Win2K Crashing intermittently, can't read minidumps.

[kms65]

Hello,

I am trying to determine the cause of intermittent crashing on a family member's computer. It is a six year old laptop, Windows 2000, used very lightly. I have run virus/spyware scans, as well as chkdsk and memtest-86.

I tried to read the minidump files using windbg, but the computer only came with setup files (no disk) on a backup partition. I get the error: "Unable to verify timestamp for ntoskrnl.exe". I suspect that the image files used to install Windows were somehow different from the ones provided on the backup partition.

Can someone please read the attached minidump files for me? Thanks in advance.

 

[kms65]

It would help if I attached them....

 

[howard_hopkinso]

Hello and welcome to Techspot.

Originally posted by cpc2004 and taken from this thread HERE.

Your windows is W2K SP4 and W2K minidump does not dump the entire stack trace and Microsoft does not provide the kernel symbolic map. The stack trace end kernel symbolic is very essential for dump reading. Change the dump option to full memory dump.

Procedure to change to dump option to full memoryl dump
1. Control Panel --> System -->Advance --> Startup and Recovery --> Write debugging information --> Change minidump to full dump
2. Reboot windows to activate the change.

When BSOD occurs, windows takes a kernel dump.

http://msdn.microsoft.com/msdnmag/i...5/07/Debugging/

Install Windows Debugging Tools
1) Create folder c:\symbols
2) Download and install the http://www.microsoft.com/whdc/devto...installx86.mspx
3) Locate your latest memory.dmp file- C:\WINNT\memory.dmp
4) open a CMD prompt and cd\program files\debugging tools for windows\
5) type the following stuff:

Code:
c:\program files\debugging tools>kd -z C:\WINNT\memory.dmp
kd> .logopen c:\debuglog.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;lmnt;.logclose;q

You now have a debuglog.txt in c:\, open it in notepad and post the content to this thread.

Regards Howard :wave: :wave:

 

[kms65]

Originally posted by cpc2004 and taken from this thread HERE.

Thanks, I will change the dump size and logging. (I have already installed windbg and use the symbol path specified.) I am not sure if the image path is correct, the only Windows image files I have are from an i386 folder on the backup partition.

 

[kms65]

Contents of debuglog:

