微点交流论坛 - 微点主动防御软件 - 不明白自己的是什么问题。请解决下

hnayzdf
新手上路

积分 16
发帖 16
注册 2006-9-11

#1 不明白自己的是什么问题。请解决下

开着微点我的E盘工具备份打开就出现错误，关掉就不会没问题。

我的系统日志，我是菜鸟，帮忙看看有啥问题。
Logfile of HijackThis v1.99.1
Scan saved at 21:37:08, on 2006-9-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Virus Chaser\Vcrmon.exe
C:\Program Files\FengYun\FYFireWall.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\racer-henan-cnc\racer.exe
C:\Program Files\Virus Chaser\SpiderNT.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Virus Chaser\Spiderui.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\racer-henan-cnc\RacerKp.exe
C:\WINDOWS\system32\conime.exe
E:\qq\QQ.exe
E:\qq\TIMPlatform.exe
E:\qq\qqpet\qqpet.exe
D:\宠物保姆\QQPetNurse.exe
F:\Evil Player\Evil_Player.exe
G:\Maxthon\Maxthon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\hh.exe
C:\Documents and Settings\Administrator\桌面\HijackThis.exe

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - G:\FLASHGET\jccatch.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - E:\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - F:\KuGoo\KuGoo3DownXControl.ocx
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - G:\FLASHGET\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - G:\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [Vcrmon] C:\Program Files\Virus Chaser\Vcrmon.exe
O4 - HKLM\..\Run: [FY_FireWall] C:\Program Files\FengYun\FYFireWall.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 河南网通宽带用户客户端.lnk = C:\Program Files\racer-henan-cnc\racer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - F:\KuGoo\KuGoo3DownX.htm
O8 - Extra context menu item: 使用网际快车下载 - G:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - G:\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用迅雷下载 - E:\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - E:\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\qq\SendMMS.htm
O9 - Extra button: 联想 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.lenovo.com (file missing)
O9 - Extra 'Tools' menuitem: 联想 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.lenovo.com (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/wind ... e.cab?1157987732689
O23 - Service: MPSVC Service (MPSVCService) - Micropoint Corporation - C:\Program Files\Micropoint\MPSVC.exe
O23 - Service: Virus Chaser Spider NT (spidernt) - New Technology Wave Inc. - C:\Program Files\Virus Chaser\SpiderNT.exe

系统出现错误图片

[ Last edited by hnayzdf on 2006-9-14 at 21:30 ]

附件 1: {D0E4A17F-B877-4A6B-922B-9A73EE995848}.JPG (2006-9-14 21:29, 86.72 K,下载次数： 14)

※ ※ ※ 本文纯属【hnayzdf】个人意见，与【微点交流论坛】立场无关※ ※ ※

2006-9-14 21:29

Legend
超级版主

超级版主

积分 77171
发帖 70170
注册 2005-10-29

#2

请问楼主微点的版本？系统是？是否安装了其它安全软件？

※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※

微点官方认证新浪微博：欢迎进入微点新浪微博
微点技术支持邮箱: support@micropoint.com.cn
给Legend发短消息

2006-9-14 21:33

hnayzdf
新手上路

积分 16
发帖 16
注册 2006-9-11

Quote:

Originally posted by Legend at 2006-9-14 21:33:
请问楼主微点的版本？系统是？是否安装了其它安全软件？

安装驱逐舰杀毒软件最新，风云最新版本防火墙，微点最新版本

※ ※ ※ 本文纯属【hnayzdf】个人意见，与【微点交流论坛】立场无关※ ※ ※

2006-9-14 21:37

Legend
超级版主

超级版主

积分 77171
发帖 70170
注册 2005-10-29

#4

请到C:\WINDOWS\System32\，找到drwtsn32.exe，双击运行，根据其中的“日志文件路径找到对应的日志文件（比如C:\Documents and Settings\All Users\Application Data\Microsoft\memory.log，就到这目录下找到这个文件memory.log)，把这个文件发到support@micropoint.com.cn，谢谢

※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※

微点官方认证新浪微博：欢迎进入微点新浪微博
微点技术支持邮箱: support@micropoint.com.cn
给Legend发短消息

2006-9-14 21:47

hnayzdf
新手上路

积分 16
发帖 16
注册 2006-9-11

Quote:

Originally posted by Legend at 2006-9-14 21:47:
请到C:\WINDOWS\System32\，找到drwtsn32.exe，双击运行，根据其中的“日志文件路径找到对应的日志文件（比如C:\Documents and Settings\All Users\Application Data\Microsoft\memory.log，就到这目录下找到这个 ...

是微点文件夹的一个文件呀

下面是系统医生的报告
和系统医生报告错误图片

还用发给你那个文件吗？
发生应用程序意外错误:
      应用程序: C:\Program Files\Micropoint\MPMon.exe (pid=3596)
      时间: 2006-9-14 @ 11:36:57.000
      意外情况编号: c0000005 (访问侵犯)

*----> 系统信息 <----*
      计算机名: LENOVO-E2D30FB7
      用户名: Administrator
      终端会话 Id: 0
      处理器数量: 2
      处理器类型: x86 Family 15 Model 2 Stepping 9
      Windows 版本: 5.1
      当前内部版本号: 2600
      Service Pack: 2
      当前类型: Multiprocessor Free
      注册的单位: Lenovo (Beijing) Limited
      注册的所有者: Lenovo User

*----> 任务列表 <----*
0 System Process
4 System
472 smss.exe
528 csrss.exe
552 winlogon.exe
596 services.exe
608 lsass.exe
820 svchost.exe
856 MPSVC.exe
976 MPSVC1.exe
996 svchost.exe
1100 svchost.exe
1192 svchost.exe
1276 svchost.exe
1428 spoolsv.exe
1624 Explorer.EXE
1852 Vcrmon.exe
1864 FYFireWall.exe
1880 ctfmon.exe
1904 racer.exe
756 RacerKp.exe
1300 SpiderNT.exe
1616 wdfmgr.exe
1076 alg.exe
1312 Spiderui.exe
2220 BitComet.exe
2492 BitComet.exe
2728 Maxthon.exe
3596 MPMon.exe
2552 drwtsn32.exe
2560 MPSVC2.exe

*----> 模块清单 <----*
(0000000000370000 - 0000000000376000: C:\Program Files\Micropoint\mp110078.dll
(0000000000380000 - 0000000000397000: C:\Program Files\Micropoint\mp110049.dll
(0000000000400000 - 0000000000428000: C:\Program Files\Micropoint\MPMon.exe
(0000000000a00000 - 0000000000c40000: C:\Program Files\Micropoint\mp110051.dll
(0000000000ca0000 - 0000000000d11000: C:\Program Files\FengYun\Hook.dll
(0000000010000000 - 0000000010017000: C:\Program Files\Micropoint\mp110036.dll
(0000000015000000 - 0000000015019000: C:\Program Files\Micropoint\mp110031.dll
(000000005adc0000 - 000000005adf7000: C:\WINDOWS\system32\uxtheme.dll
(000000005d170000 - 000000005d207000: C:\WINDOWS\system32\COMCTL32.dll
(0000000060fd0000 - 0000000061025000: C:\WINDOWS\system32\hnetcfg.dll
(0000000061be0000 - 0000000061bed000: C:\WINDOWS\system32\MFC42LOC.DLL
(0000000062c20000 - 0000000062c29000: C:\WINDOWS\system32\LPK.DLL
(00000000719c0000 - 00000000719fe000: C:\WINDOWS\system32\mswsock.dll
(0000000071a00000 - 0000000071a08000: C:\WINDOWS\System32\wshtcpip.dll
(0000000071a10000 - 0000000071a18000: C:\WINDOWS\system32\WS2HELP.dll
(0000000071a20000 - 0000000071a37000: C:\WINDOWS\system32\WS2_32.dll
(0000000073640000 - 000000007366e000: C:\WINDOWS\system32\msctfime.ime
(0000000073d30000 - 0000000073e2e000: C:\WINDOWS\system32\MFC42.DLL
(0000000073fa0000 - 000000007400b000: C:\WINDOWS\system32\USP10.dll
(0000000074680000 - 00000000746cb000: C:\WINDOWS\system32\MSCTF.dll
(0000000076300000 - 000000007631d000: C:\WINDOWS\system32\IMM32.DLL
(0000000076990000 - 0000000076acd000: C:\WINDOWS\system32\ole32.dll
(0000000076bc0000 - 0000000076bcb000: C:\WINDOWS\system32\PSAPI.DLL
(0000000076d70000 - 0000000076d92000: C:\WINDOWS\system32\Apphelp.dll
(00000000770f0000 - 000000007717c000: C:\WINDOWS\system32\oleaut32.dll
(0000000077180000 - 0000000077282000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(0000000077bd0000 - 0000000077bd8000: C:\WINDOWS\system32\version.dll
(0000000077be0000 - 0000000077c38000: C:\WINDOWS\system32\msvcrt.dll
(0000000077d10000 - 0000000077d9f000: C:\WINDOWS\system32\USER32.dll
(0000000077da0000 - 0000000077e49000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e50000 - 0000000077ee1000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077ef0000 - 0000000077f37000: C:\WINDOWS\system32\GDI32.dll
(0000000077f40000 - 0000000077fb6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fc0000 - 0000000077fd1000: C:\WINDOWS\system32\Secur32.dll
(000000007c800000 - 000000007c91c000: C:\WINDOWS\system32\kernel32.dll
(000000007c920000 - 000000007c9b4000: C:\WINDOWS\system32\ntdll.dll
(000000007d590000 - 000000007dd82000: C:\WINDOWS\system32\SHELL32.dll

[ Last edited by hnayzdf on 2006-9-14 at 22:03 ]

※ ※ ※ 本文纯属【hnayzdf】个人意见，与【微点交流论坛】立场无关※ ※ ※

2006-9-14 22:01

hnayzdf
新手上路

积分 16
发帖 16
注册 2006-9-11

#6

*----> 线程 ID 0xd84 的状态转储 <----*

eax=00000000 ebx=0012f578 ecx=00000000 edx=00cff5c4 esi=0041ba3b edi=0012f578
eip=7c99b893 esp=0012f4ac ebp=0012f4ec iopl=0       nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000          efl=00200202

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
函数: ntdll!wcstombs
      7c99b87f 0000          add    [eax],al
      7c99b881 0000          add    [eax],al
      7c99b883 0000          add    [eax],al
      7c99b885 0000          add    [eax],al
      7c99b887 0000          add    [eax],al
      7c99b889 0000          add    [eax],al
      7c99b88b 0000          add    [eax],al
      7c99b88d 0000          add    [eax],al
      7c99b88f 0000          add    [eax],al
      7c99b891 0000          add    [eax],al
错误 ->7c99b893 0000          add    [eax],al             ds:0023:00000000=??
      7c99b895 0000          add    [eax],al
      7c99b897 0000          add    [eax],al
      7c99b899 0000          add    [eax],al
      7c99b89b 0000          add    [eax],al
      7c99b89d 0000          add    [eax],al
      7c99b89f 0000          add    [eax],al
      7c99b8a1 0000          add    [eax],al
      7c99b8a3 0000          add    [eax],al
      7c99b8a5 0000          add    [eax],al
      7c99b8a7 0000          add    [eax],al

*----> 堆栈反向跟踪 <---*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\MFC42.DLL -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -
ChildEBP RetAddr  Args to Child
0012f4ec 5f04000a 00000000 0012f578 00000000 ntdll!wcstombs+0xaf56
0012f810 73d31b9b 00000464 00000fa0 00415810 0x5f04000a
0012f830 73d31b05 00000464 00000fa0 00000203 MFC42!Ordinal6374+0x24
0012f890 73d31a58 0012fadc 00000000 00000464 MFC42!Ordinal1109+0x91
0012f8b0 73dc847d 00120326 00000464 00000fa0 MFC42!Ordinal1578+0x36
0012f8dc 77d18734 00120326 00000464 00000fa0 MFC42!Ordinal1579+0x39
0012f908 77d18816 73dc8444 00120326 00000464 USER32!GetDC+0x6d
0012f970 77d1b4c0 00000000 73dc8444 00120326 USER32!GetDC+0x14f
0012f9c4 77d1b50c 0066ea10 00000464 00000fa0 USER32!DefWindowProcW+0x184
0012f9ec 7c92eae3 0012f9fc 00000018 0066ea10 USER32!DefWindowProcW+0x1d0
0012fa38 73d31233 00420c2c 00000000 00000000 ntdll!KiUserCallbackDispatcher+0x13
00420c2c 00000113 00000001 00000000 001ab567 MFC42!Ordinal5307+0x15

*----> 原始堆栈转储 <----*
000000000012f4ac  d4 fc cc 00 00 00 00 00 - 78 f5 12 00 00 00 00 00  ........x.......
000000000012f4bc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f4cc  00 00 00 00 34 f5 12 00 - 24 f5 12 00 04 f8 12 00  ....4...$.......
000000000012f4dc  01 fd cc 00 ec f4 12 00 - dc fa 12 00 d4 20 d2 00  ............. ..
000000000012f4ec  10 f8 12 00 0a 00 04 5f - 00 00 00 00 78 f5 12 00  ......._....x...
000000000012f4fc  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f50c  00 00 00 00 00 00 00 00 - 34 f5 12 00 24 f5 12 00  ........4...$...
000000000012f51c  dc fa 12 00 03 02 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f52c  00 00 00 00 00 00 00 00 - 44 00 00 00 00 00 00 00  ........D.......
000000000012f53c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f54c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f55c  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000012f56c  00 00 00 00 00 00 00 00 - 00 00 00 00 43 3a 5c 50  ............C:\P
000000000012f57c  72 6f 67 72 61 6d 20 46 - 69 6c 65 73 5c 4d 69 63  rogram Files\Mic
000000000012f58c  72 6f 70 6f 69 6e 74 5c - 4d 50 4d 61 69 6e 2e 65  ropoint\MPMain.e
000000000012f59c  78 65 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  xe..............
000000000012f5ac  45 67 d3 73 00 00 00 00 - 00 00 00 00 00 00 00 00  Eg.s............
000000000012f5bc  45 67 d3 73 00 00 00 00 - 00 00 00 00 13 01 00 00  Eg.s............
000000000012f5cc  26 03 12 00 10 ea 66 00 - 26 03 12 00 6a 03 00 00  &.....f.&...j...
000000000012f5dc  26 03 12 00 10 ea 66 00 - 26 03 12 00 6a 03 00 00  &.....f.&...j...

*----> 线程 ID 0x86c 的状态转储 <----*

eax=00000000 ebx=00000103 ecx=0014a3c0 edx=7c99e4c0 esi=00000000 edi=00000000
eip=7c92eb94 esp=00f8ff28 ebp=00f8ff6c iopl=0       nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000          efl=00000246

※ ※ ※ 本文纯属【hnayzdf】个人意见，与【微点交流论坛】立场无关※ ※ ※

2006-9-14 22:02

hnayzdf
新手上路

积分 16
发帖 16
注册 2006-9-11

#7

函数: ntdll!KiFastSystemCallRet
      7c92eb89 90             nop
      7c92eb8a 90             nop
      ntdll!KiFastSystemCall:
      7c92eb8b 8bd4          mov    edx,esp
      7c92eb8d 0f34          sysenter
      7c92eb8f 90             nop
      7c92eb90 90             nop
      7c92eb91 90             nop
      7c92eb92 90             nop
      7c92eb93 90             nop
      ntdll!KiFastSystemCallRet:
      7c92eb94 c3             ret
      7c92eb95 8da42400000000 lea    esp,[esp]
      7c92eb9c 8d642400       lea    esp,[esp]
      7c92eba0 90             nop
      7c92eba1 90             nop
      7c92eba2 90             nop
      7c92eba3 90             nop
      7c92eba4 90             nop
      ntdll!KiIntSystemCall:
      7c92eba5 8d542408       lea    edx,[esp+0x8]
      7c92eba9 cd2e          int    2e

*----> 堆栈反向跟踪 <---*
*** WARNING: Unable to verify checksum for C:\Program Files\Micropoint\MPMon.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Micropoint\MPMon.exe
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr  Args to Child
00f8ff6c 0040ce49 000000dc 00000000 00000000 ntdll!KiFastSystemCallRet
000000dc 00000000 00000000 00000000 00000000 MPMon+0xce49

*----> 原始堆栈转储 <----*
0000000000f8ff28  69 da 92 7c a6 14 83 7c - dc 00 00 00 00 00 00 00  i..|...|........
0000000000f8ff38  00 00 00 00 00 00 00 00 - 64 ff f8 00 08 00 11 00  ........d.......
0000000000f8ff48  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f8ff58  00 00 00 00 30 58 3a 00 - 58 bf 41 00 08 00 00 00  ....0X:.X.A.....
0000000000f8ff68  08 00 00 00 dc 00 00 00 - 49 ce 40 00 dc 00 00 00  ........I.@.....
0000000000f8ff78  00 00 00 00 00 00 00 00 - 00 00 00 00 ec ff f8 00  ................
0000000000f8ff88  00 00 00 00 0c 00 00 00 - c0 a3 14 00 00 00 00 00  ................
0000000000f8ff98  40 d2 40 00 01 00 00 00 - 08 00 00 00 20 00 00 00  @.@......... ...
0000000000f8ffa8  01 00 00 00 00 00 00 00 - 00 00 00 00 b0 ff f8 00  ................
0000000000f8ffb8  83 b6 80 7c 00 00 00 00 - 00 00 00 00 00 00 00 00  ...|............
0000000000f8ffc8  00 00 00 00 00 c0 fd 7f - 00 36 3b 82 c0 ff f8 00  .........6;.....
0000000000f8ffd8  58 b2 53 81 ff ff ff ff - a8 9a 83 7c 90 b6 80 7c  X.S........|...|
0000000000f8ffe8  00 00 00 00 00 00 00 00 - 00 00 00 00 30 d2 40 00  ............0.@.
0000000000f8fff8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90008  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90018  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90028  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90038  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90048  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000f90058  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

*----> 线程 ID 0xed8 的状态转储 <----*

eax=77c0a341 ebx=0108fe60 ecx=00000000 edx=00000000 esi=00000000 edi=7ffde000
eip=7c92eb94 esp=0108fe38 ebp=0108fed4 iopl=0       nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000          efl=00000246

函数: ntdll!KiFastSystemCallRet
      7c92eb89 90             nop
      7c92eb8a 90             nop
      ntdll!KiFastSystemCall:
      7c92eb8b 8bd4          mov    edx,esp
      7c92eb8d 0f34          sysenter
      7c92eb8f 90             nop
      7c92eb90 90             nop
      7c92eb91 90             nop
      7c92eb92 90             nop
      7c92eb93 90             nop
      ntdll!KiFastSystemCallRet:
      7c92eb94 c3             ret
      7c92eb95 8da42400000000 lea    esp,[esp]
      7c92eb9c 8d642400       lea    esp,[esp]
      7c92eba0 90             nop
      7c92eba1 90             nop
      7c92eba2 90             nop
      7c92eba3 90             nop
      7c92eba4 90             nop
      ntdll!KiIntSystemCall:
      7c92eba5 8d542408       lea    edx,[esp+0x8]
      7c92eba9 cd2e          int    2e

