\AHFO4_1 | |041B0000|AHGraphic20.dll | | |811008 |2007-06-29 21:40:04|C:\Program Files\ModesXML\Client\AHFO4_1 | |04280000|PDFExplorer21.dll | | |1118208 |2007-07-04 12:54:06|C:\Program Files\ModesXML\Client\AHFO4_1 | |043A0000|PDFRes10.dll | | |3731456 |2007-07-04 12:54:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |04730000|XfoHyphenCH41.dll |XfoHyphenCH |4.1.2007.704 |835584 |2007-07-04 13:00:40|C:\Program Files\ModesXML\Client\AHFO4_1 | |04800000|XfoGdiCtl41.dll |XfoGdiCtl |4.1.2007.704 |266240 |2007-07-04 13:04:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |04850000|XfoRender41.dll |XfoRender |4.1.2007.704 |2420736 |2007-07-04 13:04:10|C:\Program Files\ModesXML\Client\AHFO4_1 | |04AB0000|PDFCreator25.dll | | |1253376 |2007-07-04 13:03:00|C:\Program Files\ModesXML\Client\AHFO4_1 | |04BF0000|PDFLinearizer11.dll| | |708608 |2007-07-04 13:03:02|C:\Program Files\ModesXML\Client\AHFO4_1 | |04CB0000|SVGCreator41.dll |SVGCreator |4.1.2007.704 |434176 |2007-07-04 13:03:06|C:\Program Files\ModesXML\Client\AHFO4_1 | |10000000|XfoComCtl41.dll |XfoComCtl |4.1.2007.704 |90112 |2007-07-04 13:04:32|C:\Program Files\ModesXML\Client\AHFO4_1 | |10100000|lgscroll.dll |Logitech Scroll Enabler (UNICODE) |3.15.231.0 |44544 |2006-10-25 16:13:44|C:\Program Files\Logitech\SetPoint | |20000000|xpsp2res.dll |Service Pack 2 Messages |5.1.2600.2180 |2897920 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |4A800000|icuuc34.dll |IBM ICU Common DLL |3.4.1.0 |819200 |2006-07-18 12:33:22|C:\Program Files\ModesXML\Client\AHFO4_1 | |4A900000|icuin34.dll |IBM ICU I18N DLL |3.4.1.0 |696320 |2006-07-18 12:33:20|C:\Program Files\ModesXML\Client\AHFO4_1 | |4AD00000|icudt34.dll |ICU Data DLL |3.4.1.0 |8876032 |2006-07-18 12:33:20|C:\Program Files\ModesXML\Client\AHFO4_1 | |4EC50000|gdiplus.dll |Microsoft GDI+ |5.1.3102.2180 |1712128 |2004-08-04 12:00:00|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82 | |5AD70000|UxTheme.dll |Microsoft UxTheme Library |6.0.2900.2180 |218624 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |5B860000|NETAPI32.dll |Net Win32 API DLL |5.1.2600.3462 |332800 |2008-10-15 16:57:56|C:\WINDOWS\system32 | |5D090000|comctl32.dll |Common Controls Library |5.82.2900.2982 |617472 |2006-08-25 15:45:58|C:\WINDOWS\system32 | |5EDD0000|olepro32.dll | |5.1.2600.2180 |83456 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |662B0000|hnetcfg.dll |Home Networking Configuration Manager |5.1.2600.2180 |344064 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |69B10000|msxml4.dll |MSXML 4.0 SP 2 |4.20.9848.0 |1275392 |2007-05-08 14:03:04|C:\WINDOWS\system32 | |6FA00000|sophos_detoured.dll|Sophos Buffer Overrun Protection |1.0.0.4030 |195072 |2009-09-03 07:37:26|C:\Program Files\Sophos\Sophos Anti-Virus | |71A50000|mswsock.dll |Microsoft Windows Sockets 2.0 Service Provider |5.1.2600.2180 |245248 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |71A90000|wshtcpip.dll |Windows Sockets Helper DLL |5.1.2600.2180 |19968 |2004-08-04 12:00:00|C:\WINDOWS\System32 | |71AA0000|WS2HELP.dll |Windows Socket 2.0 Helper for Windows NT |5.1.2600.2180 |19968 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |71AB0000|WS2_32.dll |Windows Socket 2.0 32-Bit DLL |5.1.2600.2180 |82944 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |71AD0000|wsock32.dll |Windows Socket 32-Bit DLL |5.1.2600.2180 |22528 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |71B20000|mpr.dll |Multiple Provider Router DLL |5.1.2600.2180 |59904 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |71BF0000|SAMLIB.dll |SAM Library DLL |5.1.2600.2180 |64000 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |72D10000|msacm32.drv |Microsoft Sound Mapper |5.1.2600.0 |20480 