We've been having a lot of event ID 37 with src W3SVC errors popping up. We
have 50+ sites in medium isolation, and i ran IISstate on the two instances
of DLLHOST and the one of inetinfo. Is there anything revealed by the three
logs below?
thank you in advance,
TC
Opened log file 'D:\emergency\output\IISState-3088.log'
***********************
Starting new log output
IISState version 3.3.1
Sun Aug 15 21:21:55 2004
OS = Windows 2000
Executable: dllhost.exe
PID = 3088
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: 3e8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0006fd50 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa701 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9f0f
ole32!CSurrogateProcessActivator::WaitForSurrogate Timeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c581af6 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
Thread ID: 1
System Thread ID: a64
Kernel Time: 0:0:0.78
User Time: 0:0:0.281
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
No remote call being made
# ChildEBP RetAddr
00 0087fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0087ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 2
System Thread ID: bc8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008bff5c 7c573a4e ntdll!NtDelayExecution+0xb
01 008bff7c 7c573a22 KERNEL32!SleepEx+0x32
02 008bff88 77ab8ffb KERNEL32!Sleep+0xb
03 008bff90 77ab50ee ole32!CROIDTable::WorkerThreadLoop+0xc
04 008bffa8 77ab5046 ole32!CRpcThread::WorkerLoop+0x22
05 008bffb4 7c57438b ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 3
System Thread ID: 904
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abbad5 USER32!NtUserGetMessage+0xb
01 008fff70 77abba23 ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abb95e ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab50ee ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab5046 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57438b ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 4
System Thread ID: 7a8
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0098fc54 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0098fc80 6de8b9d0 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b908 TxfAux!WORK_QUEUE::WorkerLoop+0xa0
03 0098ffb4 7c57438b TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 5
System Thread ID: d8c
Kernel Time: 0:0:0.93
User Time: 0:0:0.250
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
No remote call being made
# ChildEBP RetAddr
00 00a4fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 00a4ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a4ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a4ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a4ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 6
System Thread ID: 4ec
Kernel Time: 0:0:0.46
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00bcff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcff70 787f58ce KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57438b COMSVCS!CEventDispatcher::PushEvents+0x4e
04 00bcffc0 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 7
System Thread ID: 798
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
Remote call is either to a MTA object or object not initialized. Also,
possible utility thread.
DCOM call being made to Process ID: 1752
Waiting on thread id: ffffffff
# ChildEBP RetAddr
00 00c0fb68 77d4256d ntdll!ZwRequestWaitReplyPort+0xb
01 00c0fb94 77d3ac56 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 00c0fba0 77b25b87 RPCRT4!I_RpcSendReceive+0x2c
03 00c0fbc0 77b25a52 ole32!ThreadSendReceive+0xef
04 00c0fbd8 77b22ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+ 0x14f
05 00c0fc18 77b258c6 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 00c0fc28 77a6cb5d ole32!CRpcChannelBuffer::SendReceive+0x11
07 00c0fc88 77ab74c3 ole32!CAptRpcChnl::SendReceive+0xa9
08 00c0fce0 77d94c1a ole32!CCtxComChnl::SendReceive+0x124
09 00c0fcfc 77d9487d RPCRT4!NdrProxySendReceive+0x4c
0a 00c0ff44 77d95136 RPCRT4!NdrClientCall2+0x4f5
0b 00c0ff60 77d46e75 RPCRT4!ObjectStublessClient+0x76
0c 00c0ff70 787f5818 RPCRT4!ObjectStubless+0xf
0d 00c0ffb4 7c57438b
COMSVCS!CEventDispatcher::GetEventServerInfoThread +0x118
0e 00c0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 8
System Thread ID: 48c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00c4fee0 7c573a4e ntdll!NtDelayExecution+0xb
01 00c4ff00 7c573a22 KERNEL32!SleepEx+0x32
02 00c4ff0c 787d12aa KERNEL32!Sleep+0xb
03 00c4ff7c 780085bc COMSVCS!PostData+0xf2
04 00c4ff88 77ab779b MSVCRT!_endthreadex+0xc1
05 00000000 00000000 ole32!CCtxComChnl::FreeBuffer+0x3d
Thread ID: 9
System Thread ID: ca4
Kernel Time: 0:0:49.62
User Time: 0:0:25.859
Thread Type: Other
# ChildEBP RetAddr
00 00ecfe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00ecfeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00ecff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00ecff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 00ecff7c 780085bc IISRTL!SchedulerWorkerThread+0xa7
05 00ecffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 00ecffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 10
System Thread ID: abc
Kernel Time: 0:0:56.296
User Time: 0:0:25.718
Thread Type: Other
# ChildEBP RetAddr
00 00f0fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00f0feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00f0ff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00f0ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 00f0ff7c 780085bc IISRTL!SchedulerWorkerThread+0xa7
05 00f0ffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 11
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00fcff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00fcff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00fcffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00fcffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 12
System Thread ID: 7c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0093ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0093ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0093ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0093ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 13
System Thread ID: ac4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
No remote call being made
# ChildEBP RetAddr
00 0118feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0118fee4 77d31394 KERNEL32!GetQueuedCompletionStatus+0x27
02 0118ff20 77d3e93f RPCRT4!COMMON_ProcessCalls+0x9e
