none
System using high CPU

    Question

  •  I know this has been explored in a few other areas but I don't know if my issue is the same as the others I've read about. This has occured after 3 instals of windows xp service pack 3. So what currently is happening is my USB plugs do not detect a device once it has been unplugged and plugged back in. At the same time my system process shoots through the roof and will use between 29 and 100 percent of my CPU. I am using process explorer and have hopefully setup my symbols correctly.
     
    Stack 1:
    ntkrnlpa.exe+0x6e9ab
    ntkrnlpa.exe+0x2bf82
    ntkrnlpa.exe+0x2c864
    ntkrnlpa.exe+0x6175a
    ntkrnlpa.exe+0xf8f70
    ntkrnlpa.exe+0x6f0ee
     
    Stack 2:
    ntkrnlpa.exe+0x6e946
    usbhub.sys!USBH_ChangeIndicationWorker+0x182
    ntkrnlpa.exe+0x6177d
    ntkrnlpa.exe+0xf8f70
    ntkrnlpa.exe+0x6f0ee

    Tuesday, September 1, 2009 8:08 PM

All replies

  • note: moved topic to Troubleshooting forum
    Tuesday, September 1, 2009 8:11 PM
  • Hi bigesta,

    Unfortunately, symbols are not completely resolving.  Please verify that the configuration matches that described here, and recapture the stack...


    Tuesday, September 1, 2009 8:12 PM
  • Stack for thread 60
    ntkrnlpa.exe!KiUnexpectedInterrupt+0x121
    ntkrnlpa.exe!ZwYieldExecution+0x1c8e
    hal.dll+0x2ef2
    hal.dll!KfLowerIrql+0x17
    ntkrnlpa.exe!IoAllocateErrorLogEntry+0x230
    ntkrnlpa.exe!KeSetTimer+0x18
    usbhub.sys+0x8dd5
    usbhub.sys!USBH_FdoSyncSubmitUrb+0x16
    usbhub.sys!USBH_Transact+0xdb
    usbhub.sys!USBH_SyncGetPortStatus+0x23
    usbhub.sys!USBH_ChangeIndicationWorker+0x121
    ntkrnlpa.exe!ExQueueWorkItem+0x1a3
    ntkrnlpa.exe!PsRemoveCreateThreadNotifyRoutine+0x214
    ntkrnlpa.exe!KiDispatchInterrupt+0x72e
     
    Stack for thread 52
    ntkrnlpa.exe!KiUnexpectedInterrupt+0x121
    ntkrnlpa.exe!ZwYieldExecution+0x1c8e
    hal.dll!HalpApcInterrupt+0xc6
    hal.dll!KfLowerIrql+0x17
    USBPORT.SYS!USBPORT_FlushPendingList+0x2e7
    ntkrnlpa.exe!InterlockedDecrement
    Let me know if these are any better if not i will have to wait tell tomorrow to try again.
    Tuesday, September 1, 2009 8:39 PM
  • It doesn't look like all symbols are resolving.  The offsets in some cases are too large to trust.

    Consider using DBGHELP_LOG logging to get more information about what's going on WRT symbol loading...
    1) launch a CMD prompt
    2) SET DBGHELP_LOG=c:\path\to\logfile.log
      (in the above command, replace "c:\path\to\" with a real path on the system)
    3) from same CMD prompt, launch Process Explorer
    4) verify procexp.exe's Environment tab contains the DBGHELP_LOG variable
    5) attempt to get the stack of the threads
    6) close Process Explorer
    7) check c:\path\to\logfile.log

    Wednesday, September 2, 2009 2:28 AM
  • So it looks like I didn't have the windows debugging tools installed. I have since installed maybe these stack will be better if not I will do as your second suggestion suggests.
     
    Thread 60:
    ntkrnlpa.exe!HalPrivateDispatchTable+0x36
    usbhub.sys!USBH_SyncSubmitUrb+0x105
    usbhub.sys!USBH_FdoSyncSubmitUrb+0x16
    usbhub.sys!USBH_Transact+0xdb
    usbhub.sys!USBH_SyncClearPortStatus+0x20
    usbhub.sys!USBH_ProcessPortStateChange+0x235
    usbhub.sys!USBH_ChangeIndicationWorker+0x14d
    ntkrnlpa.exe!wctomb+0x8a2
    ntkrnlpa.exe!RtlUpcaseUnicodeToMultiByteN+0x706
    ntkrnlpa.exe!NtBuildNumber+0x786
     
    Thread 52:ntkrnlpa.exe!NtBuildNumber+0x43
    ntkrnlpa.exe!wctomb+0x87f
    ntkrnlpa.exe!RtlUpcaseUnicodeToMultiByteN+0x706
    ntkrnlpa.exe!NtBuildNumber+0x786
     
    Thread 44:
    ntkrnlpa.exe!NtBuildNumber+0x43
    ntkrnlpa.exe!wctomb+0x87f
    ntkrnlpa.exe!RtlUpcaseUnicodeToMultiByteN+0x706
    ntkrnlpa.exe!NtBuildNumber+0x786

    These same to change very rapidly and sometimes they have more threads and sometimes less.