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |72D20000|wdmaud.drv |WDM Audio driver mapper |5.1.2600.2180 |23552 |2004-08-03 23:56:58|C:\WINDOWS\system32 | |73000000|winspool.drv |Windows Spooler Driver |5.1.2600.2180 |146432 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |73B30000|mscms.dll |Microsoft Color Matching System DLL |5.1.2600.2709 |74240 |2005-06-29 01:46:00|C:\WINDOWS\system32 | |73B50000|avifil32.dll |Microsoft AVI File support library |5.1.2600.2180 |84992 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |73BC0000|DCIMAN32.DLL |DCI Manager |5.1.2600.2180 |8704 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |74720000|MSCTF.dll |MSCTF Server DLL |5.1.2600.2180 |294400 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |74C80000|oleacc.dll |Active Accessibility Core Component |4.2.5406.0 |163328 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |74D90000|USP10.dll |Uniscribe Unicode script processor |1.420.2600.2180 |406528 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |754D0000|CRYPTUI.dll |Microsoft Trust UI Provider |5.131.2600.2180 |512512 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |75A70000|MSVFW32.dll |Microsoft Video for Windows DLL |5.1.2600.2180 |120832 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |75E90000|SXS.DLL |Fusion 2.5 |5.1.2600.3019 |713216 |2006-10-19 13:56:32|C:\WINDOWS\system32 | |76080000|MSVCP60.dll |Microsoft (R) C++ Runtime Library |6.2.3104.0 |413696 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76380000|msimg32.dll |GDIEXT Client DLL |5.1.2600.2180 |4608 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |763B0000|comdlg32.dll |Common Dialogs DLL |6.0.2900.2180 |276992 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |769C0000|USERENV.dll |Userenv |5.1.2600.2180 |723456 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76B20000|ATL.DLL |ATL Module for Windows XP (Unicode) |3.5.2284.0 |58880 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76B40000|winmm.dll |MCI API DLL |5.1.2600.2180 |176128 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76BF0000|PSAPI.DLL |Process Status Helper |5.1.2600.2180 |23040 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76C30000|WINTRUST.dll |Microsoft Trust Verification APIs |5.131.2600.2180 |176640 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76C90000|IMAGEHLP.dll |Windows NT Image Helper |5.1.2600.2180 |144384 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76F20000|DNSAPI.dll |DNS Client API DLL |5.1.2600.2938 |148480 |2006-06-26 17:37:10|C:\WINDOWS\system32 | |76F60000|WLDAP32.dll |Win32 LDAP API DLL |5.1.2600.2180 |172032 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |76FB0000|winrnr.dll |LDAP RnR Provider DLL |5.1.2600.2180 |16896 |2004-08-04 12:00:00|C:\WINDOWS\System32 | |76FC0000|rasadhlp.dll |Remote Access AutoDial Helper |5.1.2600.2938 |8192 |2006-06-26 17:37:10|C:\WINDOWS\system32 | |76FD0000|CLBCATQ.DLL | |2001.12.4414.308|498688 |2005-07-26 04:39:44|C:\WINDOWS\system32 | |77050000|COMRes.dll | |2001.12.4414.258|792064 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77120000|oleaut32.dll | |5.1.2600.3139 |549376 |2007-05-17 11:28:06|C:\WINDOWS\system32 | |771B0000|wininet.dll |Internet Extensions for Win32 |6.0.2900.3164 |658944 |2007-06-26 14:09:10|C:\WINDOWS\system32 | |773D0000|comctl32.dll |User Experience Controls Library |6.0.2900.2982 |1054208 |2006-08-25 15:45:56|C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03| |774E0000|ole32.dll |Microsoft OLE for Windows |5.1.2600.2726 |1285120 |2005-07-26 04:39:48|C:\WINDOWS\system32 | |77690000|NTMARTA.DLL |Windows NT MARTA provider |5.1.2600.2180 |118784 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77920000|SETUPAPI.dll |Windows Setup API |5.1.2600.2938 |985088 |2006-06-26 17:51:30|C:\WINDOWS\system32 | |77A80000|CRYPT32.dll |Crypto API32 |5.131.2600.2180 |597504 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77B20000|MSASN1.dll |ASN.1 Runtime APIs |5.1.2600.2180 |57344 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77BD0000|midimap.dll |Microsoft MIDI Mapper |5.1.2600.2180 |18944 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77BE0000|MSACM32.dll |Microsoft ACM Audio Filter |5.1.2600.2180 |71680 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77C00000|version.dll |Version Checking and File Installation Libraries|5.1.2600.2180 |18944 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77C10000|msvcrt.dll |Windows NT CRT DLL |7.0.2600.2180 |343040 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77DD0000|advapi32.dll |Advanced Windows 32 Base API |5.1.2600.2180 |616960 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77E70000|RPCRT4.dll |Remote Procedure Call Runtime |5.1.2600.2180 |581120 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |77F10000|GDI32.dll |GDI Client DLL |5.1.2600.3159 |282112 |2007-06-19 13:31:20|C:\WINDOWS\system32 | |77F60000|SHLWAPI.dll |Shell Light-weight Utility Library |6.0.2900.3157 |474112 |2007-06-14 18:09:20|C:\WINDOWS\system32 | |77FE0000|Secur32.dll |Security Support Provider Interface |5.1.2600.2180 |55808 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |78130000|MSVCR80.dll |Microsoft® C Runtime Library |8.0.50727.163 |626688 |2006-06-05 13:14:28|C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb | |7C340000|MSVCR71.dll |Microsoft® C Runtime Library |7.10.3052.4 |348160 |2004-04-20 09:58:04|C:\Program Files\ModesXML\Client\AHFO4_1 | |7C420000|MSVCP80.dll |Microsoft® C++ Runtime Library |8.0.50727.163 |548864 |2006-06-05 13:14:28|C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb | |7C800000|kernel32.dll |Windows NT BASE API Client DLL |5.1.2600.3119 |984576 |2007-04-16 15:52:54|C:\WINDOWS\system32 | |7C900000|ntdll.dll |NT Layer DLL |5.1.2600.2180 |708096 |2004-08-04 12:00:00|C:\WINDOWS\system32 | |7C9C0000|shell32.dll |Windows Shell Common Dll |6.0.2900.3051 |8453632 |2006-12-19 21:52:18|C:\WINDOWS\system32 | |7E290000|shdocvw.dll |Shell Doc Object and Control Library |6.0.2900.3157 |1494528 |2007-06-14 18:09:20|C:\WINDOWS\system32 | |7E410000|user32.dll |Windows XP USER API Client DLL |5.1.2600.3099 |577536 |2007-03-08 15:36:28|C:\WINDOWS\system32 | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Processes Information: -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |ID |Name |Description |Version |Memory |Priority|Threads|Path | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |692 |svchost.exe |Generic Host Process for Win32 Services |5.1.2600.2180|3371008 |Normal |2 |C:\WINDOWS\System32 | |776 |svchost.exe |Generic Host Process for Win32 Services |5.1.2600.2180|3346432 |Normal |2 |C:\WINDOWS\System32 | |780 |DrgToDsc.exe |Drag To Disc Application |9.0.0.53 |6365184 |Normal |4 |C:\Program Files\Roxio\Drag-to-Disc | |952 |hkcmd.exe |hkcmd Module |3.0.0.4642 |3366912 |Normal |2 |C:\WINDOWS\system32 | |1100|PNAMAIN.EXE |Citrix Applications |11.0.0.5357 |9162752 |Normal |5 |C:\Program Files\Citrix\ICA Client | |1528|OUTLOOK.EXE |Microsoft Office Outlook |11.0.5510.0 |36450304|Normal |18 |C:\Program Files\Microsoft Office\OFFICE11 | |1532|ModesXML.exe |ModesXML |1.2.0.167 |57626624|Normal |12 |C:\Program Files\ModesXML\Client | |2064|ALMon.exe |Component to show AutoUpdate's GUI elements.