Agent bombs out in WinPE with error placed on clipboard
Hey all,
As title suggests, here is what was placed on the clipboard.
I noted that this machine boots with an invalid GUID (FFFF-FFFF-etc), however not my problem.
The following information has been placed on the clipboard. Visit the Ghost forums at https://forums.symantec.com/syment/board?board.id=109 and supply this information to gain help with this error.
Symantec Ghost Client Agent
An exception has occurred of type C0000005
X:\GHOST - X:\GHOST\ngctw32.exe 11.5.0.2188
0x773AC4EC in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x773AC43B in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x773A8B7B in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x41F19E in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x4091CF in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x409870 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x40A009 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x40ADC8 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x44EAE5 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x76083833 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\kernel32.dll
0x7722A9BD in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\ntdll.dll
James
Comments
That's not a fault that has been reported before
Since the fault is actually in USER32.DLL in order to determine the cause it will be necessary to obtain a detailed memory snapshot of the process at the time of failure in order to debug it. If your WinPE has DBGHELP.DLL included, then the client will have attempted to write a snapshot of the process at the point of failure to the directory which it was launched from, named NGERROR.DMP
This .DMP file is a Microsoft-format debugging snapshot which we can load into the development tools to inspect the state of the process at the point of the failure to determine what the specific circumstances that lead up to it were. If you can locate this memory snapshot and save it, then it can be sent to me and I can analyse it (once you have the file, compress it for transmission in a zip archive and contact me at the e-mail address in my forum profile so I can arrange for you to send it to me).
Would you like to reply?
Login or Register to post your comment.