Opened log file 'c:\debuglog.txt'
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;lmnt;.logclose;q
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................
Loading User Symbols
Loading unloaded module list
.........
No export analyze found
eax=ffdff13c ebx=0000000a ecx=00000000 edx=40000000 esi=7c5852f6 edi=7c5852f6
eip=80467df7 esp=bf007d50 ebp=bf007d64 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt+0x67df7:
80467df7 ?? ???
start end module name
80062000 80072520 hal hal.dll Thu Mar 20 19:04:40 2003 (3E7A7338)
80400000 8059cd80 nt ntoskrnl.exe Thu Oct 06 03:20:25 2005 (4344EC59)
a0000000 a0190000 win32k win32k.sys Thu Oct 06 03:33:42 2005 (4344EF76)
bed1e000 bed58440 srv srv.sys Tue May 03 02:10:42 2005 (42773202)
beda9000 bedb8a20 ipsec ipsec.sys Tue Apr 29 17:04:59 2003 (3EAF051B)
bee21000 bee32f80 wdmaud wdmaud.sys Tue Apr 15 22:23:02 2003 (3E9CDAA6)
bef73000 bef9d360 vsdatant vsdatant.sys Mon Jul 14 13:09:22 2003 (3F12FFE2)
bef9e000 befbb4a0 afd afd.sys Wed Apr 30 02:45:29 2003 (3EAF8D29)
befbc000 befd2400 nwlnkipx nwlnkipx.sys Wed Jan 15 12:56:26 2003 (3E25BCEA)
befd3000 befebe00 nbf nbf.sys Sat Sep 25 13:16:47 1999 (37ED1F9F)
bf92c000 bf92d000 atidrab atidrab.dll unavailable (00000000)
bf94d000 bf962180 dump_atapi dump_atapi.sys Tue Apr 01 11:08:25 2003 (3E89D599)
bf977000 bf97a760 mdc8021x mdc8021x.sys Fri Nov 21 08:54:18 2003 (3FBE352A)
bf98b000 bf9ad3c0 Fastfat Fastfat.SYS Wed Jan 15 12:48:39 2003 (3E25BB17)
bf9ae000 bfa686e0 avg7core avg7core.sys Wed Feb 22 17:40:43 2006 (43FD048B)
bfa69000 bfacdca0 mrxsmb mrxsmb.sys Thu Jan 20 00:25:21 2005 (41EF5CE1)
bfae0000 bfb09900 rdbss rdbss.sys Thu Dec 02 20:37:11 2004 (41AFDF67)
bfb5a000 bfb69ee0 nwlnknb nwlnknb.sys Wed Jan 15 12:56:27 2003 (3E25BCEB)
bfb6a000 bfb77ec0 irda irda.sys Wed Jan 15 12:56:53 2003 (3E25BD05)
bfb9a000 bfba58c0 sysaudio sysaudio.sys Tue Apr 15 22:21:44 2003 (3E9CDA58)
bfbaa000 bfbd1e00 netbt netbt.sys Wed Jul 16 13:44:26 2003 (3F15AB1A)
bfbd2000 bfc201a0 tcpip tcpip.sys Thu May 12 04:24:58 2005 (42832EFA)
bfc89000 bfc9c5e0 WscNetDr WscNetDr.sys Mon Sep 19 16:43:51 2005 (432F3F27)
bfc9d000 bfcc73a0 update update.sys Tue Apr 15 22:22:01 2003 (3E9CDA69)
bfcc8000 bfcdeba0 ndiswan ndiswan.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfcdf000 bfd43f00 ltmdmnt ltmdmnt.sys Wed Oct 20 16:38:32 1999 (380E4468)
bfd44000 bfd63d00 KS KS.SYS Wed Dec 04 10:09:38 2002 (3DEE36D2)
bfd64000 bfd881e0 portcls portcls.sys Tue Apr 15 22:11:22 2003 (3E9CD7EA)
bfd89000 bfdb0c40 maestro maestro.sys Thu Feb 07 15:27:14 2002 (3C62FF42)
bfdb1000 bfdf3020 SynTP SynTP.sys Fri May 02 17:45:39 2003 (3EB30323)
bfe1c000 bfe4f880 RT2500 RT2500.sys Thu Jul 29 02:29:57 2004 (4108B585)
bfe50000 bfe616c0 atimpab atimpab.sys Wed Nov 10 16:34:06 1999 (382A00EE)
bfe93000 bfea8be0 Mup Mup.sys Thu Dec 02 20:37:23 2004 (41AFDF73)
bfea9000 bfed2aa0 NDIS NDIS.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfed3000 bff555a0 Ntfs Ntfs.sys Fri May 09 13:46:45 2003 (3EBC05A5)
bff56000 bff677c0 KSecDD KSecDD.sys Sat Sep 20 18:32:19 2003 (3F6CF193)
bff68000 bff7d180 atapi atapi.sys Tue Apr 01 11:08:25 2003 (3E89D599)
bff7e000 bff9f9c0 dmio dmio.sys Wed Jan 15 12:47:04 2003 (3E25BAB8)
bffa0000 bffbc220 ftdisk ftdisk.sys Mon Mar 31 15:21:58 2003 (3E88BF86)
bffbd000 bffd7b00 pcmcia pcmcia.sys Wed Feb 12 09:09:23 2003 (3E4A71B3)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 12:44:22 2003 (3E25BA16)
f7000000 f700e6a0 pci pci.sys Wed Jan 15 12:44:07 2003 (3E25BA07)
f7010000 f701b680 isapnp isapnp.sys Wed Jan 15 12:43:47 2003 (3E25B9F3)
f7020000 f7028700 CLASSPNP CLASSPNP.SYS Wed Jan 15 12:42:51 2003 (3E25B9BB)
f7040000 f704c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 12:47:20 2003 (3E25BAC8)
f7050000 f705f400 serial serial.sys Tue Apr 15 22:19:39 2003 (3E9CD9DB)
f7060000 f7068c00 smcirda smcirda.sys Wed Jun 16 08:15:50 1999 (3767B196)
f7070000 f707b680 i8042prt i8042prt.sys Tue Apr 15 22:00:59 2003 (3E9CD57B)
f7080000 f708e180 Cdr4_2K Cdr4_2K.SYS Tue Sep 24 15:21:41 2002 (3D90D765)
f7090000 f709ca80 rasl2tp rasl2tp.sys Tue Apr 29 17:05:06 2003 (3EAF0522)
f70a0000 f70abc40 raspptp raspptp.sys Wed May 14 17:47:00 2003 (3EC2D574)
f70b0000 f70bea20 parallel parallel.sys Wed Jan 15 12:47:14 2003 (3E25BAC2)
