Re: IIS 6 Multi-threaded Debugging Help with Events: 1009 and 1002 by rherring
rherring
Wed Aug 18 08:10:11 CDT 2004
Thanks Ken but my real problem is the fact that not all w3wp processes
crash. My processes get recycled every 1 minute. What I can do is
look in the event log at any event 1009, then I have the PID that
actually crashed.
I have run IISDump in this fashion but nothing looks bad (I think).
Any ideas?
Here is the log file created from IISDump:
***************************** START OF FILE
*******************************
Opened log file '\\?\C:\IISDebugTools\logs\20040817-161955\8128_w3wp_DefaultAppPool.log'
0:000> !iisdbg.dump -ma Hang
.dump /c "Generated by IISDBG" -ma
\\?\C:\IISDebugTools\logs\20040817-161955\Hang--8128_w3wp_DefaultAppPool.dmp
0:000> .time
Debug session time: Tue Aug 17 16:21:20 2004
System Uptime: 0 days 1:58:58.554
Process Uptime: 0 days 0:02:36.688
Kernel time: 0 days 0:00:00.484
User time: 0 days 0:00:01.000
0:000> !version
Version 5.2 (Build 3790) Uniprocessor Free
0:000> !iisdbg.clientconns
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for c:\windows\system32\inetsrv\w3dt.dll -
=============================
Item# 1, UL_NATIVE_REQUEST = D31E90
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 2, UL_NATIVE_REQUEST = D33CE8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 3, UL_NATIVE_REQUEST = D35B40
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 4, UL_NATIVE_REQUEST = D37998
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 5, UL_NATIVE_REQUEST = D397F0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 6, UL_NATIVE_REQUEST = D3B648
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 7, UL_NATIVE_REQUEST = D3D4A0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 8, UL_NATIVE_REQUEST = D3F2F8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 9, UL_NATIVE_REQUEST = D41150
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 10, UL_NATIVE_REQUEST = D42FA8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 11, UL_NATIVE_REQUEST = D44E00
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 12, UL_NATIVE_REQUEST = D46C58
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 13, UL_NATIVE_REQUEST = D48AB0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 14, UL_NATIVE_REQUEST = D4A908
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 15, UL_NATIVE_REQUEST = D4C760
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 16, UL_NATIVE_REQUEST = D4E5B8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 17, UL_NATIVE_REQUEST = D50410
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 18, UL_NATIVE_REQUEST = D52268
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 19, UL_NATIVE_REQUEST = D540C0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 20, UL_NATIVE_REQUEST = D55F18
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 21, UL_NATIVE_REQUEST = D57D70
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 22, UL_NATIVE_REQUEST = D59BC8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 23, UL_NATIVE_REQUEST = D5BA20
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 24, UL_NATIVE_REQUEST = D5D878
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 25, UL_NATIVE_REQUEST = D5F6D0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 26, UL_NATIVE_REQUEST = D61528
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 27, UL_NATIVE_REQUEST = D63380
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 28, UL_NATIVE_REQUEST = D651D8
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 29, UL_NATIVE_REQUEST = D67030
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 30, UL_NATIVE_REQUEST = D68E88
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
=============================
Item# 31, UL_NATIVE_REQUEST = D6ACE0
Request State: 1 (NREQ_STATE_READ)
** Still reading client request
0:000> !runaway
User Mode Time
Thread Time
164c 0 days 0:00:00.687
d84 0 days 0:00:00.187
a48 0 days 0:00:00.078
1718 0 days 0:00:00.046
129c 0 days 0:00:00.000
17ec 0 days 0:00:00.000
12ac 0 days 0:00:00.000
1640 0 days 0:00:00.000
15f4 0 days 0:00:00.000
a50 0 days 0:00:00.000
15c 0 days 0:00:00.000
1d74 0 days 0:00:00.000
15f8 0 days 0:00:00.000
12a4 0 days 0:00:00.000
1fa0 0 days 0:00:00.000
fe4 0 days 0:00:00.000
1a3c 0 days 0:00:00.000
1820 0 days 0:00:00.000
1ed0 0 days 0:00:00.000
7d4 0 days 0:00:00.000
678 0 days 0:00:00.000
0:000> !locks
NTSDEXTS: Unable to resolve ntdll!RtlCriticalSectionList
NTSDEXTS: Please check your symbols
0:000> !handle 0 0
350 Handles
Type Count
None 2
Event 187
Section 2
File 26
Port 8
Directory 2
Mutant 50
WindowStation 3
Semaphore 9
Key 16
Token 3
Process 1
Thread 28
Desktop 2
IoCompletion 8
Timer 2
KeyedEvent 1
0:000> lmv
start end module name
01000000 01004000 w3wp (deferred)
Image path: c:\windows\system32\inetsrv\w3wp.exe
Timestamp: Tue Mar 25 02:10:30 2003 (3E8000E6) Checksum: 000064E6
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3wp.exe
OriginalFilename: w3wp.exe
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Worker Process
LegalCopyright: © Microsoft Corporation. All rights reserved.
