the word file cannot be closed after encrypted by minifilter

NTFSD
1

when I close a .doc file that was encryped, then it can not be closed. It show “no response”.
when user FileSpy monitor it ,I find the error:
16 14:13:24.800 WINWORD.EXE FASTIO_QUERY_BASIC_INFO 966D4598 E:\asd.doc FAILURE

17 14:13:24.800 WINWORD.EXE IRP_MJ_QUERY_INFORMATION 00060870 966D4598 E:\asd.do
c STATUS_SUCCESS FileBasicInformation
18 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFF93 Key: N/A
19 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
20 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFA7 Key: N/A
21 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
22 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFCF Key: N/A
23 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
How can i solve it. Thanks.

2

If you are referring to the failure in the FASTIO_UNLOCK_SINGLE, that is
not the problem. This is either a filter or the file system rejecting
the Fast IO pathway which is immediately processed as a regular IRP
based operation.

You are probably not completing an operation which is resulting in the
“No Response” in WinWord.

Pete

On 3/21/2014 12:12 AM, xxxxx@gmail.com wrote:

when I close a .doc file that was encryped, then it can not be closed. It show “no response”.
when user FileSpy monitor it ,I find the error:
16 14:13:24.800 WINWORD.EXE FASTIO_QUERY_BASIC_INFO 966D4598 E:\asd.doc FAILURE

17 14:13:24.800 WINWORD.EXE IRP_MJ_QUERY_INFORMATION 00060870 966D4598 E:\asd.do
c STATUS_SUCCESS FileBasicInformation
18 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFF93 Key: N/A
19 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
20 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFA7 Key: N/A
21 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
22 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFCF Key: N/A
23 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
How can i solve it. Thanks.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

3

thanks,peter.But the all return status are STATUS_SUCCESS,?how can i to find the operation that is not completed,?

xxxxx@gmail.com
?From:?Peter ScottDate:?2014-03-21?20:39To:?Windows File Systems Devs Interest ListSubject:?Re: [ntfsd] the word file cannot be closed after encrypted by minifilter?
If you are referring to the failure in the FASTIO_UNLOCK_SINGLE, that is
not the problem. This is either a filter or the file system rejecting
the Fast IO pathway which is immediately processed as a regular IRP
based operation.
?
You are probably not completing an operation which is resulting in the
“No Response” in WinWord.
?
Pete
?
On 3/21/2014 12:12 AM, xxxxx@gmail.com wrote:

when I close a .doc file that? was encryped, then it can not be closed. It show “no response”.
when user FileSpy monitor it ,I find the error:
16 14:13:24.800 WINWORD.EXE FASTIO_QUERY_BASIC_INFO 966D4598 E:\asd.doc FAILURE

17 14:13:24.800 WINWORD.EXE IRP_MJ_QUERY_INFORMATION 00060870 966D4598 E:\asd.do
c STATUS_SUCCESS FileBasicInformation
18 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFF93 Key: N/A
19 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
20 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFA7 Key: N/A
21 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
22 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE By
teOffset: 00000000-7FFFFFCF Key: N/A
23 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 96
6D4598 E:\asd.doc STATUS_SUCCESS
How can i solve it. Thanks.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
?
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
?
?

NTFSD is sponsored by OSR
?
OSR is hiring!! Info at http://www.osr.com/careers
?
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
?
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

thanks,peter.
But the all return status are STATUS_SUCCESS, how can i to find the operation that is not completed?

5

By using windbg? Start kernel mode debugging and see which thread is stuck and the operation in question.

On 22-Mar-2014, at 8:57 am, xxxxx@gmail.com wrote:

thanks,peter.
But the all return status are STATUS_SUCCESS, how can i to find the operation that is not completed?

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

I use the process explorer to create a dump file when WINWORD.EXE show no response. The analysis result of the dump is below. I cannot understand it.
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for WINWORD.EXE -
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/WINWORD_EXE/11_0_6568_0/42e178a5/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

FAULTING_IP:
+21ed550
00000000 ?? ???

EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD: 00000fc8

DEFAULT_BUCKET_ID: STATUS_BREAKPOINT

PROCESS_NAME: WINWORD.EXE

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - {

MOD_LIST:

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774854d4 to 774870b4

PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT

BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT

STACK_TEXT:
0012dd84 774854d4 75726b32 00000330 00000330 ntdll!KiFastSystemCallRet
0012dd88 75726b32 00000330 00000330 0012dda8 ntdll!ZwClose+0xc
0012dd98 76f3caa4 00000330 04eb3fb8 0012ddc4 KERNELBASE!CloseHandle+0x2d
0012dda8 770e476f 00000330 00000000 04eb3fb8 kernel32!CloseHandleImplementation+0x3f
0012ddc4 770e4677 04eb3fb8 0012dde4 770e4199 ole32!CFileStream::~CFileStream+0x59
0012ddd0 770e4199 00000001 00000001 04eb3d10 ole32!CFileStream::`scalar deleting destructor’+0xd
0012dde4 7715c7db 04eb3fb8 04eb0858 7715c604 ole32!CFileStream::Release+0x2f
0012ddf0 7715c604 04eb0858 00000000 01a2b314 ole32!CPerContext::Close+0x3a
0012de14 300abe55 00000000 01a2b5b4 00490268 ole32!CExposedDocFile::Release+0xb8
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e08c 30151e8c 00000003 00000000 01a2b5e8 WINWORD+0xabe55
0012e2b4 300c9b56 004902c0 01a2caa8 00000000 WINWORD+0x151e8c
0012e2f8 300c9727 01a2b5e8 00000800 01a2b5e8 WINWORD+0xc9b56
0012e360 300c8d79 01a2caa8 00000000 00000000 WINWORD+0xc9727
0012e38c 30069183 00020202 00000000 00000001 WINWORD+0xc8d79
0012e410 76e3c4e7 00020202 00000000 00000000 WINWORD+0x69183
0012e43c 76e3c5e7 30068e14 00020202 00000010 user32!InternalCallWinProc+0x23
0012e4b4 76e35294 00000000 30068e14 00020202 user32!UserCallWinProcCheckWow+0x14b
0012e4f4 76e2ada9 00880860 0087eaf0 00000000 user32!SendMessageWorker+0x4d0
0012e514 30120bf5 00020202 00000010 00000000 user32!SendMessageA+0x7c
0012e98c 76e3c4e7 000301f0 00000010 00000000 WINWORD+0x120bf5
0012e9b8 76e3c5e7 300297e1 000301f0 00000010 user32!InternalCallWinProc+0x23
0012ea30 76e34f0e 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0x14b
0012ea8c 76e34f7d 0087f878 00000010 00000000 user32!DispatchClientMessage+0xda
0012eab4 77486fee 0012eacc 00000018 0012ec54 user32!__fnDWORD+0x24
0012eae0 76e34f51 76e3517d 000301f0 00000112 ntdll!KiUserCallbackDispatcher+0x2e
0012eae4 76e3517d 000301f0 00000112 0000f060 user32!NtUserMessageCall+0xc
0012eb68 76e2bb13 000301f0 00000112 0000f060 user32!RealDefWindowProcWorker+0x72
0012eb84 744b5eef 000301f0 00000112 0000f060 user32!RealDefWindowProcA+0x47
0012eb9c 744cd128 0012ebc8 007ada60 0012ec00 uxtheme!DoMsgDefault+0x2d
0012ebac 744b1e09 007ada60 0012ebc8 00000010 uxtheme!OnDwpSysCommand+0x47
0012ec00 744b5dda 00000000 00000000 0000f060 uxtheme!_ThemeDefWindowProc+0x13c
0012ec1c 76e2c6b7 000301f0 00000112 0000f060 uxtheme!ThemeDefWindowProcA+0x18
0012ec64 30121226 000301f0 00000112 0000f060 user32!DefWindowProcA+0x68
0012f0dc 76e3c4e7 000301f0 00000000 0000f060 WINWORD+0x121226
0012f108 76e35f9f 300297e1 000301f0 00000112 user32!InternalCallWinProc+0x23
0012f180 76e34f0e 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0xe0
0012f1dc 76e34f7d 0087f878 00000112 0000f060 user32!DispatchClientMessage+0xda
0012f204 77486fee 0012f21c 00000018 0012f3b0 user32!__fnDWORD+0x24
0012f230 76e34f51 76e3517d 000301f0 000000a1 ntdll!KiUserCallbackDispatcher+0x2e
0012f234 76e3517d 000301f0 000000a1 00000014 user32!NtUserMessageCall+0xc
0012f2b8 76e35138 000301f0 000000a1 00000014 user32!RealDefWindowProcWorker+0x72
0012f2d4 744b5eef 000301f0 000000a1 00000014 user32!RealDefWindowProcW+0x47
0012f2ec 744cd175 0012f324 000000a1 000301f0 uxtheme!DoMsgDefault+0x2d
0012f308 744b1e09 007ada60 0012f324 0000001c uxtheme!OnDwpNcLButtonDown+0xc9
0012f35c 744b1f20 00000000 00000000 00000014 uxtheme!_ThemeDefWindowProc+0x13c
0012f378 76e35fc3 000301f0 000000a1 00000014 uxtheme!ThemeDefWindowProcW+0x18
0012f3c0 30029983 000301f0 000000a1 00000014 user32!DefWindowProcW+0x68
0012f838 76e3c4e7 000301f0 000000a1 00000014 WINWORD+0x29983
0012f864 76e3c5e7 300297e1 000301f0 000000a1 user32!InternalCallWinProc+0x23
0012f8dc 76e3cc19 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0x14b
0012f93c 76e3cc70 300297e1 00000000 30a8afa0 user32!DispatchMessageWorker+0x35e
0012f94c 30068d76 30a8afa0 00000000 300684f6 user32!DispatchMessageW+0xf
0012f958 300684f6 30a8afa0 00240092 00240008 WINWORD+0x68d76
00000000 00000000 00000000 00000000 00000000 WINWORD+0x684f6