*----> 堆栈反向跟踪 <---*
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\msvcrt.dll -
ChildEBP RetAddr  Args to Child
0108fed4 7c80a075 00000002 00420d18 00000000 ntdll!KiFastSystemCallRet
0108fef0 00405732 00000002 00420d18 00000000 kernel32!WaitForMultipleObjects+0x18
0108ff80 77c0a3b0 0012f38c 00000000 00000000 MPMon+0x5732
0108ffb4 7c80b683 003a6738 00000000 00000000 msvcrt!endthreadex+0xa9
0108ffec 00000000 77c0a341 003a6738 00000000 kernel32!GetModuleFileNameA+0x1b4

*----> 原始堆栈转储 <----*
000000000108fe38  ab e9 92 7c e2 94 80 7c - 02 00 00 00 60 fe 08 01  ...|...|....`...
000000000108fe48  01 00 00 00 00 00 00 00 - 00 00 00 00 9a f3 d2 77  ...............w
000000000108fe58  c0 66 3a 00 5d a0 80 7c - d8 00 00 00 e4 00 00 00  .f:.]..|........
000000000108fe68  e6 19 93 7c 24 1a 93 7c - 80 c0 99 7c fa 19 93 7c  ...|$..|...|...|
000000000108fe78  28 0d 42 00 c0 66 3a 00 - 14 00 00 00 01 00 00 00  (.B..f:.........
000000000108fe88  00 00 00 00 00 00 00 00 - 10 00 00 00 00 b0 fd 7f  ................
000000000108fe98  74 ff 08 01 18 ee 92 7c - 00 e0 fd 7f 00 b0 fd 7f  t......|........
000000000108fea8  d6 1a 93 7c 00 00 00 00 - 60 fe 08 01 8c f3 12 00  ...|....`.......
000000000108feb8  02 00 00 00 54 fe 08 01 - 8c f3 12 00 74 ff 08 01  ....T.......t...
000000000108fec8  a8 9a 83 7c d8 95 80 7c - 00 00 00 00 f0 fe 08 01  ...|...|........
000000000108fed8  75 a0 80 7c 02 00 00 00 - 18 0d 42 00 00 00 00 00  u..|......B.....
000000000108fee8  ff ff ff ff 00 00 00 00 - 80 ff 08 01 32 57 40 00  ............2W@.
000000000108fef8  02 00 00 00 18 0d 42 00 - 00 00 00 00 ff ff ff ff  ......B.........
000000000108ff08  8c f3 12 00 c0 66 3a 00 - e4 00 00 00 bd 0b d4 73  .....f:........s
000000000108ff18  d8 00 00 00 00 00 00 00 - c8 67 3a 00 38 67 3a 00  .........g:.8g:.
000000000108ff28  70 ff 08 01 4c 76 dd 73 - 01 00 00 00 00 00 00 00  p...Lv.s........
000000000108ff38  00 00 00 00 00 00 00 00 - 01 00 00 00 00 00 00 00  ................
000000000108ff48  78 3c 14 00 26 03 12 00 - 00 00 00 00 00 00 00 00  x<..&...........
000000000108ff58  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000000108ff68  00 00 00 00 c0 66 3a 00 - 1c ff 08 01 a4 ff 08 01  .....f:.........

附件 1: {81B2BBD8-21D2-41A6-940A-96AEC5F8023E}.JPG (2006-9-14 22:02, 36.9 K,下载次数： 10)

※ ※ ※ 本文纯属【hnayzdf】个人意见，与【微点交流论坛】立场无关※ ※ ※

2006-9-14 22:02

Legend
超级版主

超级版主

积分 77171
发帖 70170
注册 2005-10-29

#8

感谢你提供的信息，请您加630086群，让管理员帮你分析一下

※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※

微点官方认证新浪微博：欢迎进入微点新浪微博
微点技术支持邮箱: support@micropoint.com.cn
给Legend发短消息

2006-9-14 22:04

论坛跳转:

可打印版本 | 推荐 | 订阅 | 收藏

[ 联系我们 - 东方微点 ] 北京东方微点信息技术有限责任公司福建东方微点信息安全有限责任公司闽ICP备05030815号