01b30000 01bcf000 NSLDAPSSL32V41 (deferred)
Image path: C:\WINDOWS\system32\NSLDAPSSL32V41.dll
Timestamp: Mon Sep 25 06:06:36 2000 (39CF23AC) Checksum: 00000000
File version: 16512.0.0.10521
Product version: 4.0.0.0
File flags: 2 (Mask 3F) Pre-release
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
CompanyName: iPlanet A Sun|Netscape Alliance
ProductName: Lightweight Directory Access Protocol DLL
InternalName: LDAP3241
OriginalFilename: LDAP3241.DLL
ProductVersion: 4.1
FileVersion: 4.1 Build 10521
FileDescription: Lightweight Directory Access Protocol DLL
LegalCopyright: Copyright (c) 2000 Sun Microsystems, Inc. Some
preexisting portions Copyright (c) 2000 Netscape Communications Corp.
All rights\StringFileInfo\040904e4\LegalCopyright
01bd0000 01c07000 libnspr3 (deferred)
Image path: C:\WINDOWS\system32\libnspr3.dll
Timestamp: Wed Nov 10 14:17:37 1999 (3829C4D1) Checksum: 00000000
File version: 3.5.1.0
Product version: 3.5.1.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Netscape Communications Corporation
ProductName: Netscape Communication Corporation NSPR20
InternalName: libnspr3
OriginalFilename: libnspr3.dll
ProductVersion: 3.5.1
FileVersion: 3.5.1
FileDescription: Netscape Portable Run Time
LegalCopyright: Copyright © 1996
01c10000 01c17000 libplds3 (deferred)
Image path: C:\WINDOWS\system32\libplds3.dll
Timestamp: Wed Nov 10 14:17:41 1999 (3829C4D5) Checksum: 00000000
File version: 3.5.1.0
Product version: 3.5.1.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Netscape Communications Corporation
ProductName: Netscape Communication Corporation NSPR20
InternalName: libnspr3
OriginalFilename: libnspr3.dll
ProductVersion: 3.5.1
FileVersion: 3.5.1
FileDescription: Netscape Portable Run Time
LegalCopyright: Copyright © 1996
01c20000 01cc9000 LIBEAY32 (deferred)
Image path: C:\WINDOWS\system32\LIBEAY32.dll
Timestamp: Fri Oct 04 14:42:17 2002 (3D9DE109) Checksum: 00000000
01cd0000 01cf6000 SSLEAY32 (deferred)
Image path: C:\WINDOWS\system32\SSLEAY32.dll
Timestamp: Fri Oct 04 14:43:07 2002 (3D9DE13B) Checksum: 00000000
0ffd0000 0fffd000 rsaenh (deferred)
Image path: C:\WINDOWS\system32\rsaenh.dll
Timestamp: Tue Mar 25 04:46:22 2003 (3E80256E) Checksum: 00039FD2
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: rsaenh.dll
OriginalFilename: rsaenh.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Microsoft Enhanced Cryptographic Provider
LegalCopyright: © Microsoft Corporation. All rights reserved.
