Please Help Me With This Error, Its Driving Me Crazy

the_punisher · Jul 12, 2008

I have attached the screenshot of this error.

when I click dont sent, the window closes and after this all internet activity stops, i cant browse the internet after this and I have to restart my laptop.

here is what I get when I click on detailed report.

C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\svchost.exe.mdmp
C:\DOCUME~1\FARAZA~1.SOF\LOCALS~1\Temp\WER697d.dir00\appcompat.txt
Click to expand...

and I used microfost debugger to debug the crash dump file, here is the report:

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\Faraz Ahmed\Desktop\crap\svchost.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Thu Jul 10 22:02:08.000 2008 (GMT+5)
System Uptime: not available
Process Uptime: 0 days 1:05:26.000
................................................................................
......................................................................
Loading unloaded module list
............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(48c.95c): Access violation - code c0000005 (first/second chance not available)
eax=00000001 ebx=80070000 ecx=c0000005 edx=00000000 esi=00000c88 edi=00000000
eip=7c90eb94 esp=006d984c ebp=006d98b0 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
0:061> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_IP:
msvcrt!wcscpy+e
77c47ea2 668901 mov word ptr [ecx],ax

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77c47ea2 (msvcrt!wcscpy+0x0000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 064d6000
Attempt to write to address 064d6000

DEFAULT_BUCKET_ID: STATUS_ACCESS_VIOLATION

PROCESS_NAME: svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 064d6000

FAULTING_THREAD: 0000095c

PRIMARY_PROBLEM_CLASS: STATUS_ACCESS_VIOLATION

BUGCHECK_STR: APPLICATION_FAULT_STATUS_ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 5b86a3b1 to 77c47ea2

STACK_TEXT:
006df470 5b86a3b1 064d5ca0 006df494 00000000 msvcrt!wcscpy+0xe
006df8ac 90909090 90909090 90909090 90909090 netapi32!CanonicalizePathName+0x144
WARNING: Frame IP not in any known module. Following frames may be wrong.
006df924 77ef321a 7509da52 006df938 00000007 0x90909090
006dfd3c 77ef36ee 00000000 00000000 000fc6a4 rpcrt4!NdrStubCall2+0x297
006dfd58 77e7988c 000fc6a4 0011a558 000fc6a4 rpcrt4!NdrServerCall2+0x19
006dfd8c 77e797f1 750933bb 000fc6a4 006dfe2c rpcrt4!DispatchToStubInC+0x38
006dfde0 77e7971d 0000001f 00000000 750a3f0c rpcrt4!RPC_INTERFACE:ispatchToStubWorker+0x113
006dfe04 77e81930 000fc6a4 00000000 750a3f0c rpcrt4!RPC_INTERFACE:ispatchToStub+0x84
006dfe34 77e8185d 000fc668 00000000 000fc630 rpcrt4!OSF_SCALL:ispatchHelper+0x115
006dfe48 77e817e1 00000000 0000001f 000fd6e0 rpcrt4!OSF_SCALL:ispatchRPCCall+0xfe
006dfe78 77e816ec 000fd6e0 0300031c 0000001f rpcrt4!OSF_SCALL:rocessReceivedPDU+0x58a
006dfea0 77e7dd5e 000fd6e0 0000031c 7c809794 rpcrt4!OSF_SCALL::BeginRpcCall+0x1f4
006dff00 77e7dc99 00000000 000fd6e0 0000031c rpcrt4!OSF_SCONNECTION:rocessReceiveComplete+0x3fb
006dff14 77e7728a 0009f6e0 0000000c 00000000 rpcrt4!ProcessConnectionServerReceivedEvent+0x21
006dff80 77e773a9 006dffa8 77e76a3b 0009f6e0 rpcrt4!LOADABLE_TRANSPORT:rocessIOEvents+0x16f
006dff88 77e76a3b 0009f6e0 00090778 00090000 rpcrt4!ProcessIOEventsWrapper+0xd
006dffa8 77e76c0a 0009df00 006dffec 7c80b50b rpcrt4!BaseCachedThreadRoutine+0x79
006dffb4 7c80b50b 000cb230 00090778 00090000 rpcrt4!ThreadStartRoutine+0x1a
006dffec 00000000 77e76bf0 000cb230 00000000 kernel32!BaseThreadStart+0x37

FOLLOWUP_IP:
msvcrt!wcscpy+e
77c47ea2 668901 mov word ptr [ecx],ax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: msvcrt!wcscpy+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msvcrt

IMAGE_NAME: msvcrt.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 41109752

STACK_COMMAND: ~61s; .ecxr ; kb

FAILURE_BUCKET_ID: STATUS_ACCESS_VIOLATION_c0000005_msvcrt.dll!wcscpy

BUCKET_ID: APPLICATION_FAULT_STATUS_ACCESS_VIOLATION_msvcrt!wcscpy+e

Followup: MachineOwner
Click to expand...

can anyone please find out the problem here.

I have formatted my laptop and reinstalled windows 3 times because of this error and I cant keep on doing this.

:cry:cry:cry

also I get this error when I am connected to the internet

the_punisher · Jul 12, 2008

can no one help me out here?

TimW · Jul 12, 2008

Please go to the malware section and do the READ & RUN ME FIRST. Malware Removal Guide

Then start a thread there with the requested logs attached.

Log in or Sign up

Please Help Me With This Error, Its Driving Me Crazy

the_punisher Private E-2

Attached Files:

error.JPG

the_punisher Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Please Help Me With This Error, Its Driving Me Crazy

the_punisher Private E-2

Attached Files:

error.JPG

the_punisher Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches