<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Topic &#x27;Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...&#x27; in forum &#x27;Microsoft Help&#x27; - dslreports.com</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24750827</link>
<description></description>
<language>en</language>
<pubDate>Sat, 25 May 2013 19:46:30 EDT</pubDate>
<lastBuildDate>Sat, 25 May 2013 19:46:30 EDT</lastBuildDate>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-25094037</link>
<description><![CDATA[jsolo1 posted : It's been my experience that crashes on an otherwise clean system, even after an OS reload (from scratch) typically indicate either a memory problem, or other hardware fault.<br><br>That is, make an image of your current system, unplug any additional drives.  Then reload windows from scratch (same version, drivers, etc...).  If you encounter no crashes, then your issue was due to OS corruption.  If your crashes continue (before or after you do windows updates ONLY), then it points to that piece of hardware being at fault most likely.<br><br>Before you commit to doing all this, if your audio is onboard, go into the bios and disable the sound (based on the above conclusion that it's an audio driver crashing).  If not, just pull the sound card out and see what happens.<br><br>Finally, consider proof reading your posts.  Periods, punctuation and proper grammar make reading posts much easier.<br><small>--<br>Insanity is living in a state of illusion.</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-25094037</guid>
<pubDate>Thu, 18 Nov 2010 18:10:48 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-25092942</link>
<description><![CDATA[Chao284 posted : Well that is the thing, in this economy no one can upgrade their computers, let alone building a custom system wouid cost about $1500 currently, but also getting a bare bone system would be less, but the drivers on Windows XP and Windows 7 are likely to be stable, and could cause Stop errors every 2 weeks or a month, the problem is, Sound Card Driver bugs are popping up more as gamers become more hard core or those who listen to their music all night would see these bugs take place, and the latest Bug Check I received had an unknown address that hooks with the Audio Driver Chip's address header, in other words old sound cards and newer software may encounter this, seeing I have the last version of DirectX supported on Windows 2000, <br><br>And that also has had minor issues with my video card too, but luckly there was 1 last Driver update Windows 2000 had that fixed it.<br><br>Overall it would take me the next 6 months of my job to gain enough money to upgrade my system at the required $1500 to $2000 level for a system upgrade.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-25092942</guid>
<pubDate>Thu, 18 Nov 2010 14:22:08 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24804026</link>
<description><![CDATA[auggy posted : Does the Ctmm32.dll file exist in the System32 folder?<br><br>If so, can you rename this file and see if it helps any?<br><br>More info:<br><br>&raquo;<A HREF="http://support.microsoft.com/kb/296895" >support.microsoft.com/kb/296895</A>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24804026</guid>
<pubDate>Wed, 15 Sep 2010 19:25:56 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24800837</link>
<description><![CDATA[dave posted : No, but I'm still going to say you have a simple bug in a driver, and are not being DoS'd.  The only way that I can see that a sound driver could be 'remotely attacked' would be if a maliciously-formed sound file were on a web site you visited.<br><br>Not all bugs are fixed by the time you need a fix, by the way. The non-existence of a fix does not make it not-a-bug.  <br><br>And, unfortunately, that's what end-of-life means for software: there probably will be no future bug fix.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24800837</guid>