10000000 100a2000 ds_wac_iis (deferred)
Image path: C:\Program Files\filter\myFilter.dll
Timestamp: Thu Aug 05 15:46:05 2004 (41128E7D) Checksum: 00000000
File version: 5.1.0.3
Product version: 5.1.0.3
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: MyCompany
ProductName: IIS Filter
InternalName: myFilter.dll
OriginalFilename: myFilter.dll
ProductVersion: 1,1,0,3
FileVersion: 1,1,0,3
PrivateBuild: 5103withTrace 5103999
SpecialBuild: 5103withTrace 5103999
FileDescription: IIS Filter
LegalCopyright: Copyright © 2003
LegalTrademarks: Copyright © 2003
Comments: Copyright © 2003
30000000 30007000 libplc3 (deferred)
Image path: C:\WINDOWS\system32\libplc3.dll
Timestamp: Wed Nov 10 14:17:45 1999 (3829C4D9) Checksum: 00000000
File version: 3.5.1.0
Product version: 3.5.1.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Netscape Communications Corporation
ProductName: Netscape Communication Corporation NSPR20
InternalName: libnspr3
OriginalFilename: libnspr3.dll
ProductVersion: 3.5.1
FileVersion: 3.5.1
FileDescription: Netscape Portable Run Time
LegalCopyright: Copyright © 1996
5a120000 5a130000 wamreg (deferred)
Image path: c:\windows\system32\inetsrv\wamreg.DLL
Timestamp: Tue Mar 25 04:46:11 2003 (3E802563) Checksum: 000144C0
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: wamreg.dll
OriginalFilename: wamreg.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: WAM Registration DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a300000 5a307000 W3TP (deferred)
Image path: c:\windows\system32\inetsrv\W3TP.dll
Timestamp: Tue Mar 25 04:46:02 2003 (3E80255A) Checksum: 00004259
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3tp.dll
OriginalFilename: w3tp.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Thread Pool Library
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a320000 5a333000 w3isapi (deferred)
Image path: c:\windows\system32\inetsrv\w3isapi.dll
Timestamp: Tue Mar 25 04:46:00 2003 (3E802558) Checksum: 000158BE
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3isapi.dll
OriginalFilename: w3isapi.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS ISAPI Handler
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a360000 5a36c000 w3dt (export symbols)
c:\windows\system32\inetsrv\w3dt.dll
Loaded symbol image file: c:\windows\system32\inetsrv\w3dt.dll
Image path: c:\windows\system32\inetsrv\w3dt.dll
Timestamp: Tue Mar 25 04:45:58 2003 (3E802556) Checksum: 000135B4
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3dt.dll
OriginalFilename: w3dt.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Worker Process/Http.sys Interface
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a390000 5a3e5000 w3core (deferred)
Image path: c:\windows\system32\inetsrv\w3core.dll
Timestamp: Tue Mar 25 04:45:55 2003 (3E802553) Checksum: 0005CA57
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3core.dll
OriginalFilename: w3core.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Web Server Core
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a3f0000 5a3f6000 W3COMLOG (deferred)
Image path: c:\windows\system32\inetsrv\W3COMLOG.dll
Timestamp: Tue Mar 25 04:45:54 2003 (3E802552) Checksum: 0000349A
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3comlog.dll
OriginalFilename: w3comlog.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: Microsoft IIS Common Logging Interface DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
5a400000 5a409000 W3CACHE (deferred)
Image path: c:\windows\system32\inetsrv\W3CACHE.dll
Timestamp: Tue Mar 25 04:45:54 2003 (3E802552) Checksum: 0000F04F
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3cache.dll
OriginalFilename: w3cache.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: Tsunami Cache III
LegalCopyright: © Microsoft Corporation. All rights reserved.
5b640000 5b655000 strmfilt (deferred)
Image path: C:\WINDOWS\system32\strmfilt.dll
Timestamp: Tue Mar 25 04:45:59 2003 (3E802557) Checksum: 0001BEBD
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: streamfilt.dll
OriginalFilename: streamfilt.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: Stream Filter Library
LegalCopyright: © Microsoft Corporation. All rights reserved.
62da0000 62da7000 LONSINT (deferred)
Image path: c:\windows\system32\inetsrv\LONSINT.dll
Timestamp: Tue Mar 25 04:45:10 2003 (3E802526) Checksum: 00007AE6
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: lonsint.dll
OriginalFilename: lonsint.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS NT specific library
LegalCopyright: © Microsoft Corporation. All rights reserved.
64700000 64731000 IISUTIL (deferred)
Image path: c:\windows\system32\inetsrv\IISUTIL.dll
Timestamp: Tue Mar 25 04:45:48 2003 (3E80254C) Checksum: 0002CA93
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: iisutil.dll
OriginalFilename: iisutil.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IISUTIL
LegalCopyright: © Microsoft Corporation. All rights reserved.
