Specifically interesting to note are the two exception parameters: "deadcafe"
Oh, and I ran CCleaner again afterwards and it had apparently stopped before the other 18.7MB were deleted. It didn't crash this time.
---
CODE
(f0f0f0f0.454): Unknown exception - code c000008f (first/second chance not available)
eax=01150000 ebx=0012d840 ecx=00001000 edx=7c90eb94 esi=00000000 edi=7ffdf000
eip=7c90eb94 esp=0012d818 ebp=0012d8b4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90eb94 c3 ret
0:000> .ecxr
eax=0012f954 ebx=0015d2b0 ecx=00000000 edx=7ffb001c esi=0012f9c4 edi=0015d2b0
eip=7c81eb33 esp=0012f950 ebp=0012f9a4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
kernel32!RaiseException+0x53:
7c81eb33 5e pop esi
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Module load completed but symbols could not be loaded for ccleaner.exe
FAULTING_IP:
kernel32!RaiseException+53
7c81eb33 5e pop esi
EXCEPTION_RECORD: 0012f668 -- (.exr 12f668)
ExceptionAddress: 7c81eb33 (kernel32!RaiseException+0x00000053)
ExceptionCode: c000008f
ExceptionFlags: 00000001
NumberParameters: 2
Parameter[0]: deadcafe
Parameter[1]: deadcafe
BUGCHECK_STR: c000008f
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: ccleaner.exe
ERROR_CODE: (NTSTATUS) 0xc000008f - {EXCEPTION} Floating-point inexact result.
CONTEXT: 0012f684 -- (.cxr 12f684)
eax=0012f954 ebx=0015d2b0 ecx=00000000 edx=7ffb001c esi=0012f9c4 edi=0015d2b0
eip=7c81eb33 esp=0012f950 ebp=0012f9a4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
kernel32!RaiseException+0x53:
7c81eb33 5e pop esi
Resetting default scope
LAST_CONTROL_TRANSFER: from 660d0956 to 7c81eb33
STACK_TEXT:
0012f9a4 660d0956 c000008f 00000001 00000002 kernel32!RaiseException+0x53
0012f9c4 660cddaf 0015d2b0 800a9c68 0012faf4 MSVBVM60!RaiseVbaException+0x23
0012f9d8 660cde12 0015d2b0 0012fb5c 00431705 MSVBVM60!EbRaiseException+0x60
0012f9e8 660d9d08 00009c68 004317d4 800a9c68 MSVBVM60!EbRaiseExceptionCode+0x5f
0012f9f0 004317d4 800a9c68 001c0878 00410c64 MSVBVM60!__vbaHresultCheckObj+0x1c
WARNING: Stack unwind information not available. Following frames may be wrong.
0012faf4 77d48734 008f0134 00000018 00000000 ccleaner+0x317d4
0012fb20 77d48816 00431705 008f0134 00000018 USER32!InternalCallWinProc+0x28
0012fb88 77d4b4c0 00000000 00431705 008f0134 USER32!UserCallWinProcCheckWow+0x150
0012fbdc 77d4b50c 005c32a8 00000018 00000000 USER32!DispatchClientMessage+0xa3
0012fc04 7c90eae3 0012fc14 00000018 005c32a8 USER32!__fnDWORD+0x24
0012fc28 77d4d8b0 6601c54b 008f0134 00000000 ntdll!KiUserCallbackDispatcher+0x13
0012fc70 660629d6 008f0134 00000000 00d31e94 USER32!NtUserShowWindow+0xc
0012fc88 6601e4a1 00d31e94 0012fd50 66006041 MSVBVM60!ModeUnloadZombieDesks+0x56
0012fcc8 6600605a 00cf38cc 008f00b2 00001061 MSVBVM60!FnwpMainFilter+0x531
0012fce8 77d48734 008f00b2 00001061 00000000 MSVBVM60!FnwpMain+0x19
0012fd14 77d48816 66006041 008f00b2 00001061 USER32!InternalCallWinProc+0x28
0012fd7c 77d4b89b 00000000 66006041 008f00b2 USER32!UserCallWinProcCheckWow+0x150
0012fdb8 77d5f3e3 0063e5a0 0063e538 00000000 USER32!SendMessageWorker+0x4a5
0012fdd8 6601d6a3 008f00b2 00001061 00000000 USER32!SendMessageA+0x7f
0012fdfc 6600a7aa 00cf3834 00cf375c 77d489cd MSVBVM60!ModeFinishReset+0x4c
0012fe2c 6600a737 ffffffff 000007d4 6600a711 MSVBVM60!MainAfterDispatch+0xee
0012fe38 6600a711 00cf37fc ffffffff 000007d4 MSVBVM60!CMsoComponent::FContinueMessageLoop+0xd
0012fe6c 6600a6bd 00000000 6600a4aa 00cf3764 MSVBVM60!SCM::FContinueMessageLoop+0x49
0012fe74 6600a4aa 00cf3764 00000000 ffffffff MSVBVM60!SCM_MsoStdCompMgr::FContinueMessageLoop+0x10
0012feb8 6600a41a ffffffff 00cf3764 00cf0000 MSVBVM60!ThunderMsgLoop+0x104
0012fecc 6600a3bc 00cf373c ffffffff 00cf3834 MSVBVM60!CMsoCMHandler::FPushMessageLoop+0x19
0012fefc 6600a2f8 00cf3834 ffffffff 000007d4 MSVBVM60!SCM::FPushMessageLoop+0xb9
0012ff18 6600a2c3 00cf3760 00cf3834 ffffffff MSVBVM60!SCM_MsoCompMgr::FPushMessageLoop+0x2b
0012ff3c 6600361c ffffffff 00380032 00320034 MSVBVM60!CMsoComponent::PushMsgLoop+0x26
0012ffb8 0040406e 004041a8 7c816d4f 00380032 MSVBVM60!ThunRTMain+0x9b