03 0118ff74 77d3e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0118ff78 77d35924 RPCRT4!ProcessIOEventsWrapper+0x9
05 0118ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
06 0118ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 0118ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 14
System Thread ID: 77c
Kernel Time: 0:0:0.78
User Time: 0:0:0.421
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
No remote call being made
# ChildEBP RetAddr
00 0120fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0120ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0120ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0120ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0120ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0120ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 15
System Thread ID: 738
Kernel Time: 0:0:0.78
User Time: 0:0:0.390
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page
No remote call being made
# ChildEBP RetAddr
00 0128fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0128ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0128ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0128ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0128ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0128ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 16
System Thread ID: 7c0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: Unable to locate ASP page
# ChildEBP RetAddr
00 01dafe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01dafec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01daff1c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01daff38 74a01e69 USER32!MsgWaitForMultipleObjects+0x1d
04 01daff7c 78008454 asp!CMTACallbackThread::Thread+0x42
05 01daffb4 7c57438b MSVCRT!_endthread+0xc6
06 01daffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 17
System Thread ID: 7b8
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export symbols
or -
Thread Type: PDM (Debugger) Thread.
# ChildEBP RetAddr
00 01e2fddc 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01e2fe2c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01e2fe88 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01e2fea4 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
04 01e2ff88 4a008a85 pdm+0x886c
05 01e2ffb0 4a008a09 pdm+0x8a85
06 01e2ffb4 7c57438b pdm+0x8a09
07 01e2ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 18
System Thread ID: 788
Kernel Time: 0:0:0.703
User Time: 0:0:5.796
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01e6fe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01e6fe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01e6fed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01e6fef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01e6ff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01e6ffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01e6ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 19
System Thread ID: 7ac
Kernel Time: 0:0:1.875
User Time: 0:0:19.156
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01eafe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01eafe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01eafed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01eafef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01eaff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01eaffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01eaffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 20
System Thread ID: 778
Kernel Time: 0:0:2.265
User Time: 0:0:20.359
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01eefe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01eefe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01eefed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01eefef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01eeff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01eeffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01eeffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 21
System Thread ID: 71c
Kernel Time: 0:0:1.968
User Time: 0:0:18.312
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01f2fe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01f2fe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01f2fed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01f2fef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01f2ff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01f2ffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01f2ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 22
System Thread ID: 6bc
Kernel Time: 0:0:2.390
User Time: 0:0:19.109
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01f6fe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01f6fe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01f6fed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01f6fef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01f6ff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01f6ffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01f6ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 23
System Thread ID: 7bc
Kernel Time: 0:0:1.812
User Time: 0:0:17.125
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01fafe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01fafe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01fafed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01fafef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01faff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01faffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01faffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 24
System Thread ID: 730
Kernel Time: 0:0:2.31
User Time: 0:0:19.593
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01fefe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01fefe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01fefed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01fefef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 01feff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 01feffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 01feffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 25
System Thread ID: 724
Kernel Time: 0:0:2.46
User Time: 0:0:18.468
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0202fe28 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0202fe78 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0202fed4 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0202fef0 787c3911 USER32!MsgWaitForMultipleObjects+0x1d