|3.11.56.190 |573440 |Normal |5 |C:\Program Files\Sophos\AutoUpdate | |2088|ntvdm.exe |NTVDM.EXE |5.1.2600.2180|1392640 |Normal |2 |C:\WINDOWS\system32 | |2164|Explorer.EXE |Windows Explorer |6.0.2900.3156|15851520|Normal |14 |C:\WINDOWS | |2200|SetPoint.exe |Logitech SetPoint Event Manager (UNICODE) |3.15.231.0 |8671232 |Normal |3 |C:\Program Files\Logitech\SetPoint | |2208|smax4pnp.exe |SMax4PNP |6.0.0.61 |4796416 |Normal |3 |C:\Program Files\Analog Devices\Core | |2228|GWSPRO.EXE | | |11776000|Normal |2 |C:\Program Files\Alchemy Mindworks\Graphic Workshop Professional| |2476|winhlp32.exe |Microsoft® Help |5.1.2600.2180|4079616 |Normal |1 |C:\WINDOWS | |2884|KHALMNPR.EXE |Logitech KHAL Main Process |3.1.206.0 |5120000 |Normal |15 |C:\Program Files\Common Files\Logitech\khalshared | |3340|WFCRUN32.EXE |Citrix Remote Application Runtime |11.0.0.5357 |7323648 |Normal |6 |C:\Program Files\Citrix\ICA Client | |3356|WFICA32.EXE |Citrix Client Engine |11.0.0.5357 |19283968|Normal |5 |C:\PROGRA~1\Citrix\ICACLI~1 | |3504|PDVDDXSrv.exe|CyberLink PowerCinema Resident Program |4.5.0.0 |5951488 |Normal |2 |C:\Program Files\CyberLink\PowerDVD DX | |3796|igfxpers.exe |persistence Module |3.0.0.4642 |3317760 |Normal |3 |C:\WINDOWS\system32 | |4048|SCFTray.exe |Sophos Client Firewall Tray icon |1.5.0.193 |4706304 |Normal |7 |C:\Program Files\Sophos\Sophos Client Firewall | |4084|ctfmon.exe |CTF Loader |5.1.2600.2180|4636672 |Normal |1 |C:\WINDOWS\system32 | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Assembler Information: -------------------------------------------------------- 0042EC37 mov edi, ecx 0042EC39 mov esi, edx 0042EC3B mov ebx, eax 0042EC3D test esi, esi 0042EC3F jl +$05 0042EC41 cmp esi, [ebx+$14] 0042EC44 jl +$0F 0042EC46 mov edx, [$D2F61C] 0042EC4C mov ecx, esi 0042EC4E mov eax, ebx 0042EC50 call -$000015C5 ; <-- EXCEPTION 0042EC55 mov eax, ebx 0042EC57 mov edx, [eax] 0042EC59 call dword ptr [edx+$0084] 0042EC5F mov eax, [ebx+$10] 0042EC62 mov [eax+esi*8+$04], edi 0042EC66 mov eax, ebx 0042EC68 mov edx, [eax] 0042EC6A call dword ptr [edx+$0080] 0042EC70 pop edi 0042EC71 pop esi Registers: ----------------------------- EAX: 7EE04420 EDI: FFFFFFFF EBX: 7F95ACF8 ESI: FFFFFFFF ECX: 00000000 ESP: 0012F900 EDX: 0042EC55 EIP: 0042EC50 Stack: Memory Dump: ------------------ --------------------------------------------------------------------------- 0012F900: FFFFFFFF 0042EC50: E8 3B EA FF FF 8B C3 8B 10 FF 92 84 00 00 00 8B .;.............. 0012F904: 0042ED00 0042EC60: 43 10 89 7C F0 04 8B C3 8B 10 FF 92 80 00 00 00 C..|............ 0012F908: 00426040 0042EC70: 5F 5E 5B C3 55 8B EC 83 C4 F0 53 56 89 4D F4 89 _^[.U.....SV.M.. 0012F90C: 7F902060 0042EC80: 55 F8 89 45 FC 8B 5D F8 8B 75 F4 8B 45 F8 03 45 U..E..]..u..E..E 0012F910: 0042D6C2 0042EC90: F4 D1 E8 89 45 F0 EB 01 43 8B 4D F0 8B D3 8B 45 ....E...C.M....E 0012F914: 0012F948 0042ECA0: FC FF 55 08 85 C0 7C F0 EB 01 4E 8B 4D F0 8B D6 ..U...|...N.M... 0012F918: 004051A8 0042ECB0: 8B 45 FC FF 55 08 85 C0 7F F0 3B F3 7C 20 8B CE .E..U.....;.| .. 0012F91C: 0012F930 0042ECC0: 8B D3 8B 45 FC E8 C2 FC FF FF 3B 5D F0 75 05 89 ...E......;].u.. 0012F920: 00000001 0042ECD0: 75 F0 EB 08 3B 75 F0 75 03 89 5D F0 43 4E 3B F3 u...;u.u..].CN;. 0012F924: FFFFFFFF 0042ECE0: 7D B7 3B 75 F8 7E 11 8B 45 08 50 8B CE 8B 55 F8 }.;u.~..E.P...U. 0012F928: 7F902060 0042ECF0: 8B 45 FC E8 7C FF FF FF 89 5D F8 3B 5D F4 7C 85 .E..|....].;].|. 0012F92C: 00000000 0042ED00: 5E 5B 8B E5 5D C2 04 00 53 56 8B F2 8B D8 8B D6 ^[..]...SV...... 0012F930: 0012F9AC 0042ED10: C1 E2 03 8D 43 10 E8 9D 42 FD FF 89 73 18 5E 5B ....C...B...s.^[ 0012F934: 0042EC55 0042ED20: C3 8D 40 00 53 56 8B DA 8B F0 3A 5E 1C 74 11 84 ..@.SV....:^.t.. 0012F938: 00429124 0042ED30: DB 74 0A 8B C6 8B 10 FF 92 90 00 00 00 88 5E 1C .t............^. 0012F93C: 00429124 0042ED40: 5E 5B C3 90 84 D2 74 09 8B 10 FF 92 84 00 00 00 ^[....t.........