     
    Wednesday, September 2, 2009 5:45 PM
  • Those offsets are still too large, and the names don't make sense.  Please try dbghelp_log logging to get more information about why symbols aren't resolving.
    Wednesday, September 2, 2009 6:07 PM
  • This appears to have been the same issue as http://forum.sysinternals.com/printer_friendly_posts.asp?TID=10470
    Amdk8 was having issue updated and now my PC is running without issue.
    Wednesday, September 2, 2009 7:39 PM
  • Amdk8 was having issue updated and now my PC is running without issue.
    Err..  That actually was not the case in the referenced thread - reinstalling NIS2008 resolved the issue there.

    Seeing a large amount of "activity" (with Kernrate) in amdk8.sys is normal and expected, as also directed in the referenced topic... amdk8.sys and intelppm.sys
    Wednesday, September 2, 2009 7:51 PM
  • hi there,
     
    with respect to molotov suggestion , i would recommend to have a adplus hang dump generated and point us to the loacation for analysis.
     
     
     
    Thursday, September 3, 2009 8:32 PM
  • logopen "C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__Date_09-03-2009__Time_20-52-43PM.log"
    * Created with ADPlus Version 6.03.006    Version Date 12/16/2008
    *
    * --------- ADPlus  was started at: -----------
    .time
    * ------------------------------------------------------
    *
    *
    *
    * --------- ADPlus 6.03.006 was run on server: --------
    * Server name: DOG-0F530153D1D
    * ------------------------------------------------------
    *
    *
    *
    * ------ OS Version Information displayed below. -------
    !version
    * ------------------------------------------------------
    *
    *
    *
    *
    * ------ Current Actions for Exceptions ----
    *  AccessViolation [av]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  InvalidHandle [ch]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  IllegalInstruction [ii]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  IntegerDivide [dz]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  FloatingDivide [c000008e]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  IntegerOverflow [iov]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  InvalidLockSequence [lsq]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  StackOverflow [sov]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  CPlusPlusEH [eh]       return: GN GN
    *      1st chance: Log;Time;Stack
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  UnknownException        return: GN GN
    *      1st chance: Log;Time;Stack
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  NET_CLR [clr]       return: GN GN
    *      1st chance: VOID
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  CONTRL_C_OR_Debug_Break [bpe]       return: Q GN
    *      1st chance: Log;Time;EventLog;Stacks;LoadedModules;MatchingSymbols;MiniDump !locks;!runaway
    *      2nd chance: 
    *  Wake_Debugger [wkd]       return: Q GN
    *      1st chance: Log;Time;EventLog;Stacks;LoadedModules;MatchingSymbols;MiniDump !locks;!runaway
    *      2nd chance: 
    *  DLL_Load [ld]       return: GN GN
    *      1st chance: Log
    *      2nd chance: Log
    *  DLL_UnLoad [ud]       return: GN GN
    *      1st chance: Log
    *      2nd chance: Log
    *  Process_Shut_Down [epr]       return: VOID VOID
    *      1st chance: Log;Time;EventLog;Stacks;FullDump !runaway
    *      2nd chance: 
    *  Application_hang [aph]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  Ctl_C_Console_app [cce]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  Data_misaligned [dm]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  Guard_page_violation [gp]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  In_page_IO_error [ip]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  Invalid_system_call [isc]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *  Stack_buffer_overflow [sbo]       return: GN GN
    *      1st chance: Log;Time;Stack;MiniDump
    *      2nd chance: Log;Time;Stack;FullDump;EventLog
    *
    * ------ Last Script Command: Q
    as AdpOutputDir C:\Program Files\Debugging Tools for Windows (x86)
    as AdpDumpDir C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM
    * ------ Current symbol path ----
    .sympath
    .echotimestamps
    sxe -c @".echo ---;.echo --- 1st chance AccessViolation exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_AccessViolation_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_AccessViolation__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance AccessViolation exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_AccessViolation_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_AccessViolation__full.dmp;!elog_str ADPlus detected a 2nd chance AccessViolation exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" av
    sxe -c @".echo ---;.echo --- 1st chance InvalidHandle exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_InvalidHandle_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_InvalidHandle__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance InvalidHandle exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_InvalidHandle_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_InvalidHandle__full.dmp;!elog_str ADPlus detected a 2nd chance InvalidHandle exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" ch
    sxe -c @".echo ---;.echo --- 1st chance IllegalInstruction exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_IllegalInstruction_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_IllegalInstruction__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance IllegalInstruction exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_IllegalInstruction_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_IllegalInstruction__full.dmp;!elog_str ADPlus detected a 2nd chance IllegalInstruction exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" ii