STACK_COMMAND: .cxr 0000000000000000 ; kb ; dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb

FOLLOWUP_IP:
WINWORD+abe55
300abe55 5e pop esi

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: winword+abe55

FOLLOWUP_NAME: MachineOwner
MODULE_NAME: WINWORD

IMAGE_NAME: WINWORD.EXE

DEBUG_FLR_IMAGE_TIMESTAMP: 42e178a5

FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_WINWORD.EXE!Unknown

BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_winword+abe55

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WINWORD_EXE/11_0_6568_0/42e178a5/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner

thanks

7

Two things:

  1. Get the kernel stack. Otherwise how would you know what’s causing the close to get stuck in kernel.
  2. Learn how to use windbg. It’s extremely hard to debug things without a kernel debugger attached.

Ayush

On 23-Mar-2014, at 11:38 am, xxxxx@gmail.com wrote:

I use the process explorer to create a dump file when WINWORD.EXE show no response. The analysis result of the dump is below. I cannot understand it.
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for WINWORD.EXE -
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/WINWORD_EXE/11_0_6568_0/42e178a5/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

FAULTING_IP:
+21ed550
00000000 ?? ???

EXCEPTION_RECORD: ffffffff – (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD: 00000fc8

DEFAULT_BUCKET_ID: STATUS_BREAKPOINT

PROCESS_NAME: WINWORD.EXE

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - {

MOD_LIST:

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 774854d4 to 774870b4

PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT

BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT

STACK_TEXT:
0012dd84 774854d4 75726b32 00000330 00000330 ntdll!KiFastSystemCallRet
0012dd88 75726b32 00000330 00000330 0012dda8 ntdll!ZwClose+0xc
0012dd98 76f3caa4 00000330 04eb3fb8 0012ddc4 KERNELBASE!CloseHandle+0x2d
0012dda8 770e476f 00000330 00000000 04eb3fb8 kernel32!CloseHandleImplementation+0x3f
0012ddc4 770e4677 04eb3fb8 0012dde4 770e4199 ole32!CFileStream::~CFileStream+0x59
0012ddd0 770e4199 00000001 00000001 04eb3d10 ole32!CFileStream::`scalar deleting destructor’+0xd
0012dde4 7715c7db 04eb3fb8 04eb0858 7715c604 ole32!CFileStream::Release+0x2f
0012ddf0 7715c604 04eb0858 00000000 01a2b314 ole32!CPerContext::Close+0x3a
0012de14 300abe55 00000000 01a2b5b4 00490268 ole32!CExposedDocFile::Release+0xb8
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e08c 30151e8c 00000003 00000000 01a2b5e8 WINWORD+0xabe55
0012e2b4 300c9b56 004902c0 01a2caa8 00000000 WINWORD+0x151e8c
0012e2f8 300c9727 01a2b5e8 00000800 01a2b5e8 WINWORD+0xc9b56
0012e360 300c8d79 01a2caa8 00000000 00000000 WINWORD+0xc9727
0012e38c 30069183 00020202 00000000 00000001 WINWORD+0xc8d79
0012e410 76e3c4e7 00020202 00000000 00000000 WINWORD+0x69183
0012e43c 76e3c5e7 30068e14 00020202 00000010 user32!InternalCallWinProc+0x23
0012e4b4 76e35294 00000000 30068e14 00020202 user32!UserCallWinProcCheckWow+0x14b
0012e4f4 76e2ada9 00880860 0087eaf0 00000000 user32!SendMessageWorker+0x4d0
0012e514 30120bf5 00020202 00000010 00000000 user32!SendMessageA+0x7c
0012e98c 76e3c4e7 000301f0 00000010 00000000 WINWORD+0x120bf5
0012e9b8 76e3c5e7 300297e1 000301f0 00000010 user32!InternalCallWinProc+0x23
0012ea30 76e34f0e 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0x14b
0012ea8c 76e34f7d 0087f878 00000010 00000000 user32!DispatchClientMessage+0xda
0012eab4 77486fee 0012eacc 00000018 0012ec54 user32!__fnDWORD+0x24
0012eae0 76e34f51 76e3517d 000301f0 00000112 ntdll!KiUserCallbackDispatcher+0x2e
0012eae4 76e3517d 000301f0 00000112 0000f060 user32!NtUserMessageCall+0xc
0012eb68 76e2bb13 000301f0 00000112 0000f060 user32!RealDefWindowProcWorker+0x72
0012eb84 744b5eef 000301f0 00000112 0000f060 user32!RealDefWindowProcA+0x47
0012eb9c 744cd128 0012ebc8 007ada60 0012ec00 uxtheme!DoMsgDefault+0x2d
0012ebac 744b1e09 007ada60 0012ebc8 00000010 uxtheme!OnDwpSysCommand+0x47
0012ec00 744b5dda 00000000 00000000 0000f060 uxtheme!_ThemeDefWindowProc+0x13c
0012ec1c 76e2c6b7 000301f0 00000112 0000f060 uxtheme!ThemeDefWindowProcA+0x18
0012ec64 30121226 000301f0 00000112 0000f060 user32!DefWindowProcA+0x68
0012f0dc 76e3c4e7 000301f0 00000000 0000f060 WINWORD+0x121226
0012f108 76e35f9f 300297e1 000301f0 00000112 user32!InternalCallWinProc+0x23
0012f180 76e34f0e 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0xe0
0012f1dc 76e34f7d 0087f878 00000112 0000f060 user32!DispatchClientMessage+0xda
0012f204 77486fee 0012f21c 00000018 0012f3b0 user32!__fnDWORD+0x24
0012f230 76e34f51 76e3517d 000301f0 000000a1 ntdll!KiUserCallbackDispatcher+0x2e
0012f234 76e3517d 000301f0 000000a1 00000014 user32!NtUserMessageCall+0xc
0012f2b8 76e35138 000301f0 000000a1 00000014 user32!RealDefWindowProcWorker+0x72
0012f2d4 744b5eef 000301f0 000000a1 00000014 user32!RealDefWindowProcW+0x47
0012f2ec 744cd175 0012f324 000000a1 000301f0 uxtheme!DoMsgDefault+0x2d
0012f308 744b1e09 007ada60 0012f324 0000001c uxtheme!OnDwpNcLButtonDown+0xc9
0012f35c 744b1f20 00000000 00000000 00000014 uxtheme!_ThemeDefWindowProc+0x13c
0012f378 76e35fc3 000301f0 000000a1 00000014 uxtheme!ThemeDefWindowProcW+0x18
0012f3c0 30029983 000301f0 000000a1 00000014 user32!DefWindowProcW+0x68
0012f838 76e3c4e7 000301f0 000000a1 00000014 WINWORD+0x29983
0012f864 76e3c5e7 300297e1 000301f0 000000a1 user32!InternalCallWinProc+0x23
0012f8dc 76e3cc19 00000000 300297e1 000301f0 user32!UserCallWinProcCheckWow+0x14b
0012f93c 76e3cc70 300297e1 00000000 30a8afa0 user32!DispatchMessageWorker+0x35e
0012f94c 30068d76 30a8afa0 00000000 300684f6 user32!DispatchMessageW+0xf
0012f958 300684f6 30a8afa0 00240092 00240008 WINWORD+0x68d76
00000000 00000000 00000000 00000000 00000000 WINWORD+0x684f6

STACK_COMMAND: .cxr 0000000000000000 ; kb ; dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb

FOLLOWUP_IP:
WINWORD+abe55
300abe55 5e pop esi

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: winword+abe55

FOLLOWUP_NAME: MachineOwner
MODULE_NAME: WINWORD

IMAGE_NAME: WINWORD.EXE

DEBUG_FLR_IMAGE_TIMESTAMP: 42e178a5

FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_WINWORD.EXE!Unknown

BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_winword+abe55

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WINWORD_EXE/11_0_6568_0/42e178a5/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner

thanks

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

8

Thanks a lot ,Ayush.
I will try my best to learn debugger well.