04 0202ff1c 787c2cc0 COMSVCS!STAThread::WaitForWork+0x33
05 0202ffb4 7c57438b COMSVCS!STAThread::STAThreadWorker+0x4e2
06 0202ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 26
System Thread ID: 720
Kernel Time: 0:0:0.109
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0208ff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 0208ffb4 7c57438b ntdll!RtlpTimerThread+0x42
02 0208ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 27
System Thread ID: 718
Kernel Time: 0:0:0.0
User Time: 0:0:0.140
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\Common Files\System\OLE DB\oledb32.dll -
Thread Type: Other
# ChildEBP RetAddr
00 02daff58 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02daff80 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02daff90 028d55a1 KERNEL32!WaitForSingleObject+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 02daffb4 7c57438b oledb32!DllGetClassObject+0x38eb
04 02daffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 28
System Thread ID: 714
Kernel Time: 0:0:0.15
User Time: 0:0:0.78
Thread Type: Other
# ChildEBP RetAddr
00 02deff50 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02deff78 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02deff88 028d5593 KERNEL32!WaitForSingleObject+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 02deffb4 7c57438b oledb32!DllGetClassObject+0x38dd
04 02deffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 29
System Thread ID: 6c8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 02e2fd54 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02e2fd7c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02e2fd8c 7878db85 KERNEL32!WaitForSingleObject+0xf
03 02e2ffb4 7c57438b COMSVCS!PingThread+0xf5
04 02e2ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 30
System Thread ID: 6b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 02f9ff88 751a4848 ntdll!ZwWaitForMultipleObjects+0xb
01 02f9ffb4 7c57438b NETAPI32!NetbiosWaiter+0x71
02 02f9ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 31
System Thread ID: 4dc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0363ff20 77f838a5 ntdll!ZwRemoveIoCompletion+0xb
01 0363ffb4 7c57438b ntdll!RtlpWorkerThread+0x6b
02 0363ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 32
System Thread ID: d5c
Kernel Time: 0:0:1.156
User Time: 0:0:20.375
*** WARNING: Unable to verify checksum for
Thread Type: Other
# ChildEBP RetAddr
00 041dff38 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 041dff64 040e4911 KERNEL32!GetQueuedCompletionStatus+0x27
02 041dffb4 7c57438b MivaIIS!MivaThreadProc+0x35
03 041dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 33
System Thread ID: be8
Kernel Time: 0:0:2.906
User Time: 0:0:51.937
Thread Type: Other
# ChildEBP RetAddr
00 0421ff38 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0421ff64 040e4911 KERNEL32!GetQueuedCompletionStatus+0x27
02 0421ffb4 7c57438b MivaIIS!MivaThreadProc+0x35
03 0421ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 34
System Thread ID: 600
Kernel Time: 0:0:0.31
User Time: 0:0:0.203
Thread Type: Other
# ChildEBP RetAddr
00 172fff60 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 172fff88 77ab510c KERNEL32!WaitForSingleObjectEx+0x71
02 172fffa8 77ab5046 ole32!CRpcThread::WorkerLoop+0x40
03 172fffb4 7c57438b ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
04 172fffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 35
System Thread ID: cdc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 17c2ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 17c2ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 17c2ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 36
System Thread ID: 774
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 17c6ff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 17c6ff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 17c6ff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 17c6ffb4 7c57438b USERENV!NotificationThread+0x5f
04 17c6ffec 00000000 KERNEL32!BaseThreadStart+0x52
*****
Dump name is formatted as: PID-Timestamp.dmp
Creating D:\emergency\output\3088-1092630121.dmp - mini user dump
*****
Closing open log file D:\emergency\output\IISState-3088.log
Opened log file 'D:\emergency\output\IISState-1752.log'
***********************
Starting new log output
IISState version 3.3.1
Sun Aug 15 21:21:50 2004
OS = Windows 2000
Executable: dllhost.exe
PID = 1752
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: 6d4
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0006fd50 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa701 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9f0f
ole32!CSurrogateProcessActivator::WaitForSurrogate Timeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c581af6 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
Thread ID: 1
System Thread ID: 6e0
Kernel Time: 0:0:0.515
User Time: 0:0:0.562
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0087fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0087ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 2
System Thread ID: 6e8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abbad5 USER32!NtUserGetMessage+0xb
01 008fff70 77abba23 ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abb95e ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab50ee ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab5046 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57438b ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 3
System Thread ID: 6f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc54 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0098fc80 6de8b9d0 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b908 TxfAux!WORK_QUEUE::WorkerLoop+0xa0
03 0098ffb4 7c57438b TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 4
System Thread ID: 6f8
Kernel Time: 0:0:0.31
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 78804961 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 78801f8c COMSVCS!CRMRecoveryClerk::RecoveryThread+0x49d
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8e
05 00a0ffb4 7c57438b MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 5
System Thread ID: 6fc
Kernel Time: 0:0:6.781
User Time: 0:0:14.359
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c573a4e ntdll!NtDelayExecution+0xb
01 00a4ff00 7c573a22 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d12aa KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57438b MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 6