f70f0000 f70f9be0 usbhub usbhub.sys Tue Mar 18 16:30:41 2003 (3E77AC21)
f7100000 f7109ce0 NDProxy NDProxy.SYS Thu Sep 30 17:25:35 1999 (37F3F16F)
f7110000 f7118fa0 Npfs Npfs.SYS Sat Oct 09 17:58:07 1999 (37FFD68F)
f7120000 f7128680 msgpc msgpc.sys Wed Jan 15 12:54:25 2003 (3E25BC71)
f7130000 f71381a0 netbios netbios.sys Tue Oct 12 13:34:19 1999 (38038D3B)
f7160000 f716efe0 Cdfs Cdfs.SYS Tue Apr 15 21:58:53 2003 (3E9CD4FD)
f7180000 f718e360 nwlnkspx nwlnkspx.sys Sat Sep 25 13:16:42 1999 (37ED1F9A)
f71f0000 f71f8240 Fips Fips.SYS Tue May 09 09:28:29 2000 (39182E9D)
f7280000 f7285520 PCIIDEX PCIIDEX.SYS Tue Feb 25 11:31:08 2003 (3E5BB66C)
f7288000 f728f4c0 MountMgr MountMgr.sys Tue Feb 10 12:47:53 2004 (40293569)
f7290000 f7297720 disk disk.sys Wed Jan 15 12:43:05 2003 (3E25B9C9)
f7298000 f729d100 agp440 agp440.sys Wed Jan 15 12:47:07 2003 (3E25BABB)
f72b8000 f72b9000 fdc fdc.sys unavailable (00000000)
f72c8000 f72ce100 parport parport.sys Wed Jan 15 12:47:13 2003 (3E25BAC1)
f72d0000 f72d7d00 wanarp wanarp.sys Fri Aug 16 06:25:01 2002 (3D5CEF1D)
f72e0000 f72e5ec0 kbdclass kbdclass.sys Thu Feb 20 09:37:30 2003 (3E55044A)
f72f0000 f72f4fc0 USBD USBD.SYS Wed Jan 22 10:05:33 2003 (3E2ECF5D)
f7300000 f7305400 mouclass mouclass.sys Thu Feb 20 09:37:45 2003 (3E550459)
f7310000 f73168e0 avg7rsnt avg7rsnt.sys Wed Feb 22 17:40:31 2006 (43FD047F)
f7318000 f731ec40 cdrom cdrom.sys Wed Jan 15 12:43:04 2003 (3E25B9C8)
f7328000 f732d560 Cdralw2k Cdralw2k.SYS Tue Sep 24 15:20:49 2002 (3D90D731)
f7330000 f7337f40 uhcd uhcd.sys Wed Jan 15 12:45:50 2003 (3E25BA6E)
f7338000 f733dfa0 HIDCLASS HIDCLASS.SYS Wed Jan 15 12:45:26 2003 (3E25BA56)
f7350000 f7355900 HIDPARSE HIDPARSE.SYS Tue Apr 08 11:34:46 2003 (3E930836)
f7368000 f736f0e0 Modem Modem.SYS Wed Jan 15 12:43:48 2003 (3E25B9F4)
f7378000 f737ccc0 rasirda rasirda.sys Wed Jan 15 12:56:54 2003 (3E25BD06)
f7398000 f739c400 ptilink ptilink.sys Wed Jan 15 12:47:15 2003 (3E25BAC3)
f73a8000 f73ac0e0 raspti raspti.sys Fri Oct 08 14:45:10 1999 (37FE57D6)
f73c0000 f73c4a60 flpydisk flpydisk.sys Wed Jan 15 12:42:52 2003 (3E25B9BC)
f73d8000 f73dea20 EFS EFS.SYS Wed Jan 15 12:46:55 2003 (3E25BAAF)
f73e8000 f73ed320 USBSTOR USBSTOR.SYS Wed Jan 15 12:45:52 2003 (3E25BA70)
f7408000 f740d240 Msfs Msfs.SYS Tue Oct 26 17:21:32 1999 (3816377C)
f7410000 f7412a20 BOOTVID BOOTVID.dll Wed Nov 03 18:24:33 1999 (3820E051)
f7414000 f7416320 compbatt compbatt.sys Wed Jan 15 12:44:30 2003 (3E25BA1E)
f7418000 f741ac00 ACPIEC ACPIEC.sys Wed Jan 15 12:44:28 2003 (3E25BA1C)
f741c000 f741ed00 PartMgr PartMgr.sys Wed Jan 15 12:43:07 2003 (3E25B9CB)
f747c000 f747e5a0 CmBatt CmBatt.sys Wed Jan 15 12:44:29 2003 (3E25BA1D)
f7488000 f748b640 serenum serenum.sys Wed Jan 15 12:47:01 2003 (3E25BAB5)
f7490000 f7492720 irenum irenum.sys Wed Jan 15 12:56:56 2003 (3E25BD08)
f74b0000 f74b3e60 TDI TDI.SYS Wed Jan 15 12:56:26 2003 (3E25BCEA)
f74b8000 f74ba2e0 ndistapi ndistapi.sys Wed Jan 15 12:54:15 2003 (3E25BC67)
f74e8000 f74eb020 usbscan usbscan.sys Wed Jan 15 12:45:45 2003 (3E25BA69)
f74f8000 f74fb580 vga vga.sys Sat Sep 25 12:37:40 1999 (37ED1674)
f7500000 f7501b00 BATTC BATTC.SYS Wed Jan 15 12:44:26 2003 (3E25BA1A)
f7502000 f7503100 intelide intelide.sys Wed Feb 19 10:19:09 2003 (3E53BC8D)
f7504000 f7505d20 Diskperf Diskperf.sys Wed Feb 12 14:34:38 2003 (3E4ABDEE)
f7512000 f7513000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
f751a000 f751be40 rasacd rasacd.sys Sat Sep 25 12:41:23 1999 (37ED1753)
f7522000 f75230c0 avg7rsw avg7rsw.sys Sun Sep 18 18:09:31 2005 (432E01BB)
f758c000 f758d000 ParVdm ParVdm.SYS unavailable (00000000)
f75a8000 f75a9380 avgtdi avgtdi.sys Sat Sep 03 18:38:58 2005 (431A4222)
f75c8000 f75c8f80 WMILIB WMILIB.SYS Sat Sep 25 12:36:47 1999 (37ED163F)
f75f1000 f75f1a40 audstub audstub.sys Sat Sep 25 12:35:33 1999 (37ED15F5)
f75fc000 f75fd000 swenum swenum.sys Wed Dec 04 10:10:07 2002 (3DEE36EF)
f760b000 f760c000 Null Null.SYS unavailable (00000000)
f760d000 f760dee0 Beep Beep.SYS Wed Oct 20 16:18:59 1999 (380E3FD3)
f7610000 f7610f80 mnmdd mnmdd.SYS Sat Sep 25 12:37:40 1999 (37ED1674)
f7641000 f7641f80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 12:36:47 1999 (37ED163F)
f7675000 f7675ba0 V7 V7.SYS Mon Mar 08 07:31:42 1999 (36E3DF4E)