0012fff0 00000000 00404064 00000000 00000000 ccleaner+0x406e
FOLLOWUP_IP:
MSVBVM60!RaiseVbaException+23
660d0956 c9 leave
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: MSVBVM60!RaiseVbaException+23
MODULE_NAME: MSVBVM60
IMAGE_NAME: MSVBVM60.DLL
DEBUG_FLR_IMAGE_TIMESTAMP: 403acfec
STACK_COMMAND: .cxr 0x12f684; kb
FAILURE_BUCKET_ID: c000008f_MSVBVM60!RaiseVbaException+23
BUCKET_ID: c000008f_MSVBVM60!RaiseVbaException+23
Followup: MachineOwner
Additionally, here's the appcompat that dwwin generates:
CODE
<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="ccleaner.exe" FILTER="GRABMI_FILTER_PRIVACY">
<MATCHING_FILE NAME="ccleaner.dll" SIZE="49152" CHECKSUM="0xC2076D1C" BIN_FILE_VERSION="2.1.0.3" BIN_PRODUCT_VERSION="2.1.0.3" PRODUCT_VERSION="2, 1, 0, 3" FILE_DESCRIPTION="CCleaner" PRODUCT_NAME=" CCleaner" FILE_VERSION="2, 1, 0, 3" ORIGINAL_FILENAME="CCleaner.dll" INTERNAL_NAME="CCleaner" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="2.1.0.3" UPTO_BIN_PRODUCT_VERSION="2.1.0.3" LINK_DATE="05/12/2005 08:04:26" UPTO_LINK_DATE="05/12/2005 08:04:26" VER_LANGUAGE="English (United Kingdom) [0x809]" />
<MATCHING_FILE NAME="ccleaner.exe" SIZE="569344" CHECKSUM="0x1082AC4C" BIN_FILE_VERSION="1.29.0.295" BIN_PRODUCT_VERSION="1.29.0.295" PRODUCT_VERSION="1.29.0295" COMPANY_NAME="CCleaner.com" PRODUCT_NAME="CCleaner" FILE_VERSION="1.29.0295" ORIGINAL_FILENAME="ccleaner.exe" INTERNAL_NAME="ccleaner" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x98DF3" LINKER_VERSION="0x1001D" UPTO_BIN_FILE_VERSION="1.29.0.295" UPTO_BIN_PRODUCT_VERSION="1.29.0.295" LINK_DATE="04/28/2006 08:32:13" UPTO_LINK_DATE="04/28/2006 08:32:13" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="CCSubTimer.dll" SIZE="40960" CHECKSUM="0xD8AE4B74" BIN_FILE_VERSION="1.1.0.9" BIN_PRODUCT_VERSION="1.1.0.9" PRODUCT_VERSION="1.01.0009" COMPANY_NAME="Home" PRODUCT_NAME="CCSubTimer" FILE_VERSION="1.01.0009" ORIGINAL_FILENAME="CCSubTimer.dll" INTERNAL_NAME="CCSubTimer" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x13AA4" LINKER_VERSION="0x10001" UPTO_BIN_FILE_VERSION="1.1.0.9" UPTO_BIN_PRODUCT_VERSION="1.1.0.9" LINK_DATE="05/31/2005 10:31:32" UPTO_LINK_DATE="05/31/2005 10:31:32" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="CCSystem.dll" SIZE="57344" CHECKSUM="0xE28BAE2A" BIN_FILE_VERSION="1.0.0.6" BIN_PRODUCT_VERSION="1.0.0.6" PRODUCT_VERSION="1.00.0006" COMPANY_NAME="Company" PRODUCT_NAME="CCSystem" FILE_VERSION="1.00.0006" ORIGINAL_FILENAME="CCSystem.dll" INTERNAL_NAME="CCSystem" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xEBD4" LINKER_VERSION="0x10000" UPTO_BIN_FILE_VERSION="1.0.0.6" UPTO_BIN_PRODUCT_VERSION="1.0.0.6" LINK_DATE="09/27/2005 11:10:41" UPTO_LINK_DATE="09/27/2005 11:10:41" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="lang-1033.dll" SIZE="19968" CHECKSUM="0xCEAFB4A9" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="04/26/2006 09:40:42" UPTO_LINK_DATE="04/26/2006 09:40:42" />
<MATCHING_FILE NAME="uninst.exe" SIZE="55420" CHECKSUM="0x8CD5E3" MODULE_TYPE="WIN32" PE_CHECKSUM="0x69780" LINKER_VERSION="0x0" LINK_DATE="03/04/2006 17:05:36" UPTO_LINK_DATE="03/04/2006 17:05:36" />
</EXE>
<EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="kernel32.dll" SIZE="983552" CHECKSUM="0x4CE79457" BIN_FILE_VERSION="5.1.2600.2180" BIN_PRODUCT_VERSION="5.1.2600.2180" PRODUCT_VERSION="5.1.2600.2180" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFF848" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.2180" UPTO_BIN_PRODUCT_VERSION="5.1.2600.2180" LINK_DATE="08/04/2004 07:56:36" UPTO_LINK_DATE="08/04/2004 07:56:36" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="kernel32.dll" SIZE="983552" CHECKSUM="0x4CE79457" BIN_FILE_VERSION="5.1.2600.2180" BIN_PRODUCT_VERSION="5.1.2600.2180" PRODUCT_VERSION="5.1.2600.2180" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFF848" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.2180" UPTO_BIN_PRODUCT_VERSION="5.1.2600.2180" LINK_DATE="08/04/2004 07:56:36" UPTO_LINK_DATE="08/04/2004 07:56:36" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
</DATABASE>