647b0000 647d4000 IisRTL (deferred)
Image path: C:\WINDOWS\system32\IisRTL.DLL
Timestamp: Tue Mar 25 04:45:44 2003 (3E802548) Checksum: 0002D5D4
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: iisrtl.dll
OriginalFilename: iisrtl.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS RunTime Library
LegalCopyright: © Microsoft Corporation. All rights reserved.
647f0000 64810000 iisres (deferred)
Image path: c:\windows\system32\inetsrv\iisres.dll
Timestamp: Tue Mar 25 04:45:42 2003 (3E802546) Checksum: 00025FB6
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: iisres.dll
OriginalFilename: iisres.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Resource DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
64830000 64840000 IISMAP (deferred)
Image path: C:\WINDOWS\system32\IISMAP.dll
Timestamp: Tue Mar 25 04:45:40 2003 (3E802544) Checksum: 00019680
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: iismap.dll
OriginalFilename: iismap.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: Microsoft IIS client certificate mapper
LegalCopyright: © Microsoft Corporation. All rights reserved.
67150000 6715a000 HTTPAPI (deferred)
Image path: C:\WINDOWS\system32\HTTPAPI.dll
Timestamp: Tue Mar 25 04:45:42 2003 (3E802546) Checksum: 0000D3C0
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: httpapi.dll
OriginalFilename: httpapi.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: HTTP Protocol Stack API
LegalCopyright: © Microsoft Corporation. All rights reserved.
67300000 67311000 IISCHAgent (deferred)
Image path: \\?\C:\IISDebugTools\IISCHAgent.dll
Timestamp: Mon Jul 14 18:11:16 2003 (3F132A84) Checksum: 00015259
File version: 2003.7.14.1
Product version: 1.1.0.3800
File flags: 0 (Mask 3F)
File OS: 5 Unknown Base
File type: 1.0 App
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: IIS Debug Tools
OriginalFilename: iischagent.dll
ProductVersion: 01.01.00.3800
FileVersion: 2003.07.14.01
FileDescription: IIS crash and hang monitoring agent.
LegalCopyright: Copyright (c) 2003 Microsoft Corporation. All
rights reserved.
685b0000 685b9000 gzip (deferred)
Image path: C:\WINDOWS\system32\inetsrv\gzip.dll
Timestamp: Tue Mar 25 04:44:36 2003 (3E802504) Checksum: 0000E5E5
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: gzip.dll
OriginalFilename: gzip.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: GZIP Compression DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
71430000 71440000 ADMWPROX (deferred)
Image path: C:\WINDOWS\system32\ADMWPROX.DLL
Timestamp: Tue Mar 25 04:43:40 2003 (3E8024CC) Checksum: 00011FD7
File version: 6.0.3790.0
Product version: 6.0.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: admwprox.dll
OriginalFilename: admwprox.dll
ProductVersion: 6.0.3790.0
FileVersion: 6.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: IIS Admin Com API Proxy dll
LegalCopyright: © Microsoft Corporation. All rights reserved.
71ae0000 71ae8000 wshtcpip (deferred)
Image path: C:\WINDOWS\System32\wshtcpip.dll
Timestamp: Tue Mar 25 04:43:27 2003 (3E8024BF) Checksum: 00004BA1
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: wshtcpip.dll
OriginalFilename: wshtcpip.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows Sockets Helper DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
71b20000 71b63000 mswsock (deferred)
Image path: C:\WINDOWS\System32\mswsock.dll
Timestamp: Tue Mar 25 04:43:27 2003 (3E8024BF) Checksum: 0004B77C
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: mswsock.dll
OriginalFilename: mswsock.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Microsoft Windows Sockets 2.0 Service Provider
LegalCopyright: © Microsoft Corporation. All rights reserved.
71bb0000 71bb9000 WSOCK32 (deferred)
Image path: C:\WINDOWS\system32\WSOCK32.dll
Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00011E19
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: wsock32.dll
OriginalFilename: wsock32.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows Socket 32-Bit DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
71bd0000 71be1000 mpr (deferred)
Image path: C:\WINDOWS\system32\mpr.dll
Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00018F0B
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: mpr.dll
OriginalFilename: mpr.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Multiple Provider Router DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
71bf0000 71bf8000 WS2HELP (deferred)
Image path: C:\WINDOWS\system32\WS2HELP.dll
Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 0000B6AB
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ws2help.dll
OriginalFilename: ws2help.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows Socket 2.0 Helper for Windows NT
LegalCopyright: © Microsoft Corporation. All rights reserved.
