Operating System: Microsoft Windows 2000 Professional (32-bit), version 5.00.2195 Service Pack 4 Program Executable: c:\program files\vmware\vmware tools\VMTOOLSD.EXE Program Arguments: Starting Directory: C:\Program Files\VMware\VMware Tools\ Search Path: C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem Options Selected: Simulate ShellExecute by inserting any App Paths directories into the PATH environment variable. Log DllMain calls for process attach and process detach messages. Hook the process to gather more detailed dependency information. Log LoadLibrary function calls. Log GetProcAddress function calls. Log debug output messages. Automatically open and profile child processes. -------------------------------------------------------------------------------- Started "VMTOOLSD.EXE" (process 0x410) at address 0x00400000. Successfully hooked module. Loaded "NTDLL.DLL" at address 0x77F80000. Successfully hooked module. Loaded "ADVAPI32.DLL" at address 0x7C2D0000. Successfully hooked module. Loaded "KERNEL32.DLL" at address 0x7C570000. Successfully hooked module. Loaded "RPCRT4.DLL" at address 0x77D30000. Successfully hooked module. Loaded "OLE32.DLL" at address 0x7CE20000. Successfully hooked module. Loaded "GDI32.DLL" at address 0x77F40000. Successfully hooked module. Loaded "USER32.DLL" at address 0x77E10000. Successfully hooked module. Loaded "VERSION.DLL" at address 0x77820000. Successfully hooked module. Loaded "LZ32.DLL" at address 0x759B0000. Successfully hooked module. Loaded "MSVCR90.DLL" at address 0x78520000. Successfully hooked module. Loaded "INTL.DLL" at address 0x10000000. Successfully hooked module. Loaded "ICONV.DLL" at address 0x00230000. Successfully hooked module. Loaded "GLIB-2.0.DLL" at address 0x00420000. Successfully hooked module. Loaded "WS2_32.DLL" at address 0x75030000. Successfully hooked module. Loaded "MSVCRT.DLL" at address 0x77B40000. Successfully hooked module. Loaded "WS2HELP.DLL" at address 0x75020000. Successfully hooked module. Loaded "SHELL32.DLL" at address 0x7CF30000. Successfully hooked module. Loaded "SHLWAPI.DLL" at address 0x70A70000. Successfully hooked module. Loaded "COMCTL32.DLL" at address 0x71710000. Successfully hooked module. Loaded "MSIMG32.DLL" at address 0x6B2C0000. Successfully hooked module. Loaded "GMODULE-2.0.DLL" at address 0x00530000. Successfully hooked module. Loaded "GOBJECT-2.0.DLL" at address 0x00540000. Successfully hooked module. Loaded "GTHREAD-2.0.DLL" at address 0x00590000. Successfully hooked module. Loaded "VMTOOLS.DLL" at address 0x005A0000. Successfully hooked module. Loaded "OLEAUT32.DLL" at address 0x779B0000. Successfully hooked module. Entrypoint reached. All implicit modules have been loaded. DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0012FD30) in "KERNEL32.DLL" called. DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0012FD30) in "KERNEL32.DLL" returned 1 (0x1). Injected "DEPENDS.DLL" at address 0x08370000. DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "DEPENDS.DLL" called. DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "DEPENDS.DLL" returned 1 (0x1). DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0012FD30) in "RPCRT4.DLL" called. LoadLibraryA("kernel32.dll") called from "RPCRT4.DLL" at address 0x77D87E19. LoadLibraryA("kernel32.dll") returned 0x7C570000. GetProcAddress(0x7C570000 [KERNEL32.DLL], "InterlockedCompareExchange") called from "RPCRT4.DLL" at address 0x77D87E29 and returned 0x7C57B5FC. DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0012FD30) in "RPCRT4.DLL" returned 1 (0x1). DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0012FD30) in "ADVAPI32.DLL" called. DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0012FD30) in "ADVAPI32.DLL" returned 1 (0x1). DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0012FD30) in "USER32.DLL" called. DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0012FD30) in "USER32.DLL" returned 28311553 (0x1B00001). DllMain(0x7CE20000, DLL_PROCESS_ATTACH, 0x0012FD30) in "OLE32.DLL" called. GetProcAddress(0x77D30000 [RPCRT4.DLL], "I_RpcForcePickleCleanup") called from "OLE32.DLL" at address 0x7CEE2BE6 and returned 0x77D38159. GetProcAddress(0x77F80000 [NTDLL.DLL], "NtQuerySystemInformation") called from "RPCRT4.DLL" at address 0x77D87B65 and returned 0x77F889DC. GetProcAddress(0x77F80000 [NTDLL.DLL], "NtOpenFile") called from "RPCRT4.DLL" at address 0x77D87B80 and returned 0x77F886AC. GetProcAddress(0x77F80000 [NTDLL.DLL], "RtlInitUnicodeString") called from "RPCRT4.DLL" at address 0x77D87B8D and returned 0x77FABE9C. DllMain(0x7CE20000, DLL_PROCESS_ATTACH, 0x0012FD30) in "OLE32.DLL" returned 1 (0x1). DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0012FD30) in "LZ32.DLL" called. DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0012FD30) in "LZ32.DLL" returned 1 (0x1). DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0012FD30) in "VERSION.DLL" called. DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0012FD30) in "VERSION.DLL" returned 1 (0x1). DllMain(0x78520000, DLL_PROCESS_ATTACH, 0x0012FD30) in "MSVCR90.DLL" called. GetProcAddress(0x7C570000 [KERNEL32.DLL], "FlsAlloc") called from "MSVCR90.DLL" at address 0x78543ACC and returned 0x7C5C4B2E. GetProcAddress(0x7C570000 [KERNEL32.DLL], "FlsGetValue") called from "MSVCR90.DLL" at address 0x78543AD9 and returned 0x7C5C4B4E. GetProcAddress(0x7C570000 [KERNEL32.DLL], "FlsSetValue") called from "MSVCR90.DLL" at address 0x78543AE6 and returned 0x7C5C4B60. GetProcAddress(0x7C570000 [KERNEL32.DLL], "FlsFree") called from "MSVCR90.DLL" at address 0x78543AF3 and returned 0x7C5C4B3C. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x785435E2 and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "DecodePointer") called from "MSVCR90.DLL" at address 0x78543667 and returned 0x77FD471E. GetProcAddress(0x7C570000 [KERNEL32.DLL], "DecodePointer") called from "MSVCR90.DLL" at address 0x78543667 and returned 0x77FD471E. GetProcAddress(0x7C570000 [KERNEL32.DLL], "EncodePointer") called from "MSVCR90.DLL" at address 0x7854379B and returned 0x77FD46F8. GetProcAddress(0x7C570000 [KERNEL32.DLL], "DecodePointer") called from "MSVCR90.DLL" at address 0x785437AB and returned 0x77FD471E. GetProcAddress(0x7C570000 [KERNEL32.DLL], "IsProcessorFeaturePresent") called from "MSVCR90.DLL" at address 0x785A385B and returned 0x7C597B45. GetProcAddress(0x7C570000 [KERNEL32.DLL], "FindActCtxSectionStringW") called from "MSVCR90.DLL" at address 0x78542822 and returned 0x7C5C78D1. LoadLibraryA("USER32.DLL") called from "MSVCR90.DLL" at address 0x7858D976. LoadLibraryA("USER32.DLL") returned 0x77E10000. GetProcAddress(0x77E10000 [USER32.DLL], "MessageBoxA") called from "MSVCR90.DLL" at address 0x7858D98E and returned 0x77E333B3. GetProcAddress(0x77E10000 [USER32.DLL], "GetActiveWindow") called from "MSVCR90.DLL" at address 0x7858D9AB and returned 0x77E1FDBF. GetProcAddress(0x77E10000 [USER32.DLL], "GetLastActivePopup") called from "MSVCR90.DLL" at address 0x7858D9C0 and returned 0x77E2E2BE. GetProcAddress(0x77E10000 [USER32.DLL], "GetUserObjectInformationA") called from "MSVCR90.DLL" at address 0x7858D9D5 and returned 0x77E3CB83. GetProcAddress(0x77E10000 [USER32.DLL], "GetProcessWindowStation") called from "MSVCR90.DLL" at address 0x7858D9ED and returned 0x77E585F2. DllMain(0x78520000, DLL_PROCESS_ATTACH, 0x0012FD30) in "MSVCR90.DLL" returned 0 (0x0). Second chance exception 0xC0000142 (DLL Initialization Failed) occurred in "NTDLL.DLL" at address 0x77FAC57C. Exited "VMTOOLSD.EXE" (process 0x410) with code 128 (0x80).