Continued below....

 

[kms65]

Contents of debuglog continued:

Unloaded modules:
becf9000 bed1e000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bfb2a000 bfb37000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bfb3a000 bfb48000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bef6b000 bef6f000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bf938000 bf94d000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bf92c000 bf94d000 atidrab.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
f7140000 f7149000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f73f8000 f73fd000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f74f0000 f74f3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt


About the system in question:

This is a P-III, 650 Mhz, Quantex N30W (Compal), essentially a Dell Inspiron 5000, Windows 2000 SP4, running the original factory installed system, gently used, Motherboard is original (Compal 440Bx), memory is original, 128 mb installed, 5-8 mb free, pagefile is 400mb (fixed), 80 mb in use, video is ATI Rage Mobility 2x. Firewall is ZA 3.7 and AV is AVG free.

 

[Samstoned]

try disable ZA 3.7

 

[howard_hopkinso]

I have asked cpc2004 to take a look at your problem.

He`s the expert, when it comes to these kind of problems with Windows 2000.

Regards Howard

 

[cpc2004]

Full memory or kernel dump

Hi kms65,

The W2K SP4 minidump does not dump entire stack trace. Unless it is well known problem, it is very difficult to find out the culprit from the W2K minidump. You must change the dump option to full memory or kernel dump. Use windbg to format the full memory dump.

Probably the culprit may ZA or Norton AV. If you can provide the full memory dump, I can examine the stack trace and find out the culprit.

 

[kms65]

Hi kms65,

The W2K SP4 minidump does not dump entire stack trace. Unless it is well known problem, it is very difficult to find out the culprit from the W2K minidump. You must change the dump option to full memory or kernel dump. Use windbg to format the full memory dump.

Probably the culprit may ZA or Norton AV. If you can provide the full memory dump, I can examine the stack trace and find out the culprit.

(Clarification: No Norton AV, only AVG.)