    sxe -c @".echo ---;.echo --- 1st chance IntegerDivide exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_IntegerDivide_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_IntegerDivide__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance IntegerDivide exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_IntegerDivide_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_IntegerDivide__full.dmp;!elog_str ADPlus detected a 2nd chance IntegerDivide exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" dz
    sxe -c @".echo ---;.echo --- 1st chance FloatingDivide exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_FloatingDivide_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_FloatingDivide__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance FloatingDivide exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_FloatingDivide_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_FloatingDivide__full.dmp;!elog_str ADPlus detected a 2nd chance FloatingDivide exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" c000008e
    sxe -c @".echo ---;.echo --- 1st chance IntegerOverflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_IntegerOverflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_IntegerOverflow__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance IntegerOverflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_IntegerOverflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_IntegerOverflow__full.dmp;!elog_str ADPlus detected a 2nd chance IntegerOverflow exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" iov
    sxe -c @".echo ---;.echo --- 1st chance InvalidLockSequence exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_InvalidLockSequence_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_InvalidLockSequence__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance InvalidLockSequence exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_InvalidLockSequence_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_InvalidLockSequence__full.dmp;!elog_str ADPlus detected a 2nd chance InvalidLockSequence exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" lsq
    sxe -c @".echo ---;.echo --- 1st chance StackOverflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_StackOverflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_StackOverflow__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance StackOverflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_StackOverflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_StackOverflow__full.dmp;!elog_str ADPlus detected a 2nd chance StackOverflow exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" sov
    sxe -c @".echo ---;.echo --- 1st chance CPlusPlusEH exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo; GN" -c2 @".echo ---;.echo --- 2nd chance CPlusPlusEH exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_CPlusPlusEH_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_CPlusPlusEH__full.dmp;!elog_str ADPlus detected a 2nd chance CPlusPlusEH exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" eh
    sxe -c @".echo ---;.echo --- 1st chance UnknownException exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo; GN" -c2 @".echo ---;.echo --- 2nd chance UnknownException exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_UnknownException_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_UnknownException__full.dmp;!elog_str ADPlus detected a 2nd chance UnknownException exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" *
    sxi -c2 @".echo ---;.echo --- 2nd chance NET_CLR exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_NET_CLR_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_NET_CLR__full.dmp;!elog_str ADPlus detected a 2nd chance NET_CLR exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" clr
    sxi -c @".echo ---;.echo --- 1st chance CONTRL_C_OR_Debug_Break exception ----;.echo ---------------------------------------------------------------;.echo CTRL-C was pressed to stop debugging this process!;.echo When PageHeap is in use this exception can be an internal exception;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;!elog_str ADPlus detected a 1st chance CONTRL_C_OR_Debug_Break exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time EventLog Stacks LoadedModules MatchingSymbols MiniDump. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM;.echo;.echo All thread stacks below ---;~*kvn250;.echo;.echo;.echo Listing loaded modules ---;lmv;.echo;.echo Modules with matching symbols ---;lml;.dump -u /mdi /c 1st_chance_CONTRL_C_OR_Debug_Break_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_CONTRL_C_OR_Debug_Break__mini.dmp;.echo;.echo Executing custom commands; !locks;!runaway; Q" bpe
    sxi -c @".echo ---;.echo --- 1st chance Wake_Debugger exception ----;.echo ---------------------------------------------------------------;.echo This was added for cases whereby the CTRL-C / debug break exception does not work and the debugger reverts to a non-invasive attach;.echo CTRL-C was pressed to stop debugging this process!;.echo When PageHeap is in use this exception can be an internal exception;.echo Exiting the debugger!!!;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;!elog_str ADPlus detected a 1st chance Wake_Debugger exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time EventLog Stacks LoadedModules MatchingSymbols MiniDump. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM;.echo;.echo All thread stacks below ---;~*kvn250;.echo;.echo;.echo Listing loaded modules ---;lmv;.echo;.echo Modules with matching symbols ---;lml;.dump -u /mdi /c 1st_chance_Wake_Debugger_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Wake_Debugger__mini.dmp;.echo;.echo Executing custom commands; !locks;!runaway; Q" wkd
    sxe -c @".echo ---;.echo --- 1st chance DLL_Load exception ----;.echo ---------------------------------------------------------------; GN" -c2 @".echo ---;.echo --- 2nd chance DLL_Load exception ----;.echo ---------------------------------------------------------------; GN" ld
    sxn -c @".echo ---;.echo --- 1st chance DLL_UnLoad exception ----;.echo ---------------------------------------------------------------; GN" -c2 @".echo ---;.echo --- 2nd chance DLL_UnLoad exception ----;.echo ---------------------------------------------------------------; GN" ud