71c00000 71c18000 WS2_32 (deferred)
Image path: C:\WINDOWS\system32\WS2_32.dll
Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00022613
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ws2_32.dll
OriginalFilename: ws2_32.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows Socket 2.0 32-Bit DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
71c40000 71c93000 NETAPI32 (deferred)
Image path: C:\WINDOWS\system32\NETAPI32.dll
Timestamp: Tue Mar 25 04:43:26 2003 (3E8024BE) Checksum: 00058483
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: NetApi32.DLL
OriginalFilename: NetApi32.DLL
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Net Win32 API DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
76190000 761a2000 MSASN1 (deferred)
Image path: C:\WINDOWS\system32\MSASN1.dll
Timestamp: Mon Mar 15 21:00:27 2004 (40565FBB) Checksum: 00011C0E
File version: 5.2.3790.139
Product version: 5.2.3790.139
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: msasn1.dll
OriginalFilename: msasn1.dll
ProductVersion: 5.2.3790.139
FileVersion: 5.2.3790.139 (srv03_gdr.040116-1702)
FileDescription: ASN.1 Runtime APIs
LegalCopyright: © Microsoft Corporation. All rights reserved.
761b0000 76248000 CRYPT32 (deferred)
Image path: C:\WINDOWS\system32\CRYPT32.dll
Timestamp: Tue Mar 25 04:42:56 2003 (3E8024A0) Checksum: 0009E077
File version: 5.131.3790.0
Product version: 5.131.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: CRYPT32.DLL
OriginalFilename: CRYPT32.DLL
ProductVersion: 5.131.3790.0
FileVersion: 5.131.3790.0 (srv03_rtm.030324-2048)
FileDescription: Crypto API32
LegalCopyright: © Microsoft Corporation. All rights reserved.
76300000 76514000 msi (deferred)
Image path: C:\WINDOWS\system32\msi.dll
Timestamp: Tue Mar 25 04:42:54 2003 (3E80249E) Checksum: 002140A0
File version: 2.0.3790.0
Product version: 2.0.3790.0
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Windows Installer - Unicode
InternalName: msi
OriginalFilename: msi.dll
ProductVersion: 2.0.3790.0
FileVersion: 2.0.3790.0
FileDescription: Windows Installer
LegalCopyright: © Microsoft Corporation. All rights reserved.
76aa0000 76acc000 WINMM (deferred)
Image path: C:\WINDOWS\system32\WINMM.dll
Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 000384CD
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: winmm.dll
OriginalFilename: WINMM.DLL
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: MCI API DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
76b70000 76b7b000 PSAPI (deferred)
Image path: C:\WINDOWS\system32\PSAPI.DLL
Timestamp: Tue Mar 25 04:42:52 2003 (3E80249C) Checksum: 0000E560
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: PSAPI
OriginalFilename: PSAPI
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Process Status Helper
LegalCopyright: © Microsoft Corporation. All rights reserved.
76ed0000 76ef7000 DNSAPI (deferred)
Image path: C:\WINDOWS\system32\DNSAPI.dll
Timestamp: Tue Mar 25 04:42:50 2003 (3E80249A) Checksum: 0002E8A2
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: dnsapi
OriginalFilename: dnsapi
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: DNS Client API DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
76f10000 76f3f000 WLDAP32 (deferred)
Image path: C:\WINDOWS\system32\WLDAP32.dll
Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 0002C4D2
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: WLDAP32.DLL
OriginalFilename: WLDAP32.DLL
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Win32 LDAP API DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
76f50000 76f63000 Secur32 (deferred)
Image path: C:\WINDOWS\system32\Secur32.dll
Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 0001508D
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: security.dll
OriginalFilename: security.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Security Support Provider Interface
LegalCopyright: © Microsoft Corporation. All rights reserved.
76f70000 76f77000 winrnr (deferred)
Image path: C:\WINDOWS\System32\winrnr.dll
Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 00007C95
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: winrnr
OriginalFilename: winrnr
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: LDAP RnR Provider DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
76f80000 76f85000 rasadhlp (deferred)
Image path: C:\WINDOWS\system32\rasadhlp.dll
Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 00002272
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: rasadhlp.dll
OriginalFilename: rasadhlp.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Remote Access AutoDial Helper
LegalCopyright: © Microsoft Corporation. All rights reserved.
