Dr Watson (drwtsn.exe) keeps crashing my computer

Archived from groups: microsoft.public.windowsxp.general (More info?)

Hello to all.
First let me just say that I am not very computer literate when it comes to
checking coding and event logs etc so I apologise in advance if I don't get
your suggestions right the first time.

OK here it is, as easily explained as I can make it: recently when having
Internet Explorer open in the background, clicking on the desktop forces my
cursor to change to that horrible hour glass for about 20-30 seconds, then I
get an error message saying "DrWatson postmortem debugger has encountered a
problem and must close". I then proceed to click send error report. It sends
then my computer freezes up and thats that. I have to manually restart it.
This has only happened recently and is becoming quite tedious. And also it
does the same thing if I click dont send...
I know that DrWatson has something to do with saving files or recording the
script errors before the computer crashes (i think :s ) but thats where it
gets too complicated for me.
It crashed on me only a few hours ago and I was vigalent enough to get as
much information as I can, here it is, hope it helps...

OK first things first...
As soon as that error report popped up I had a look and copied down the
information(if it'll help)

Error Signature
EventType:BEX P1rwtsn32.exe P2:5.1.2600.0 P3:3b7d84a2
P4bghelp.dll P5:5.1.2600.2180 P6:4110969a P7:0001295d
p8:c0000409 P9:00000000

I also had a look in the event viewer and found the entry to do with this
latest crash:

Discription of fault
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d

This is the bit at the bottom in bytes...

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 32 31 38 2600.218
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d

....and words...

0000: 6c707041 74616369 206e6f69 6c696146
0010: 20657275 77726420 336e7374 78652e32
0020: 2e352065 36322e31 302e3030 206e6920
0030: 68676264 2e706c65 206c6c64 2e312e35
0040: 30303632 3831322e 74612030 66666f20
0050: 20746573 31303030 6435393


The following information is from the DrWatson log file...

Application exception occurred:
App: C:\WINDOWS\Explorer.EXE (pid=1572)
When: 7/18/2005 @ 20:03:03.890
Exception number: 80000007
()

*----> System Information <----*
Computer Name: SN032162420571
User Name: Anthony Cook
Terminal Session Id: 0
Number of Processors: 1
Processor Type: x86 Family 15 Model 2 Stepping 9
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Anthony Cook

*----> Task List <----*
0 System Process
4 System
480 smss.exe
552 csrss.exe
576 winlogon.exe
624 services.exe
636 lsass.exe
780 svchost.exe
828 svchost.exe
868 svchost.exe
944 svchost.exe
1108 spoolsv.exe
1180 isafe.exe
1212 MPFSERVICE.exe
1248 svchost.exe
1264 wdfmgr.exe
1572 Explorer.EXE
1632 ABoard.exe
1644 hpztsb08.exe
1652 MpfTray.exe
1660 Dragdiag.exe
1676 VetTray.exe
1692 sistray.EXE
1732 jusched.exe
1752 realsched.exe
1760 ybrwicon.exe
1776 BTHelpNotifier.exe
1796 AOSD.exe
1820 MpfAgent.exe
1912 ycommon.exe
384 LVComS.exe
1016 iexplore.exe
812 msnmsgr.exe
1416 VetMsg.exe
540 LimeWire.exe
3952 drwtsn32.exe