<pubDate>Wed, 15 Sep 2010 07:33:24 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24800735</link>
<description><![CDATA[Chao284 posted : Well if you think this has to do with me not upgrading my OS due to a need of a Hardware overhaul upgrade, I have no money for it and just speak of it, a Similar but same Zero Day crash now got triggered by one of the Kernal System Audio Drivers, kmixer.sys,<br><br>*******************************************************************************<br>*                                                                             *<br>*                        Bugcheck Analysis                                    *<br>*                                                                             *<br>*******************************************************************************<br><br>KMODE_EXCEPTION_NOT_HANDLED (1e)<br>This is a very common bugcheck.  Usually the exception address pinpoints<br>the driver/function that caused the problem.  Always note this address<br>as well as the link date of the driver/image that contains this address.<br>Arguments:<br>Arg1: c0000005, The exception code that was not handled<br>Arg2: 00000000, The address that the exception occurred at<br>Arg3: 00000000, Parameter 0 of the exception<br>Arg4: 00000000, Parameter 1 of the exception<br><br>Debugging Details:<br>------------------<br><br>OVERLAPPED_MODULE: Address regions for 'kmixer' and 'kmixer.sys' overlap<br><br>EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".<br><br>FAULTING_IP: <br>+0<br>00000000 ??              ???<br><br>EXCEPTION_PARAMETER1:  00000000<br><br>EXCEPTION_PARAMETER2:  00000000<br><br>READ_ADDRESS: unable to read from 80481518<br>unable to read from 804811c8<br>unable to read from 804810a8<br>unable to read from 80472de0<br>unable to read from 804810c0<br>unable to read from 804811c4<br>unable to read from 80472de4<br>unable to read from 80481284<br>unable to read from 804814b8<br> 00000000 <br><br>CUSTOMER_CRASH_COUNT:  1<br><br>DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO<br><br>BUGCHECK_STR:  0x1E<br><br>PROCESS_NAME:  System<br><br>LAST_CONTROL_TRANSFER:  from 8045fceb to 80454a78<br><br>FAILED_INSTRUCTION_ADDRESS: <br>+0<br>00000000 ??              ???<br><br>STACK_TEXT:  <br>bc128724 8045fceb bc12874c 00000000 bc12874c nt!PsGetVersion+0x6<br>bc12874c 80469962 bc128bcc bc128dcc bc128824 nt!_itoa+0x23<br>bc128770 8045b8f4 bc128bcc bc128dcc bc128824 nt!RtlpCaptureContext+0x2e<br>bc128844 80062f53 00000001 bc12896c 00000008 nt!RtlDispatchException+0x122<br>WARNING: Stack unwind information not available. Following frames may be wrong.<br>00000000 00000000 00000000 00000000 00000000 hal!KfLowerIrql+0x43<br><br>STACK_COMMAND:  kb<br><br>FOLLOWUP_IP: <br>nt!PsGetVersion+6<br>80454a78 6a01            push    1<br><br>SYMBOL_STACK_INDEX:  0<br><br>SYMBOL_NAME:  nt!PsGetVersion+6<br><br>FOLLOWUP_NAME:  MachineOwner<br><br>MODULE_NAME: nt<br><br>IMAGE_NAME:  ntoskrnl.exe<br><br>DEBUG_FLR_IMAGE_TIMESTAMP:  4b7a1bd5<br><br>FAILURE_BUCKET_ID:  0x1E_NULL_IP_nt!PsGetVersion+6<br><br>BUCKET_ID:  0x1E_NULL_IP_nt!PsGetVersion+6<br><br>Followup: MachineOwner<br><br>Update, I checked for new drivers for my Sound Card, and I will repeat, THERE IS NO NEW DRIVERS, according to Windows 2000, the driver I have is the current one and is not seeing any update and I figure that remote attacks even if there is no driver update means these hackers want to take my system down, and for this complaint below,<br><br>Now are you going to still say that I need to upgrade my hardware and my entire system?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24800735</guid>
