Posts Tagged ‘Dr Watson’
Posted by William Diaz on July 25, 2012
This is an XP workstation so likely the post-mortem default debugger is capturing the exception. I UNC-navigate to \\computername\Documents and Settings\All Users\Application Data\Microsoft\DrWatson. I grab both the drwtsn32.log and user.dmp files. They have recent time stamps of the day before which means that they were likely created as a result of the issue the user was experiencing. I start by examining the log file, starting from the bottom working my way up. The user’s initial complaint was the IE was crashing when going to various websites. I expected to find iexplore.exe process crashing in the log. A few searches in the text file later, I find IE crashing on that day:
|
Application exception occurred:
App: C:\Program Files\Internet Explorer\iexplore.exe (pid=6828)
When: 7/24/2012 @ 11:28:13.701
Exception number: c0000005 (access violation)
|
Read the rest of this entry »
Posted in Troubleshooting | Tagged: Crash, Dr Watson, Dump, Malware, Process Explorer | Leave a Comment »
Posted by William Diaz on March 2, 2012
A user called in and requested one of our technicians to assist in removing some annoying autorun applications. Upon opening the Control Panel and going to Add or Remove Programs in Windows XP, the rundll32.exe process was crashing. The same applied for any process that required a CPL to run:
I was asked to assist and started by going to C:\Documents and Settings\username\Application Data\Microsoft\ Dr Watson. I opened the drwtsn32.log and scrolled to the bottom, confirming that some error in rundll32.exe was being encountered: Read the rest of this entry »
Posted in Troubleshooting | Tagged: Crash, Dr Watson, Malware | Leave a Comment »
Posted by William Diaz on February 9, 2012
The other day while trying to remove some add-ons from Internet Explorer, Windows DEP was kicking in and closing the IE Setting control panel box (rundll32.exe process) for whatever reason:
Or at least it was trying to. Read the rest of this entry »
Posted in Troubleshooting, Troubleshooting Tools | Tagged: Crash, Dr Watson, Hang | Leave a Comment »
Posted by William Diaz on October 3, 2011
A few years ago I started to see several complaints of Internet Explorer crashing in the course of a couple months. The error was one of the rather vague exception messages thrown at the time of the crash and didn’t allude to anything obvious. Tired of not being able to explain through any of the conventional troubleshooting methods, I did a little research into advanced troubleshooting techniques and came across the Windows XP default debugger, Dr. Watson. Sure it sounds a little cheesy but this is actually a helpful little gem that has assisted me in resolving many cases of unexplained application crashes. And even though Microsoft has done away with drwtsn32.exe in all Windows operating systems after XP, the majority of small and large enterprises are still using XP, which means it should be one of core tools of any Windows XP troubleshooting guru. You’ll also see how, despite Microsoft moving to WER, Dr. Watson can still be leveraged by the Windows Vista/7 OS (just for the hell of it).
To use Dr. Watson, you don’t need to do anything. By default, it is the default Windows XP debugger. When an application experiences a exception of sorts that leads to a crash, ideally it is designed to dump that process and create two files, a plain text drwtsn32.log and a dump file named user.dmp, the latter which requires WinDbg to open and analyze. If you are not sure if Dr. Watson is the default debugger, you can run drwtsn32.exe –i to make it the default. You can also confirm by going to HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug and looking in the Debugger string for drwtsn32 -p %ld -e %ld –g:
Read the rest of this entry »
Posted in Troubleshooting, Troubleshooting Tools, Uncategorized | Tagged: Debugging, Dr Watson, Dump | Leave a Comment »
Posted by William Diaz on October 1, 2011
I don’t trust uninstallers. They always tend to leave something behind. Every now and then one of these orphaned components still ends up not playing well with some other application or the OS, resulting in crashing user-mode apps or the kernel. A good example of this was a previous post where I was experiencing a BSOD when running Process Monitor (read about it here) after installing a Microsoft application.
So, we have a workstation that is about to be sent off to be re-imaged because iLinc, a web conferencing application, is crashing when the user tries to join a session. I intervene because I hate to see these issue written off as unexplained. Who knows, the system gets re-imaged, the user installs some application again and the problem repeats itself (which it would have been the case here).
It happened that Dr. Watson, the Windows XP post-mortem default debugger, was capturing the user-mode crash so I jumped in without hesitation:
Read the rest of this entry »
Posted in Troubleshooting | Tagged: Autoruns, Dr Watson, Dump, Process Monitor, WinDbg | Leave a Comment »
Posted by William Diaz on May 12, 2011
In Windows XP, if you have Dr Watson set as your post-mortem default debugger (by default it is) it usually does a good job at catching exceptions when the Windows print spooler, spoolersv.exe, crashes*. Most print spooler crashes are the result of a print driver. Finding the problem print driver is a simple matter of going into the drwtsn32.log and finding the thread that contains the FAULT, literally:
A user.dmp is also created in the DrWatson folder. This dump file offers more details and confirms it is a print driver but requires the Windows Debugging Tools to analyze. Resort to the user.dmp if the log is not revealing enough: Read the rest of this entry »
Posted in Troubleshooting | Tagged: Crash, Dr Watson, Printing | Leave a Comment »
Posted by William Diaz on October 12, 2010
She called me one day. I had no idea who she was. She was in one of our local offices and someone told her I was the crack desktop support tech to speak to cause “he knows a lot.” This is true, no doubt, and I’m honored some people think this highly of me. Since then, she has called me over many an issue, and in particular turned me on to what has become a known bug between Internet Explorer, a 3rd party toolbar application we use for tracking time (LexisNexis for the benefit of search queries for this in my SharePoint blog), and shipper’s tracking website. This would happen while trying to print shipping labels via Internet Explorer. Yes or No would crash IE. The error would often present itself as the following: “Runtime error. Corrupt block/Unknown block type freed. This is probably caused by freeing a static variable or bad pointer. Do you want to GPF?”
Read the rest of this entry »
Posted in Troubleshooting | Tagged: Crash, Dr Watson, Internet Explorer | Leave a Comment »
Posted by William Diaz on July 21, 2010
We see numerous complaints about missing printers. This will happen when the Windows print spooler (spoolersv.exe) is not running and we often see this complaint with those setup with personal HP 1020/1022 printers. While attempting to print PDFs, or after printing PDFs, the print spooler is crashing. The drwtsn32.log and user.dmp files in C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson all point to the same culprit, the HP ZSR.dll print driver.mHere is an excerpt from the drwtsn32.log: Read the rest of this entry »
Posted in Troubleshooting | Tagged: Crash, Dr Watson, PDF, Printing | Leave a Comment »
Posted by William Diaz on July 2, 2010
Some time ago we started to see a rash of complaints where Internet Explorer was crashing while visiting certain sites. Even though we were still largely a mix of IE6 and IE7, I had no problem reproducing the crash with IE8. The error message was rather vague (they often are) and didn’t offer any details as to what was the cause or how to troubleshoot: "IEXPLORE.EXE – Application Error – The Instruction at … referenced memory at … The memory could not be ‘read’":
Posted in Troubleshooting, Troubleshooting Tools | Tagged: Crash, Dr Watson, Dump, Internet Explorer, Networking | 1 Comment »
Windows Explored 