*----> Module List <----*
(0000000001000000 - 00000000010ff000: C:\WINDOWS\Explorer.EXE
(00000000016a0000 - 00000000016b2000: C:\WINDOWS\system32\browselc.dll
(00000000016c0000 - 00000000016cc000: C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll
(0000000001d90000 - 0000000001e18000: C:\WINDOWS\system32\shdoclc.dll
(0000000002330000 - 0000000002452000: C:\PROGRA~1\quickbar\quickbar.dll
(0000000002560000 - 0000000002635000: C:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
(00000000034f0000 - 000000000365d000: C:\WINDOWS\System32\quartz.dll
(000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll
(0000000010000000 - 0000000010020000: C:\PROGRA~1\BTYAHO~1\SMARTB~1\SBHook.dll
(0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll
(000000004ec50000 - 000000004edf3000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxTheme.dll
(000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI32.dll
(000000005ba60000 - 000000005bad1000: C:\WINDOWS\System32\themeui.dll
(000000005cad0000 - 000000005caf7000: C:\WINDOWS\System32\shmedia.dll
(000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEng.dll
(000000005d090000 - 000000005d127000: C:\WINDOWS\system32\comctl32.dll
(000000005edd0000 - 000000005ede7000: C:\WINDOWS\system32\olepro32.dll
(0000000060ca0000 - 0000000060d2c000: C:\WINDOWS\System32\qedit.dll
(00000000629c0000 - 00000000629c9000: C:\WINDOWS\system32\LPK.DLL
(000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.dll
(000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenral.DLL
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\System32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\System32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\System32\WSOCK32.dll
(0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dll
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\System32\SAMLIB.dll
(0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanman.dll
(0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP.dll
(0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1.dll
(0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0.dll
(0000000071d40000 - 0000000071d5c000: C:\WINDOWS\System32\actxprxy.dll
(0000000072410000 - 000000007242a000: C:\WINDOWS\System32\mydocs.dll
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\system32\msacm32.drv
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\system32\wdmaud.drv
(0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPOOL.DRV
(00000000736b0000 - 00000000736b7000: C:\WINDOWS\system32\msdmo.dll
(0000000073b30000 - 0000000073b45000: C:\WINDOWS\system32\mscms.dll
(0000000073b50000 - 0000000073b67000: C:\WINDOWS\System32\AVIFIL32.dll
(0000000073ba0000 - 0000000073bb3000: C:\WINDOWS\System32\sti.dll
(0000000073bc0000 - 0000000073bc6000: C:\WINDOWS\system32\DCIMAN32.DLL
(00000000745e0000 - 00000000748a6000: C:\WINDOWS\system32\msi.dll
(0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\System32\POWRPROF.dll
(0000000074ae0000 - 0000000074ae7000: C:\WINDOWS\System32\CFGMGR32.dll
(0000000074af0000 - 0000000074afa000: C:\WINDOWS\System32\BatMeter.dll
(0000000074b30000 - 0000000074b76000: C:\WINDOWS\System32\webcheck.dll
(0000000074d90000 - 0000000074dfb000: C:\WINDOWS\system32\USP10.dll
(00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTUI.dll
(0000000075a70000 - 0000000075a91000: C:\WINDOWS\System32\MSVFW32.dll
(0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL
(0000000075f40000 - 0000000075f51000: C:\WINDOWS\System32\devenum.dll
(0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov.dll
(0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davclnt.dll
(0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSEUI.dll
(0000000076280000 - 00000000762a1000: C:\WINDOWS\System32\stobject.dll
(0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA.dll
(0000000076380000 - 0000000076385000: C:\WINDOWS\System32\MSIMG32.dll
(00000000763b0000 - 00000000763f9000: C:\WINDOWS\system32\comdlg32.dll
(0000000076400000 - 00000000765a6000: C:\WINDOWS\system32\NETSHELL.dll
(0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL.dll
(0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKINFO.dll
(0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshrui.dll
(00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USERENV.dll
(0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DLL
(0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.dll
(0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui.dll
(0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRUST.dll
(0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll
(0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpapi.dll
(0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutils.dll
(0000000076e90000 - 0000000076ea2000: C:\WINDOWS\system32\rasman.dll
(0000000076eb0000 - 0000000076edf000: C:\WINDOWS\system32\TAPI32.dll
(0000000076ee0000 - 0000000076f1c000: C:\WINDOWS\system32\RASAPI32.DLL
(0000000076f50000 - 0000000076f58000: C:\WINDOWS\System32\WTSAPI32.dll
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
(0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL
(0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll
(0000000077120000 - 00000000771ac000: C:\WINDOWS\system32\OLEAUT32.dll
(00000000771b0000 - 0000000077256000: C:\WINDOWS\system32\WININET.dll
(0000000077260000 - 00000000772fe000: C:\WINDOWS\system32\urlmon.dll
(00000000773d0000 - 00000000774d2000:
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
(00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMARTA.DLL
(0000000077760000 - 00000000778cc000: C:\WINDOWS\system32\SHDOCVW.dll
(0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll
(0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.dll
(0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll
(0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHelp.dll
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\system32\midimap.dll
(0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM32.dll
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
(0000000077c70000 - 0000000077c93000: C:\WINDOWS\system32\msv1_0.dll
(0000000077d40000 - 0000000077dd0000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077f10000 - 0000000077f56000: C:\WINDOWS\system32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\System32\Secur32.dll
(000000007c800000 - 000000007c8f4000: C:\WINDOWS\system32\kernel32.dll
(000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll
(000000007c9c0000 - 000000007d1d4000: C:\WINDOWS\system32\SHELL32.dll