<pubDate>Wed, 15 Sep 2010 06:28:49 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24752496</link>
<description><![CDATA[dave posted : The only thing I can see in common between your bug and that writeup is that they both involve sound drivers.<br><br>How do you imagine these Russians are issuing I/O to your sound driver?  Anyway, it's easy to test.  Don't connect the machine to the net.  Does it still crash?<br><br>You have a driver bug.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24752496</guid>
<pubDate>Fri, 03 Sep 2010 15:51:16 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751930</link>
<description><![CDATA[auggy posted : Also, can you zip up several of the dump files and attach a post in this thread?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751930</guid>
<pubDate>Fri, 03 Sep 2010 13:50:36 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751867</link>
<description><![CDATA[cmcasey79 posted : Why are you assuming that a system crash is because of some kind of attack against your system?  It's far more likely that you have some kind of hardware or software problem.<br><br>Using an OS as old as Win2k, you may not want to use the "latest" drivers, because they'll probably not be compatible.  What exact sound card and driver version for that card are you using?<br><small>--<br>- cmcasey79, BrightHouse Michigan RoadRunner Turbo(15000/1500), Farmington Hills, MI</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751867</guid>
<pubDate>Fri, 03 Sep 2010 13:36:58 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751257</link>
<description><![CDATA[Chao284 posted : Unfortunately, ever since after late 2008, there has been No more driver updates to the to the sound card, worse my OS is expired for support and that very much means a total system upgrade is needed, oh and put the reason the 0-Day attack, sounds like Russia managed to exploit most Creative Sound Card Drivers, here is the google quick view of the PDF the Russian Mafia and a security group found out,<br><br>&raquo;<A HREF="http://docs.google.com/viewer?a=v&q=cache:e8Q8Ry17_JoJ:securityvulns.ru/files/paper-wdm.pdf+portcls.sys+Exploits&hl=en&gl=us&pid=bl&srcid=ADGEESgWFshak8zl76Jta5lhhIkdowbCFUNMyCJsjQTF8A5ZWjrlhhm8CmxUhzjEDTMcj0HO-8It-losY0j9FNMt3p58oUudWt_Ty7duanUXC46A6GvD2Ae4-Wo2EynWGQ14CwzNzZnD&sig=AHIEtbTVMh95ytlktpCcgKZRX-NnbvSYzA" >docs.google.com/viewer?a=v&q=cac&middot;&middot;&middot;NnbvSYzA</A>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751257</guid>
<pubDate>Fri, 03 Sep 2010 11:29:23 EDT</pubDate>
</item>

<item>
<title>Re: [W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751165</link>
<description><![CDATA[Cudni posted : try updating your sound driver (portcls.sys) ?<br><br>Cudni]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/Re-W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24751165</guid>
<pubDate>Fri, 03 Sep 2010 11:11:54 EDT</pubDate>
</item>

<item>
<title>[W2K] Stop Error 1E on portcls.sys, 0-Day address crash...</title>
<link>http://www.dslreports.com/forum/W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24750827</link>
<description><![CDATA[Chao284 posted : Apparently as of recent, I have been hit with more and more Stop Errors knowing I have upgrade my ENTIRE system to support the latest OSes(Vista and windows 7), it seems I hit again with a Zero-Day based DoS BSoD(Stop Error)under KMODE_EXCEPTION_NOT_HANDLED which the piramry offset is a Kernal System Access Violation, here is the log info below, the falut occors on the System Process,<br><br>*******************************************************************************<br>*                                                                             *<br>*                        Bugcheck Analysis                                    *<br>*                                                                             *<br>*******************************************************************************<br><br>KMODE_EXCEPTION_NOT_HANDLED (1e)<br>This is a very common bugcheck.  