System Thread ID: 6ec
Kernel Time: 0:0:0.343
User Time: 0:0:0.609
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 00a8fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 00a8ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 7
System Thread ID: 700
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787f011d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d32355 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d9356d RPCRT4!Invoke+0x30
05 00acf924 77d93a2c RPCRT4!NdrStubCall2+0x664
06 00acf988 77b24584 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b2485f ole32!SyncStubInvoke+0x61
08 00acfa14 77ab7881 ole32!StubInvoke+0xa8
09 00acfa78 77aa9c8f ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b24469 ole32!MTAInvoke+0x18
0b 00acfac4 77b24bab ole32!AppInvoke+0xb5
0c 00acfb84 77b248d7 ole32!ComInvokeWithLockAndIPID+0x2b5
0d 00acfba4 77ab3c3d ole32!ComInvoke+0x41
0e 00acfbb4 77b258ed ole32!ThreadDispatch+0x21
0f 00acfbc8 77b25937 ole32!DispatchCall+0x24
10 00acfbe0 77b22ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+ 0x34
11 00acfc20 77b258c6 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6cb5d ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab74c3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d94c1a ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d9487d RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95136 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d46e75 RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f2251 RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57438b COMSVCS!CEventServer::DispatchEvents+0x83
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 8
System Thread ID: 708
Kernel Time: 0:0:0.281
User Time: 0:0:0.515
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 00b4fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 00b4ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b4ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b4ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b4ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 00b4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 9
System Thread ID: 710
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b8ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 00b8ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 00b8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 10
System Thread ID: 784
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 00bcffb4 7c57438b ntdll!RtlpTimerThread+0x42
02 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52
*****
Dump name is formatted as: PID-Timestamp.dmp
Creating D:\emergency\output\1752-1092630112.dmp - mini user dump
*****
Closing open log file D:\emergency\output\IISState-1752.log
Opened log file 'D:\emergency\output\IISState-1564.log'
***********************
Starting new log output
IISState version 3.3.1
Sun Aug 15 21:22:11 2004
OS = Windows 2000
Executable: inetinfo.exe
PID = 1564
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: 618
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
Thread ID: 1
System Thread ID: 624
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
00 0059fd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0059fd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
04 0059ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
05 0059ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 2
System Thread ID: 638
Kernel Time: 0:2:10.218
User Time: 0:1:10.734
Thread Type: Other
# ChildEBP RetAddr
00 006dfe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 006dfeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 006dff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 006dffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 3
System Thread ID: 63c
Kernel Time: 0:2:10.265
User Time: 0:1:9.671
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 4
System Thread ID: 664
Kernel Time: 0:0:0.31
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 00e0fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e0fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e0fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e0fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e0fd30 6fc6b2f0 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e0fd70 01002440 ftpsvc2!ServiceEntry+0xc7
06 00e0ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e0ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 5
System Thread ID: 668
Kernel Time: 0:0:0.109
User Time: 0:0:0.140
Thread Type: Other
# ChildEBP RetAddr
00 00e4fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e4fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e4fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e4fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e4fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e4fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e4ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e4ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 6
System Thread ID: 670
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f0ff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f0ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
02 00f0ffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
03 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 7
System Thread ID: 674
Kernel Time: 0:0:38.140
User Time: 0:1:10.218
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f4ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00f4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00f4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 8
System Thread ID: 678
Kernel Time: 0:0:42.843
User Time: 0:1:12.484
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f8ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f8ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00f8ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00f8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 9
System Thread ID: 680
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0130fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0130ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0130ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0130ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f
04 0130ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0130ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 10
System Thread ID: 684