After resetting the dump to full I finally had enough time to read the stop error on the screen when it crashes. "Driver_IRQL_not_less_or_equal." This leads me to believe the speculation about Zonealarm being the cause.

It is an intermittent problem, so I had to wait for it to crash again. (Most of the time I don't have to wait too long.) Usually, the crash happens after a re-start, when everything is loaded, explorer, drivers, and security apps such as AVG and ZoneAlarm. Everything loads, the Internet connection establishes -- and then it crashes. Sometimes, it crashes during use, but much less frequently. The most likely cause seems to be a windows update about two months ago. Very little changes on this computer in terms of software. Hardware, including RAM and hardrive, tested normally.

I have attached the latest memory dump, the computer said it was performing a full dump, but it appears identical to me? Also, KD doesn't seem to be able to process the entire dump. I will attach the debuglog below.

(Actually, the debuglog appears identical to one already attached, new date, same content.)

Thanks.

 

[kms65]

I found part of the problem, the computer was writing a minidump to the minidump directory, and the full memory dump to the system root. It writes both files even when full is specified. (I don't know how to post the full dump, it is 127 MB...) I am also specifying the system root as the image path, and getting better results.
=========

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Fri Mar 24 13:19:30.403 2006 (GMT-7)
System Uptime: 0 days 0:04:20.063
Loading Kernel Symbols
..............................................................................................................
Loading User Symbols
.............................................................
Loading unloaded module list
.........
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Bugcheck code 000000D1
Arguments 00236e60 00000002 00000000 77fcc35a

ChildEBP RetAddr Args to Child
becddd64 77fcc35a 00000000 00000000 00000000 nt!KiTrap0E+0x20b
00e3fcb4 780013a5 00230000 00000008 00000080 ntdll!RtlAllocateHeap+0x997
00e3fcfc 78008641 00000001 00000080 00095374 MSVCRT!calloc+0xf8
00e3fd10 78010588 00e3fe24 00e3fd4c 75190376 MSVCRT!_getptd+0x25
00e3fd1c 75190376 000a1e5a 000a4708 00095368 MSVCRT!_wcsicmp+0x9
00e3fd4c 751901da 00e3fd90 00000000 00000065 NETAPI32!EnumServersForTransport+0x92
00e3fe34 7518ffcc 00000000 00000065 00e3ffac NETAPI32!NetServerEnumEx+0x200
00e3fe60 7614807d 00000000 00000065 00e3ffac NETAPI32!NetServerEnum+0x22
00e3ffb4 7c57b388 00000000 00070000 00070748 localspl!ServerThread+0x68
00e3ffec 00000000 76148015 00000000 00000000 KERNEL32!BaseThreadStart+0x52

kd> .reload
Loading Kernel Symbols
..............................................................................................................
Loading User Symbols
.............................................................
Loading unloaded module list
.........
kd> !analyze
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
No export analyze found


=====
!Analyze still isn't working...

I have looked up code 0x000000D1 but I can't seem to get a definitive answer.

 

[cpc2004]

Hi,

From the stack trace, I find out the footprint of NET API call. Probably the problem is related ZoneAlarm and your version is 3 years behind. De-install or upgrade ZA.

ChildEBP RetAddr Args to Child
becddd64 77fcc35a 00000000 00000000 00000000 nt!KiTrap0E+0x20b
00e3fcb4 780013a5 00230000 00000008 00000080 ntdll!RtlAllocateHeap+0x997
00e3fcfc 78008641 00000001 00000080 00095374 MSVCRT!calloc+0xf8
00e3fd10 78010588 00e3fe24 00e3fd4c 75190376 MSVCRT!_getptd+0x25
00e3fd1c 75190376 000a1e5a 000a4708 00095368 MSVCRT!_wcsicmp+0x9
00e3fd4c 751901da 00e3fd90 00000000 00000065 NETAPI32! EnumServersForTransport+0x92 <-- Net Access API call
00e3fe34 7518ffcc 00000000 00000065 00e3ffac NETAPI32!NetServerEnumEx+0x200
00e3fe60 7614807d 00000000 00000065 00e3ffac NETAPI32!NetServerEnum+0x22
00e3ffb4 7c57b388 00000000 00070000 00070748 localspl!ServerThread+0x68
00e3ffec 00000000 76148015 00000000 00000000 KERNEL32!BaseThreadStart+0x52

Issue command !process to display running process.

 

[kms65]

Hi,

From the stack trace, I find out the footprint of NET API call. Probably the problem is related ZoneAlarm and your version is 3 years behind. De-install or upgrade ZA.

ChildEBP RetAddr Args to Child
becddd64 77fcc35a 00000000 00000000 00000000 nt!KiTrap0E+0x20b
00e3fcb4 780013a5 00230000 00000008 00000080 ntdll!RtlAllocateHeap+0x997
00e3fcfc 78008641 00000001 00000080 00095374 MSVCRT!calloc+0xf8
00e3fd10 78010588 00e3fe24 00e3fd4c 75190376 MSVCRT!_getptd+0x25
00e3fd1c 75190376 000a1e5a 000a4708 00095368 MSVCRT!_wcsicmp+0x9
00e3fd4c 751901da 00e3fd90 00000000 00000065 NETAPI32! EnumServersForTransport+0x92 <-- Net Access API call
00e3fe34 7518ffcc 00000000 00000065 00e3ffac NETAPI32!NetServerEnumEx+0x200
00e3fe60 7614807d 00000000 00000065 00e3ffac NETAPI32!NetServerEnum+0x22
00e3ffb4 7c57b388 00000000 00070000 00070748 localspl!ServerThread+0x68
00e3ffec 00000000 76148015 00000000 00000000 KERNEL32!BaseThreadStart+0x52

Issue command !process to display running process.

Thank you very much for the help. I am going to deinstall it and see what happens. I have stayed with an old version of ZA on this computer because the user's needs are simple in terms of security, and the system has limited resources. I might try simply reinstalling, it has worked well for a long time. I'll let you know how it goes.