Usually the exception address pinpoints<br>the driver/function that caused the problem.  Always note this address<br>as well as the link date of the driver/image that contains this address.<br>Arguments:<br>Arg1: c0000005, The exception code that was not handled<br>Arg2: 00000000, The address that the exception occurred at<br>Arg3: 00000000, Parameter 0 of the exception<br>Arg4: 00000000, Parameter 1 of the exception<br><br>Debugging Details:<br>------------------<br><br>EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".<br><br>FAULTING_IP: <br>+0<br>00000000 ??              ???<br><br>EXCEPTION_PARAMETER1:  00000000<br><br>EXCEPTION_PARAMETER2:  00000000<br><br>READ_ADDRESS: unable to read from 80481518<br>unable to read from 804811c8<br>unable to read from 804810a8<br>unable to read from 80472de0<br>unable to read from 804810c0<br>unable to read from 804811c4<br>unable to read from 80472de4<br>unable to read from 80481284<br>unable to read from 804814b8<br> 00000000 <br><br>CUSTOMER_CRASH_COUNT:  1<br><br>DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO<br><br>BUGCHECK_STR:  0x1E<br><br>PROCESS_NAME:  System<br><br>EXCEPTION_RECORD:  ba69ebcc -- (.exr 0xffffffffba69ebcc)<br>ExceptionAddress: 00000000<br>   ExceptionCode: c0000005 (Access violation)<br>  ExceptionFlags: 00000000<br>NumberParameters: 2<br>   Parameter[0]: 00000000<br>   Parameter[1]: 00000000<br>Attempt to read from address 00000000<br><br>TRAP_FRAME:  ba69ec20 -- (.trap 0xffffffffba69ec20)<br>ErrCode = 00000000<br>eax=ff01c08c ebx=fe0ff008 ecx=ff01c008 edx=fd5b8f00 esi=fee99ed0 edi=86b2b2a8<br>eip=00000000 esp=ba69ec94 ebp=ba69ecd0 iopl=0         nv up ei ng nz na po nc<br>cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282<br>00000000 ??              ???<br>Resetting default scope<br><br>LAST_CONTROL_TRANSFER:  from 8045fceb to 80454a78<br><br>FAILED_INSTRUCTION_ADDRESS: <br>+0<br>00000000 ??              ???<br><br>STACK_TEXT:  <br>WARNING: Frame IP not in any known module. Following frames may be wrong.<br>ba69ec90 bfa2b73a ff01c08c 86b2b2a8 86b2b200 0x0<br>ba69ecd0 bfa2b0bc 00000000 86b2b200 00000000 portcls+0x1473a<br>ba69ed04 bfa29cf3 00000000 826add90 86b2b2a8 portcls+0x140bc<br>ba69ed2c bfa29b74 826add90 86b2b2a8 86b2b2a8 portcls+0x12cf3<br>ba69ed4c 8041ddf1 826add90 86b2b2a8 fefab848 portcls+0x12b74<br>ba69eda8 80454ad2 fefab848 00000000 00000000 nt!IofCallDriver+0x1<br>ba69eddc 804692e2 b7915414 fefab848 00000000 nt!PsGetVersion+0x60<br>ba69edf0 00000000 00000000 00000000 00000000 nt!RtlCompareMemoryUlong+0x12<br><br>STACK_COMMAND:  .trap 0xffffffffba69ec20 ; kb<br><br>FOLLOWUP_IP: <br>portcls+1473a<br>bfa2b73a ??              ???<br><br>SYMBOL_STACK_INDEX:  1<br><br>SYMBOL_NAME:  portcls+1473a<br><br>FOLLOWUP_NAME:  MachineOwner<br><br>MODULE_NAME: portcls<br><br>IMAGE_NAME:  portcls.sys<br><br>DEBUG_FLR_IMAGE_TIMESTAMP:  3e9cd7ea<br><br>FAILURE_BUCKET_ID:  0x1E_NULL_IP_portcls+1473a<br><br>BUCKET_ID:  0x1E_NULL_IP_portcls+1473a<br><br>Followup: MachineOwner<br>---------<br><br>kd> lmvm portcls<br>start    end        module name<br>bfa17000 bfa3b1e0   portcls  T (no symbols)           <br>    Loaded symbol image file: portcls.sys<br>    Image path: portcls.sys<br>    Image name: portcls.sys<br>    Timestamp:        Tue Apr 15 21:11:22 2003 (3E9CD7EA)<br>    CheckSum:         0002BA69<br>    ImageSize:        000241E0<br>    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/W2K-Stop-Error-1E-on-portclssys-0Day-address-crash-24750827</guid>
<pubDate>Fri, 03 Sep 2010 09:48:12 EDT</pubDate>
</item>

</channel>
</rss>