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0134fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0134fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0134fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0134ffb4 7c57438b RTUTILS!TraceServerThread+0xde
04 0134ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 11
System Thread ID: 688
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0139feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0139fee4 77d31394 KERNEL32!GetQueuedCompletionStatus+0x27
02 0139ff20 77d3e93f RPCRT4!COMMON_ProcessCalls+0x9e
03 0139ff74 77d3e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0139ff78 77d35924 RPCRT4!ProcessIOEventsWrapper+0x9
05 0139ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
06 0139ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 0139ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 12
System Thread ID: 68c
Kernel Time: 0:0:0.515
User Time: 0:0:0.421
Thread Type: Other
# ChildEBP RetAddr
00 013dff00 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 013dff50 75037871 KERNEL32!WaitForMultipleObjectsEx+0xea
02 013dff6c 6fc66e80 WS2_32!WSAWaitForMultipleEvents+0x18
03 013dffb4 7c57438b ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x39
04 013dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 13
System Thread ID: 2f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0141fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 0141fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0141fe08 750312f5 msafd!WSPSelect+0x24e
03 0141fe6c 6e2b3b6e WS2_32!select+0xe7
04 0141ffb4 7c57438b inetsloc!SocketListenThread+0x51
05 0141ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 14
System Thread ID: 2c0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0145fdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 0145fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0145ff24 750312f5 msafd!WSPSelect+0x24e
03 0145ff88 6d7075bd WS2_32!select+0xe7
04 0145ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 0145ffb4 7c57438b ISATQ!BmonThreadFunc+0x9
06 0145ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 15
System Thread ID: 5f8
Kernel Time: 0:0:0.796
User Time: 0:0:4.625
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0149ff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0149ff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0149ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0149ffb4 7c57438b compfilt!CompressionThread+0x29
04 0149ffc0 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 16
System Thread ID: 5fc
Kernel Time: 0:0:0.31
User Time: 0:0:0.93
Thread Type: Other
# ChildEBP RetAddr
00 0151fe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0151fec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0151ff1c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0151ff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 0151ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 0151ffb4 7c57438b MSVCRT!_endthread+0xc6
06 0151ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 17
System Thread ID: 604
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0155fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0155fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0155ff54 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0155ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 0155ffb4 7c57438b w3svc!OleHackThread+0x88
05 0155ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 18
System Thread ID: 6c0
Kernel Time: 0:0:40.578
User Time: 0:1:9.734
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 018dff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 018dff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 018dffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 018dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 19
System Thread ID: 6cc
Kernel Time: 0:0:49.250
User Time: 0:1:26.609
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0191ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0191ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0191ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0191ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 20
System Thread ID: 704
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for C:\Program
Files\WebTrends\SmartSource Data Collector\bin\iislogserver.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\Program Files\WebTrends\SmartSource Data Collector\bin\iislogserver.dll -
Thread Type: Other
# ChildEBP RetAddr
00 0195fe9c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0195feec 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0195ff04 1000ee6e KERNEL32!WaitForMultipleObjects+0x17
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0195ff7c 780085bc iislogserver!TerminateFilter+0xda7e
04 0195ffb4 7c57438b MSVCRT!_endthreadex+0xc1
05 0195ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 21
System Thread ID: 73c
Kernel Time: 0:0:32.984
User Time: 0:0:31.765
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0199fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0199ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0199ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0199ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f
04 0199ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0199ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 22
System Thread ID: 408
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01faebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 01faffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 01faffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 23
System Thread ID: 850
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01feff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01feff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 01feff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 01feffb4 7c57438b USERENV!NotificationThread+0x5f
04 01feffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 24
System Thread ID: 7b4
Kernel Time: 0:0:0.593
User Time: 0:0:0.406
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0267ff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0267ff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0267ff70 787f58ce KERNEL32!WaitForMultipleObjects+0x17
03 0267ffb4 7c57438b COMSVCS!CEventDispatcher::PushEvents+0x4e
04 0267ffc0 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 25
System Thread ID: 2d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
Remote call is either to a MTA object or object not initialized. Also,
possible utility thread.
