Jump to content

Recommended Posts

Hi,

I just downloaded and it prompted me for an application update, after I clicked yes on reboot it crashed.

Here is the information from windbg which I have set as Just-in-time debugger, hopefully it will help you fixing the issue.

Microsoft ® Windows Debugger Version 6.12.0002.633 X86

Copyright © Microsoft Corporation. All rights reserved.

*** wait with pending attach

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

ModLoad: 00400000 00875000 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

ModLoad: 7c900000 7c9b2000 C:\WINDOWS\system32\ntdll.dll

ModLoad: 7c800000 7c8f5000 C:\WINDOWS\system32\kernel32.dll

ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll

ModLoad: 77f10000 77f58000 C:\WINDOWS\system32\GDI32.dll

ModLoad: 7c9c0000 7d1d6000 C:\WINDOWS\system32\SHELL32.dll

ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll

ModLoad: 77e70000 77f02000 C:\WINDOWS\system32\RPCRT4.dll

ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll

ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll

ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll

ModLoad: 774e0000 7761c000 C:\WINDOWS\system32\ole32.dll

ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll

ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll

ModLoad: 773d0000 774d2000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll

ModLoad: 76380000 76385000 C:\WINDOWS\system32\MSIMG32.dll

ModLoad: 76d60000 76d79000 C:\WINDOWS\system32\IPHLPAPI.DLL

ModLoad: 71ab0000 71ac7000 C:\WINDOWS\system32\WS2_32.dll

ModLoad: 71aa0000 71aa8000 C:\WINDOWS\system32\WS2HELP.dll

ModLoad: 71ad0000 71ad9000 C:\WINDOWS\system32\WSOCK32.dll

ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll

ModLoad: 771b0000 77258000 C:\WINDOWS\system32\WININET.dll

ModLoad: 77a80000 77b14000 C:\WINDOWS\system32\CRYPT32.dll

ModLoad: 77b20000 77b32000 C:\WINDOWS\system32\MSASN1.dll

ModLoad: 5b860000 5b8b4000 C:\WINDOWS\system32\NETAPI32.dll

ModLoad: 76bf0000 76bfb000 C:\WINDOWS\system32\PSAPI.DLL

ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll

ModLoad: 74720000 7476b000 C:\WINDOWS\system32\MSCTF.dll

ModLoad: 77b40000 77b62000 C:\WINDOWS\system32\Apphelp.dll

(2f4.d0): Access violation - code c0000005 (!!! second chance !!!)

eax=00000000 ebx=77d6f3c6 ecx=00000000 edx=00000000 esi=00000000 edi=fffffffe

eip=00509302 esp=0287f9e8 ebp=00000000 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

SUPERAntiSpyware+0x109302:

00509302 8b01 mov eax,dword ptr [ecx] ds:0023:00000000=????????

0:000> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

GetPageUrlData failed, server returned HTTP status 404

URL requested: http://watson.microsoft.com/StageOne/SUPERAntiSpyware_exe/5_0_0_1096/SUPERAntiSpyware_exe/5_0_0_1096/00109302.htm?Retriage=1

FAULTING_IP:

SUPERAntiSpyware+109302

00509302 8b01 mov eax,dword ptr [ecx]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 00509302 (SUPERAntiSpyware+0x00109302)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000000

Attempt to read from address 00000000

FAULTING_THREAD: 000000d0

PROCESS_NAME: SUPERAntiSpyware.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000000

READ_ADDRESS: 00000000

FOLLOWUP_IP:

SUPERAntiSpyware+109302

00509302 8b01 mov eax,dword ptr [ecx]

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_READ_PROBABLYEXPLOITABLE

PRIMARY_PROBLEM_CLASS: NULL_POINTER_READ_PROBABLYEXPLOITABLE

DEFAULT_BUCKET_ID: NULL_POINTER_READ_PROBABLYEXPLOITABLE

LAST_CONTROL_TRANSFER: from 00000000 to 00509302

STACK_TEXT:

00000000 00000000 00000000 00000000 00000000 SUPERAntiSpyware+0x109302

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: SUPERAntiSpyware+109302

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SUPERAntiSpyware

DEBUG_FLR_IMAGE_TIMESTAMP: 4e14ac6b

STACK_COMMAND: ~0s ; kb

BUCKET_ID: APPLICATION_FAULT_NULL_POINTER_READ_PROBABLYEXPLOITABLE_SUPERAntiSpyware+109302

IMAGE_NAME: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

FAILURE_BUCKET_ID: NULL_POINTER_READ_PROBABLYEXPLOITABLE_c0000005_C:_Program_Files_SUPERAntiSpyware_SUPERAntiSpyware.exe!Unknown

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/SUPERAntiSpyware_exe/5_0_0_1096/4e14ac6b/SUPERAntiSpyware_exe/5_0_0_1096/4e14ac6b/c0000005/00109302.htm?Retriage=1

Followup: MachineOwner

---------

Share this post


Link to post
Share on other sites

btw this is on a VMware virtual machine, using Windows XP SP3, if you need more data please let me know :)

Share this post


Link to post
Share on other sites

btw this is on a VMware virtual machine, using Windows XP SP3, if you need more data please let me know :)

Thanks for the info. We found and fixed the issue thanks to your debug dump.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...