*----> State Dump for Thread Id 0x628 <----*

eax=0007f1a0 ebx=00000000 ecx=7c810198 edx=02205868 esi=7c97c0d8 edi=00000000
eip=7c90eb94 esp=0007ed10 ebp=0007ed98 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
function: ntdll!KiFastSystemCallRet
7c90eb89 90 nop
7c90eb8a 90 nop
ntdll!KiFastSystemCall:
7c90eb8b 8bd4 mov edx,esp
7c90eb8d 0f34 sysenter
7c90eb8f 90 nop
7c90eb90 90 nop
7c90eb91 90 nop
7c90eb92 90 nop
7c90eb93 90 nop
FAULT ->ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
7c90eb95 8da42400000000 lea esp,[esp]
7c90eb9c 8d642400 lea esp,[esp]
7c90eba0 90 nop
7c90eba1 90 nop
7c90eba2 90 nop
7c90eba3 90 nop
7c90eba4 90 nop
ntdll!KiIntSystemCall:
7c90eba5 8d542408 lea edx,[esp+0x8]
7c90eba9 cd2e int 2e

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be
wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\SHLWAPI.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\SHDOCVW.dll -


I hope you can understand all this because its jibberish to me :-)
Thanks for your patience with me...
Anthony


--
Thank you

Archived from groups: microsoft.public.windowsxp.general (More info?)

anthony_cook wrote:

> Hello to all.
> First let me just say that I am not very computer literate when it comes to
> checking coding and event logs etc so I apologise in advance if I don't get
> your suggestions right the first time.
>
> OK here it is, as easily explained as I can make it: recently when having
> Internet Explorer open in the background, clicking on the desktop forces my
> cursor to change to that horrible hour glass for about 20-30 seconds, then I
> get an error message saying "DrWatson postmortem debugger has encountered a
> problem and must close". I then proceed to click send error report. It sends
> then my computer freezes up and thats that. I have to manually restart it.
> This has only happened recently and is becoming quite tedious. And also it
> does the same thing if I click dont send...
> I know that DrWatson has something to do with saving files or recording the
> script errors before the computer crashes (i think :s ) but thats where it
> gets too complicated for me.
> It crashed on me only a few hours ago and I was vigalent enough to get as
> much information as I can, here it is, hope it helps...

<snip>

Start with a thorough check for malware:

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm


--
Rock
MS MVP Windows - Shell/User

Archived from groups: microsoft.public.windowsxp.general (More info?)

Yes, follow that will take you a big step on your way. :-))

Gunilla.

"anthony_cook" <ant81(remove this)@hotmail.com> skrev i meddelandet
news:6C96DCCC-BECE-435F-92B1-0D8108EA444E@microsoft.com...
> Wow! i did not know this piece of junk (i.e. my computer) was that badly
> infected with stuff. I thought I had enough anti-virus software and a
> pretty
> good firewall not to worry about stuff like that! if I follow these
> instructions would I be able to remove these nasty piece's of work?
> Thanks again for helping me out
> Anthony
>

Archived from groups: microsoft.public.windowsxp.general (More info?)

That's good...I shall await the results with eager! :-))

Gunilla

"anthony_cook" <ant81(remove this)@hotmail.com> skrev i meddelandet
news:1EE0B10E-862E-424E-9262-551D52DF7B27@microsoft.com...
> Thanks again...
> I shall follow your instructions to the letter and will let you know how I
> get on.
> Anthony