Thanks again. :wave:

 

[kms65]

Okay, I think I can rule ZoneAlarm out as the problem. I uninstalled it completely, and then reinstalled a later version (4.5). It crashed about an hour later. Since ZA has been on this computer for around three years now, and the new install still crashes, it seems unlikely to be the source. I am going to try to uninstall the last Windows Update. Thanks for your help.

Here is the latest debug session (in the hope that someone spots something it that is meaningful.)


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT
Loading symbols for 80400000 ntoskrnl.exe -> ntoskrnl.exe
ModLoad: 80400000 8059cd80 ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Sat Mar 25 16:42:44.042 2006 (GMT-7)
System Uptime: 0 days 0:36:11.722
Loading symbols for 80400000 ntoskrnl.exe -> ntoskrnl.exe
ModLoad: 80400000 8059cd80 ntoskrnl.exe
Loading Kernel Symbols
.ModLoad: 80062000 80072520 halacpi.dll
.ModLoad: f7410000 f7412a20 \WINNT\System32\BOOTVID.dll
.ModLoad: bffd8000 bffffc20 ACPI.sys
.ModLoad: f75c8000 f75c8f80 \WINNT\System32\DRIVERS\WMILIB.SYS
.ModLoad: f7000000 f700e6a0 pci.sys
.ModLoad: f7010000 f701b680 isapnp.sys
.ModLoad: f7414000 f7416320 compbatt.sys
.ModLoad: f7500000 f7501b00 \WINNT\System32\DRIVERS\BATTC.SYS
.ModLoad: f7502000 f7503100 intelide.sys
.ModLoad: f7280000 f7285520 \WINNT\System32\DRIVERS\PCIIDEX.SYS
.ModLoad: bffbd000 bffd7b00 pcmcia.sys
.ModLoad: bffa0000 bffbc220 ftdisk.sys
.ModLoad: f7504000 f7505d20 Diskperf.sys
.ModLoad: bff7e000 bff9f9c0 dmio.sys
.ModLoad: f7418000 f741ac00 ACPIEC.sys
.ModLoad: f741c000 f741ed00 PartMgr.sys
.ModLoad: f7288000 f728f4c0 MountMgr.sys
.ModLoad: bff68000 bff7d180 atapi.sys
.ModLoad: f7290000 f7297720 disk.sys
.ModLoad: f7020000 f7028700 \WINNT\System32\DRIVERS\CLASSPNP.SYS
.ModLoad: bff56000 bff677c0 KSecDD.sys
.ModLoad: bfed3000 bff555a0 Ntfs.sys
.ModLoad: bfea9000 bfed2aa0 NDIS.sys
.ModLoad: bfe93000 bfea8be0 Mup.sys
.ModLoad: f7298000 f729d100 agp440.sys
.ModLoad: f747c000 f747e5a0 \SystemRoot\System32\DRIVERS\CmBatt.sys
.ModLoad: f7040000 f704c4c0 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
.ModLoad: bfe50000 bfe616c0 \SystemRoot\System32\DRIVERS\atimpab.sys
Unable to read image header at f72b8000
.ModLoad: f72b8000 f72bf000 \SystemRoot\System32\DRIVERS\fdc.sys
.ModLoad: f72c8000 f72ce100 \SystemRoot\System32\DRIVERS\parport.sys
.ModLoad: f7050000 f705f400 \SystemRoot\System32\DRIVERS\serial.sys
.ModLoad: f7484000 f7487640 \SystemRoot\System32\DRIVERS\serenum.sys
.ModLoad: f7060000 f7068c00 \SystemRoot\System32\DRIVERS\smcirda.sys
.ModLoad: f748c000 f748e720 \SystemRoot\System32\DRIVERS\irenum.sys
.ModLoad: f7070000 f707b680 \SystemRoot\System32\DRIVERS\i8042prt.sys
.ModLoad: f72e0000 f72e5ec0 \SystemRoot\System32\DRIVERS\kbdclass.sys
.ModLoad: f72f0000 f72f4fc0 \SystemRoot\system32\DRIVERS\USBD.SYS
.ModLoad: bfde5000 bfe27020 \SystemRoot\system32\DRIVERS\SynTP.sys
.ModLoad: f7300000 f7305400 \SystemRoot\System32\DRIVERS\mouclass.sys
.ModLoad: f7080000 f708e180 \SystemRoot\System32\Drivers\Cdr4_2K.SYS
.ModLoad: f7318000 f731ec40 \SystemRoot\System32\DRIVERS\cdrom.sys
.ModLoad: f7328000 f732d560 \SystemRoot\System32\Drivers\Cdralw2k.SYS
.ModLoad: f7330000 f7337f40 \SystemRoot\System32\DRIVERS\uhcd.sys
.ModLoad: bfd78000 bfd97d00 \SystemRoot\system32\drivers\KS.SYS
.ModLoad: bfd98000 bfdbc1e0 \SystemRoot\system32\drivers\portcls.sys
.ModLoad: bfdbd000 bfde4c40 \SystemRoot\system32\drivers\maestro.sys
.ModLoad: bfd13000 bfd77f00 \SystemRoot\System32\DRIVERS\ltmdmnt.sys
.ModLoad: f7368000 f736f0e0 \SystemRoot\System32\Drivers\Modem.SYS
.ModLoad: f75f0000 f75f0a40 \SystemRoot\System32\DRIVERS\audstub.sys
.ModLoad: f74ac000 f74afe60 \SystemRoot\System32\DRIVERS\TDI.SYS
.ModLoad: f7378000 f737ccc0 \SystemRoot\System32\DRIVERS\rasirda.sys
.ModLoad: f7090000 f709ca80 \SystemRoot\System32\DRIVERS\rasl2tp.sys
.ModLoad: f74b4000 f74b62e0 \SystemRoot\System32\DRIVERS\ndistapi.sys
.ModLoad: bfcfc000 bfd12ba0 \SystemRoot\System32\DRIVERS\ndiswan.sys
.ModLoad: f70a0000 f70abc40 \SystemRoot\System32\DRIVERS\raspptp.sys
.ModLoad: f7398000 f739c400 \SystemRoot\System32\DRIVERS\ptilink.sys
.ModLoad: f73a8000 f73ac0e0 \SystemRoot\System32\DRIVERS\raspti.sys
.ModLoad: f70b0000 f70bea20 \SystemRoot\System32\DRIVERS\parallel.sys
.ModLoad: f75fb000 f75fc000 \SystemRoot\System32\DRIVERS\swenum.sys
.ModLoad: bfcd1000 bfcfb3a0 \SystemRoot\System32\DRIVERS\update.sys
.ModLoad: bfcbd000 bfcd05e0 \SystemRoot\system32\DRIVERS\WscNetDr.sys
Unable to read image header at f73c0000
.ModLoad: f73c0000 f73c5000 \SystemRoot\System32\DRIVERS\flpydisk.sys
.ModLoad: f70f0000 f70f9be0 \SystemRoot\System32\DRIVERS\usbhub.sys
.ModLoad: f7100000 f7109ce0 \SystemRoot\System32\Drivers\NDProxy.SYS
.ModLoad: f73d0000 f73d6a20 \SystemRoot\System32\Drivers\EFS.SYS
.ModLoad: f73e8000 f73ed320 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
.ModLoad: f74e4000 f74e7020 \SystemRoot\System32\DRIVERS\usbscan.sys
Unable to read image header at f7510000
.ModLoad: f7510000 f7512000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
Unable to read image header at f760a000
.ModLoad: f760a000 f760b000 \SystemRoot\System32\Drivers\Null.SYS
.ModLoad: f760c000 f760cee0 \SystemRoot\System32\Drivers\Beep.SYS
.ModLoad: f74f4000 f74f7580 \SystemRoot\System32\drivers\vga.sys
.ModLoad: f760f000 f760ff80 \SystemRoot\System32\Drivers\mnmdd.SYS
.ModLoad: f7408000 f740d240 \SystemRoot\System32\Drivers\Msfs.SYS
.ModLoad: f7110000 f7118fa0 \SystemRoot\System32\Drivers\Npfs.SYS
.ModLoad: f7518000 f7519e40 \SystemRoot\System32\DRIVERS\rasacd.sys
.ModLoad: bfc06000 bfc541a0 \SystemRoot\System32\DRIVERS\tcpip.sys
.ModLoad: f7120000 f7128680 \SystemRoot\System32\DRIVERS\msgpc.sys
.ModLoad: f72d0000 f72d7d00 \SystemRoot\System32\DRIVERS\wanarp.sys
.ModLoad: bfbde000 bfc05e00 \SystemRoot\System32\DRIVERS\netbt.sys
.ModLoad: f7130000 f71381a0 \SystemRoot\System32\DRIVERS\netbios.sys
.ModLoad: bfb14000 bfb3d900 \SystemRoot\System32\DRIVERS\rdbss.sys
.ModLoad: bfa9d000 bfb01ca0 \SystemRoot\System32\DRIVERS\mrxsmb.sys
.ModLoad: bf9e2000 bfa9c6e0 \SystemRoot\System32\Drivers\avg7core.sys
.ModLoad: f751e000 f751f0c0 \SystemRoot\System32\Drivers\avg7rsw.sys
.ModLoad: f7308000 f730e8e0 \SystemRoot\System32\Drivers\avg7rsnt.sys
.ModLoad: bf9bf000 bf9e13c0 \SystemRoot\System32\Drivers\Fastfat.SYS
.ModLoad: f7160000 f716efe0 \SystemRoot\System32\Drivers\Cdfs.SYS
.ModLoad: f7640000 f7640f80 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
.ModLoad: bf981000 bf996180 \SystemRoot\System32\Drivers\dump_atapi.sys
.ModLoad: a0000000 a0190000 \??\C:\WINNT\system32\win32k.sys
Unable to read image header at bf960000
.ModLoad: bf960000 bf981000 \SystemRoot\System32\atidrab.dll
.ModLoad: f7674000 f7674ba0 \SystemRoot\System32\Drivers\V7.SYS
.ModLoad: bfb9e000 bfbabec0 \SystemRoot\System32\DRIVERS\irda.sys
.ModLoad: bf144000 bf147760 \SystemRoot\system32\DRIVERS\mdc8021x.sys
.ModLoad: bf007000 bf01fe00 \SystemRoot\System32\DRIVERS\nbf.sys
.ModLoad: beff0000 bf006400 \SystemRoot\System32\DRIVERS\nwlnkipx.sys
.ModLoad: bfb8e000 bfb9dee0 \SystemRoot\System32\DRIVERS\nwlnknb.sys
.ModLoad: befd2000 befef4a0 \SystemRoot\System32\drivers\afd.sys
Unable to read NT module Full Name string at e31f8fa8 - NTSTATUS 0xC0000147
.ModLoad: f7170000 f717e360 nwlnkspx.sys
.ModLoad: f7360000 f7365900 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
.ModLoad: f7348000 f734dfa0 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
Unable to read image header at f757a000
.ModLoad: f757a000 f757c000 \SystemRoot\System32\Drivers\ParVdm.SYS
.ModLoad: beed0000 beee1f80 \SystemRoot\system32\drivers\wdmaud.sys
.ModLoad: bf070000 bf07b8c0 \SystemRoot\system32\drivers\sysaudio.sys
.ModLoad: f7586000 f7587380 \??\C:\WINNT\System32\Drivers\avgtdi.sys
.ModLoad: f71d0000 f71d8240 \SystemRoot\System32\Drivers\Fips.SYS
.ModLoad: bed58000 bed92440 \SystemRoot\System32\DRIVERS\srv.sys
.ModLoad: beca8000 becb7a20 \SystemRoot\System32\DRIVERS\ipsec.sys
.ModLoad: f74a4000 f74a7d80 \??\C:\PROGRA~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS
.ModLoad: be89e000 be8a0dc0 \SystemRoot\System32\DRIVERS\ndisuio.sys
.ModLoad: be61e000 be654720 \??\C:\WINNT\System32\vsdatant.sys
.ModLoad: be522000 be555880 \SystemRoot\system32\DRIVERS\RT2500.sys