DCOM call being made to Process ID: 1752
Waiting on thread id: ffffffff
# ChildEBP RetAddr
00 026bfb68 77d4256d ntdll!ZwRequestWaitReplyPort+0xb
01 026bfb94 77d3ac56 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 026bfba0 77b25b87 RPCRT4!I_RpcSendReceive+0x2c
03 026bfbc0 77b25a52 ole32!ThreadSendReceive+0xef
04 026bfbd8 77b22ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+ 0x14f
05 026bfc18 77b258c6 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 026bfc28 77a6cb5d ole32!CRpcChannelBuffer::SendReceive+0x11
07 026bfc88 77ab74c3 ole32!CAptRpcChnl::SendReceive+0xa9
08 026bfce0 77d94c1a ole32!CCtxComChnl::SendReceive+0x124
09 026bfcfc 77d9487d RPCRT4!NdrProxySendReceive+0x4c
0a 026bff44 77d95136 RPCRT4!NdrClientCall2+0x4f5
0b 026bff60 77d46e75 RPCRT4!ObjectStublessClient+0x76
0c 026bff70 787f5818 RPCRT4!ObjectStubless+0xf
0d 026bffb4 7c57438b
COMSVCS!CEventDispatcher::GetEventServerInfoThread +0x118
0e 026bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 26
System Thread ID: 848
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 027bfef8 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 027bff20 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 027bff30 67de6ddf KERNEL32!WaitForSingleObject+0xf
03 027bff70 67f6cf08 fp4amsft!VmetabaseSinkThread::t_main+0x102
04 027bff7c 780085bc fp4Autl!Vthread::top+0xd
05 027bffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 027bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 27
System Thread ID: 5d4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02e3ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02e3ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02e3ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02e3ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02e3ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 28
System Thread ID: 7cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02e7ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02e7ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02e7ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02e7ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02e7ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 29
System Thread ID: 770
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02ebff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02ebff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02ebff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02ebffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02ebffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 30
System Thread ID: 644
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02efff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02efff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02efff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02efffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02efffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 31
System Thread ID: 51c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02f3ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02f3ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02f3ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02f3ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02f3ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 32
System Thread ID: 84c
Kernel Time: 0:0:28.359
User Time: 0:0:45.578
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0307ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0307ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0307ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0307ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 33
System Thread ID: 888
Kernel Time: 0:0:0.890
User Time: 0:0:0.625
Thread Type: Other
# ChildEBP RetAddr
00 0312fc60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0312fcb0 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0312fcc8 6e901993 KERNEL32!WaitForMultipleObjects+0x17
03 0312ff54 6e9018d0 idq!CWQueryCache::ProcessCacheEvents+0xa4
04 0312ff7c 6e903b01 idq!CWQueryCache::WatchDogThread+0x2f
05 0312ffb4 7c57438b idq!CThread::_ThreadFunction+0x42
06 0312ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 34
System Thread ID: a4c
Kernel Time: 0:0:24.734
User Time: 0:0:21.906
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0499fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0499ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0499ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0499ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0499ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0499ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 35
System Thread ID: a34
Kernel Time: 0:0:24.906
User Time: 0:0:40.890
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 04d4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 04d4ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 04d4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 04d4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 36
System Thread ID: ae0
Kernel Time: 0:0:21.296
User Time: 0:0:19.312
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0508fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0508ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0508ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0508ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0508ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0508ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 37
System Thread ID: c40
Kernel Time: 0:0:1.265
User Time: 0:0:1.750
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 069aff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 069aff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 069affb4 7c57438b ISATQ!AtqPoolThread+0x40
03 069affec 00000000 KERNEL32!BaseThreadStart+0x52
*****
Dump name is formatted as: PID-Timestamp.dmp
Creating D:\emergency\output\1564-1092630134.dmp - mini user dump
*****
Closing open log file D:\emergency\output\IISState-1564.log