    sxi -c @".echo ---;.echo --- 1st chance Process_Shut_Down exception ----;.echo ---------------------------------------------------------------;.echo This process is shutting down!;.echo This can happen for the following reasons;.echo 1) Someone killed the process with Task Manager or the kill command;.echo 2.) If this process is an MTS or COM+ server package, it could be;.echo *    exiting because an MTS/COM+ server package idle limit was reached.;.echo 3.) If this process is an MTS or COM+ server package,;.echo *    someone may have shutdown the package via the MTS Explorer or;.echo *    Component Services MMC snap-in.;.echo 4.) If this process is an MTS or COM+ server package,;.echo *    MTS or COM+ could be shutting down the process because an internal;.echo *    error was detected in the process (MTS/COM+ fail fast condition).;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;!elog_str ADPlus detected a 1st chance Process_Shut_Down exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time EventLog Stacks FullDump. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM;.echo;.echo All thread stacks below ---;~*kvn250;.echo;.dump -u /ma /c 1st_chance_Process_Shut_Down_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Process_Shut_Down__full.dmp;.echo;.echo Executing custom commands; !runaway; " epr
    sxe -c @".echo ---;.echo --- 1st chance Application_hang exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Application_hang_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Application_hang__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Application_hang exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Application_hang_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Application_hang__full.dmp;!elog_str ADPlus detected a 2nd chance Application_hang exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" aph
    sxe -c @".echo ---;.echo --- 1st chance Ctl_C_Console_app exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Ctl_C_Console_app_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Ctl_C_Console_app__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Ctl_C_Console_app exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Ctl_C_Console_app_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Ctl_C_Console_app__full.dmp;!elog_str ADPlus detected a 2nd chance Ctl_C_Console_app exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" cce
    sxe -c @".echo ---;.echo --- 1st chance Data_misaligned exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Data_misaligned_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Data_misaligned__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Data_misaligned exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Data_misaligned_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Data_misaligned__full.dmp;!elog_str ADPlus detected a 2nd chance Data_misaligned exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" dm
    sxe -c @".echo ---;.echo --- 1st chance Guard_page_violation exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Guard_page_violation_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Guard_page_violation__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Guard_page_violation exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Guard_page_violation_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Guard_page_violation__full.dmp;!elog_str ADPlus detected a 2nd chance Guard_page_violation exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" gp
    sxe -c @".echo ---;.echo --- 1st chance In_page_IO_error exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_In_page_IO_error_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_In_page_IO_error__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance In_page_IO_error exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_In_page_IO_error_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_In_page_IO_error__full.dmp;!elog_str ADPlus detected a 2nd chance In_page_IO_error exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" ip
    sxe -c @".echo ---;.echo --- 1st chance Invalid_system_call exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Invalid_system_call_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Invalid_system_call__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Invalid_system_call exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Invalid_system_call_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Invalid_system_call__full.dmp;!elog_str ADPlus detected a 2nd chance Invalid_system_call exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" isc
    sxe -c @".echo ---;.echo --- 1st chance Stack_buffer_overflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /mdi /c 1st_chance_Stack_buffer_overflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__1st_chance_Stack_buffer_overflow__mini.dmp; GN" -c2 @".echo ---;.echo --- 2nd chance Stack_buffer_overflow exception ----;.echo ---------------------------------------------------------------;.echo;.echo Occurrence happened at: ;.time;.echo;.echo Faulting stack below ---;~#kvn250;.echo;.dump -u /ma /c 2nd_chance_Stack_buffer_overflow_exception_in_SYSTEM_running_on_DOG-0F530153D1D C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM\PID-4__SYSTEM__2nd_chance_Stack_buffer_overflow__full.dmp;!elog_str ADPlus detected a 2nd chance Stack_buffer_overflow exception in process SYSTEM and has taken the following actions at the time of the crash: Log Time Stack FullDump EventLog. The output directory is C:\Program Files\Debugging Tools for Windows (x86)\Crash_Mode__Date_09-03-2009__Time_20-52-43PM; GN" sbo
    *
    * ADPlus is monitoring: SYSTEM
    * for  1st chance and 2nd chance exceptions as configured above.
    * To change ADPlus configuration please refer to ADPlus.Doc. This file can be found
    * in the same folder as ADPlus.vbs
    *
    g
    *
    *
    *
    * -------- ADPlus 6.03.006 finished running at: --------
    .time
    * -------------------------------------------------------
    * -- Ending the script with a QUIT  --
    Q
    Thursday, September 3, 2009 8:54 PM
  • I didn't realize adplus could be used with the SYSTEM process, PID 4... Confused
    Friday, September 4, 2009 2:36 AM