 

[kms65]

debuglog continued:


Loading User Symbols
.ModLoad: 01000000 0100e000 C:\WINNT\system32\spoolsv.exe
.ModLoad: 77f80000 77ffd000 C:\WINNT\system32\ntdll.dll
.ModLoad: 78000000 78045000 C:\WINNT\system32\MSVCRT.dll
.ModLoad: 7c570000 7c623000 C:\WINNT\system32\KERNEL32.dll
.ModLoad: 7c2d0000 7c332000 C:\WINNT\system32\ADVAPI32.dll
.ModLoad: 77d30000 77da1000 C:\WINNT\system32\RPCRT4.DLL
.ModLoad: 77f40000 77f7c000 C:\WINNT\system32\GDI32.dll
.ModLoad: 77e10000 77e6f000 C:\WINNT\system32\USER32.dll
.ModLoad: 76a90000 76aa6000 C:\WINNT\system32\SPOOLSS.DLL
.ModLoad: 75030000 75044000 C:\WINNT\system32\WS2_32.dll
.ModLoad: 75020000 75028000 C:\WINNT\system32\WS2HELP.DLL
.ModLoad: 75170000 751bf000 C:\WINNT\system32\NETAPI32.dll
.ModLoad: 7c340000 7c34f000 C:\WINNT\system32\Secur32.dll
.ModLoad: 77bf0000 77c01000 C:\WINNT\system32\NTDSAPI.dll
.ModLoad: 77980000 779a4000 C:\WINNT\system32\DNSAPI.DLL
.ModLoad: 75050000 75058000 C:\WINNT\system32\WSOCK32.DLL
.ModLoad: 77950000 7797a000 C:\WINNT\system32\WLDAP32.DLL
.ModLoad: 751c0000 751c6000 C:\WINNT\system32\NETRAP.dll
.ModLoad: 75150000 7515f000 C:\WINNT\system32\SAMLIB.dll
.ModLoad: 77340000 77353000 C:\WINNT\system32\iphlpapi.dll
.ModLoad: 77520000 77525000 C:\WINNT\system32\ICMP.DLL
.ModLoad: 77320000 77337000 C:\WINNT\system32\MPRAPI.DLL
.ModLoad: 7ce20000 7cf0f000 C:\WINNT\system32\OLE32.DLL
.ModLoad: 779b0000 77a4b000 C:\WINNT\system32\OLEAUT32.DLL
.ModLoad: 773b0000 773df000 C:\WINNT\system32\ACTIVEDS.DLL
.ModLoad: 77380000 773a3000 C:\WINNT\system32\ADSLDPC.DLL
.ModLoad: 77830000 7783e000 C:\WINNT\system32\RTUTILS.DLL
.ModLoad: 77880000 7790e000 C:\WINNT\system32\SETUPAPI.DLL
.ModLoad: 7c0f0000 7c151000 C:\WINNT\system32\USERENV.DLL
.ModLoad: 774e0000 77513000 C:\WINNT\system32\RASAPI32.DLL
.ModLoad: 774c0000 774d1000 C:\WINNT\system32\RASMAN.DLL
.ModLoad: 77530000 77552000 C:\WINNT\system32\TAPI32.DLL
.ModLoad: 71710000 71794000 C:\WINNT\system32\COMCTL32.DLL
.ModLoad: 70a70000 70ad6000 C:\WINNT\system32\SHLWAPI.DLL
.ModLoad: 77360000 77379000 C:\WINNT\system32\DHCPCSVC.DLL
.ModLoad: 777f0000 777f5000 C:\WINNT\system32\rasadhlp.dll
.ModLoad: 76120000 76162000 C:\WINNT\system32\localspl.dll
.ModLoad: 77820000 77827000 C:\WINNT\system32\VERSION.DLL
.ModLoad: 759b0000 759b6000 C:\WINNT\system32\LZ32.DLL
.ModLoad: 76980000 7699b000 C:\WINNT\system32\SFC.DLL
.ModLoad: 68010000 68100000 C:\WINNT\system32\sfcfiles.dll
.ModLoad: 77800000 7781e000 C:\WINNT\system32\winspool.drv
.ModLoad: 76620000 76630000 C:\WINNT\system32\MPR.DLL
.ModLoad: 733e0000 733ee000 C:\WINNT\system32\cnbjmon.dll
.ModLoad: 66d00000 66d10000 C:\WINNT\system32\CNMLMON.DLL
.ModLoad: 00d60000 00d7a000 C:\WINNT\system32\CNMLM27.DLL
.ModLoad: 10000000 10013000 C:\WINNT\system32\MPASSMON.DLL
.ModLoad: 00d90000 00d96000 C:\WINNT\system32\mpupmon.dll
.ModLoad: 74fd0000 74fee000 C:\WINNT\system32\msafd.dll
.ModLoad: 76ab0000 76ab7000 C:\WINNT\system32\pjlmon.dll
.ModLoad: 76a80000 76a8d000 C:\WINNT\system32\tcpmon.dll
.ModLoad: 76a70000 76a76000 C:\WINNT\system32\usbmon.dll
.ModLoad: 6b460000 6b467000 C:\WINNT\system32\msfaxmon.dll
.ModLoad: 00de0000 00de6000 C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD27.DLL
.ModLoad: 00df0000 00df7000 C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPDy7.DLL
.ModLoad: 782c0000 782cc000 C:\WINNT\System32\rnr20.dll
.ModLoad: 777e0000 777e8000 C:\WINNT\System32\winrnr.dll
.ModLoad: 75010000 75017000 C:\WINNT\System32\wshtcpip.dll
.ModLoad: 76a50000 76a70000 C:\WINNT\system32\win32spl.dll
.ModLoad: 7c950000 7c9df000 C:\WINNT\system32\CLBCATQ.DLL
.ModLoad: 76b00000 76b13000 C:\WINNT\system32\inetpp.dll
.ModLoad: 66900000 66a54000 C:\WINNT\system32\spool\DRIVERS\W32X86\3\CNMUIy7.DLL
.ModLoad: 76b30000 76b6e000 C:\WINNT\system32\comdlg32.dll
.ModLoad: 7cf30000 7d175000 C:\WINNT\system32\SHELL32.DLL
.ModLoad: 6b2c0000 6b2c5000 C:\WINNT\system32\MSIMG32.dll
.ModLoad: 66400000 6642c000 C:\WINNT\system32\spool\DRIVERS\W32X86\3\CNMDRy7.DLL
.ModLoad: 6b770000 6b783000 C:\WINNT\system32\mscms.dll

