> Hi,
>     I analyzed a user.dmp generated by Dr.Waton in NT4. It's quite wierd.
>         1. Windbg told me the last error occured in the Exe file. I
> unassemblied the exe file and found the error place was out of the code
> block(looks like in some place useless). Looks like some de{*filter*} or virus
> writing some information to the remain block. So the information of input
> parameter is no use.
>         2. The Windbg told me there's only one thread in the dump. But
> actually I don't think it's the only thread.
>         3. The stack seems to be totally destroy. I digged the stack and
> only found the only useful address - just the start of WinMainCrtStart.
>     Any advice would help.
>     Thanks.

> Regards,
> congling