Loading unloaded module list
...........Loading symbols for 77f80000 ntdll.dll -> ntdll.dll

Loaded kext extension DLL
Loaded kdextx86 extension DLL
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 127
"The specified procedure could not be found."
Please check your debugger configuration and/or network access.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Bugcheck code 000000D1
Arguments 751add64 00000002 00000000 751add64

ChildEBP RetAddr Args to Child
be9b9d64 751add64 00480014 00080008 000c0048 nt!KiTrap0E+0x20b
Loading symbols for 75170000 NETAPI32.dll -> NETAPI32.dll
00e3fcf8 7519039f 00000000 000a38c8 0009d808 NETAPI32!NdrClientCall2
00e3fd4c 751901da 00e3fd90 00000000 00000065 NETAPI32!EnumServersForTransport+0xbb
00e3fe34 7518ffcc 00000000 00000065 00e3ffac NETAPI32!NetServerEnumEx+0x200
Loading symbols for 76120000 localspl.dll -> localspl.dll
00e3fe60 7614807d 00000000 00000065 00e3ffac NETAPI32!NetServerEnum+0x22
Loading symbols for 7c570000 KERNEL32.dll -> KERNEL32.dll
00e3ffb4 7c57b388 00000000 00070000 00070748 localspl!ServerThread+0x68
00e3ffec 00000000 76148015 00000000 00000000 KERNEL32!BaseThreadStart+0x52

kd> !process
PROCESS 8112bd60 SessionId: 0 Cid: 01ec Peb: 7ffdf000 ParentCid: 00e8
DirBase: 00112000 ObjectTable: 8112cf88 TableSize: 159.
Image: spoolsv.exe
VadRoot 844269a8 Clone 0 Private 578. Modified 69. Locked 0.
DeviceMap 814ab088
Token e32493b0
ElapsedTime 0:35:15.0992
UserTime 0:00:07.0861
KernelTime 0:00:02.0703
QuotaPoolUsage[PagedPool] 29140
QuotaPoolUsage[NonPagedPool] 15228
Working Set Sizes (now,min,max) (906, 50, 345) (3624KB, 200KB, 1380KB)
PeakWorkingSetSize 2349
VirtualSize 32 Mb
PeakVirtualSize 45 Mb
PageFaultCount 12472
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 919

THREAD 8112bae0 Cid 1ec.1e0 Teb: 7ffde000 Win32Thread: 00000000 WAIT: (Executive) UserMode Non-Alertable
8112b9e4 NotificationEvent

THREAD 8112a9e0 Cid 1ec.1f0 Teb: 7ffdd000 Win32Thread: e324c008 WAIT: (UserRequest) UserMode Non-Alertable
8112a9a0 NotificationEvent

THREAD 81129020 Cid 1ec.1f4 Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (WrEventPairLow) UserMode Non-Alertable
8112af00 Unknown
81129108 NotificationTimer

THREAD 81129980 Cid 1ec.1f8 Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
810b0368 Semaphore Limit 0x7fffffff

THREAD 81129560 Cid 1ec.200 Teb: 7ffd9000 Win32Thread: e324c4e8 WAIT: (WrExecutive) UserMode Non-Alertable
81129948 SynchronizationEvent
81129648 NotificationTimer

THREAD 83ccdbe0 Cid 1ec.444 Teb: 7ffd7000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
811d0480 SynchronizationEvent
811d0560 SynchronizationEvent
811b75c0 SynchronizationEvent
8781a560 SynchronizationEvent

THREAD 855e3020 Cid 1ec.454 Teb: 7ffd5000 Win32Thread: e326a5c8 WAIT: (UserRequest) UserMode Non-Alertable
811c7640 SynchronizationEvent
8778f3a0 SynchronizationEvent

THREAD 855e3da0 Cid 1ec.1fc Teb: 7ffda000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
810cd3a0 SynchronizationEvent

THREAD 83031840 Cid 1ec.490 Teb: 7ffaf000 Win32Thread: 00000000 RUNNING

THREAD 830315c0 Cid 1ec.494 Teb: 7ffae000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
87833a20 SynchronizationEvent

THREAD 83d62660 Cid 1ec.564 Teb: 7ffa9000 Win32Thread: e365b2a8 WAIT: (WrUserRequest) UserMode Non-Alertable
83a54e60 SynchronizationEvent

THREAD 823e3aa0 Cid 1ec.270 Teb: 7ffd8000 Win32Thread: e376aea8 WAIT: (WrLpcReceive) UserMode Non-Alertable
8112a348 Semaphore Limit 0x7fffffff
823e3b88 NotificationTimer

THREAD 846aab60 Cid 1ec.5d0 Teb: 7ffd4000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
8112a348 Semaphore Limit 0x7fffffff
846aac48 NotificationTimer

THREAD 80fa49a0 Cid 1ec.378 Teb: 7ffa8000 Win32Thread: e310eea8 WAIT: (WrUserRequest) UserMode Non-Alertable
823d90e0 SynchronizationEvent

 

[cpc2004]

Hi,

ZA maybe incompatible with some of your device driver. De-install ZA and install other firewall.