76f90000 7700e000 CLBCatQ (deferred)
Image path: C:\WINDOWS\system32\CLBCatQ.DLL
Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000837A0
File version: 2001.12.4720.130
Product version: 5.2.3790.130
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: CLBCATQ.DLL
OriginalFilename: CLBCATQ.DLL
ProductVersion: 5.2.3790.130
FileVersion: 2001.12.4720.130 (srv03_gdr.040116-1702)
FileDescription: COM+ Configuration Catalog
LegalCopyright: © Microsoft Corporation. All rights reserved.
77010000 770d6000 COMRes (deferred)
Image path: C:\WINDOWS\system32\COMRes.dll
Timestamp: Tue Mar 25 04:42:49 2003 (3E802499) Checksum: 000C4402
File version: 2001.12.4720.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: COMRES.DLL
OriginalFilename: COMRES.DLL
ProductVersion: 5.2.3790.0
FileVersion: 2001.12.4720.0 (srv03_rtm.030324-2048)
FileDescription: COM+ Resources
LegalCopyright: © Microsoft Corporation. All rights reserved.
770e0000 7715d000 OLEAUT32 (deferred)
Image path: C:\WINDOWS\system32\OLEAUT32.dll
Timestamp: Tue Mar 25 04:42:48 2003 (3E802498) Checksum: 0007D084
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
InternalName: OLEAUT32.DLL
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0
LegalCopyright: Copyright © Microsoft Corp. 1993-2001.
LegalTrademarks: Microsoft® is a registered trademark of
Microsoft Corporation. Windows® is a registered trademark of Microsoft
Corporation.
77160000 77285000 ole32 (deferred)
Image path: C:\WINDOWS\system32\ole32.dll
Timestamp: Mon Mar 15 22:08:56 2004 (40566FC8) Checksum: 00129304
File version: 5.2.3790.138
Product version: 5.2.3790.138
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: OLE32.DLL
OriginalFilename: OLE32.DLL
ProductVersion: 5.2.3790.138
FileVersion: 5.2.3790.138 (srv03_gdr.040116-1702)
FileDescription: Microsoft OLE for Windows
LegalCopyright: © Microsoft Corporation. All rights reserved.
77290000 772d9000 SHLWAPI (deferred)
Image path: C:\WINDOWS\system32\SHLWAPI.dll
Timestamp: Thu Jul 08 20:25:08 2004 (40EDE5E4) Checksum: 000521B7
File version: 6.0.3790.186
Product version: 6.0.3790.186
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: SHLWAPI
OriginalFilename: SHLWAPI.DLL
ProductVersion: 6.00.3790.186
FileVersion: 6.00.3790.186 (srv03_gdr.040410-1234)
FileDescription: Shell Light-weight Utility Library
LegalCopyright: © Microsoft Corporation. All rights reserved.
77b90000 77b98000 VERSION (deferred)
Image path: C:\WINDOWS\system32\VERSION.dll
Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0000CD51
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: version
OriginalFilename: VERSION.DLL
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Version Checking and File Installation Libraries
LegalCopyright: © Microsoft Corporation. All rights reserved.
77ba0000 77bf4000 msvcrt (deferred)
Image path: C:\WINDOWS\system32\msvcrt.dll
Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 0005D4DB
File version: 7.0.3790.0
Product version: 6.1.8638.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: msvcrt.dll
OriginalFilename: msvcrt.dll
ProductVersion: 7.0.3790.0
FileVersion: 7.0.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows NT CRT DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
77c00000 77c44000 GDI32 (deferred)
Image path: C:\WINDOWS\system32\GDI32.dll
Timestamp: Tue Mar 25 04:42:46 2003 (3E802496) Checksum: 00042EEA
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: gdi32
OriginalFilename: gdi32
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: GDI Client DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
77c50000 77cf5000 RPCRT4 (deferred)
Image path: C:\WINDOWS\system32\RPCRT4.dll
Timestamp: Mon Mar 15 22:08:57 2004 (40566FC9) Checksum: 000A240C
File version: 5.2.3790.137
Product version: 5.2.3790.137
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: rpcrt4.dll
OriginalFilename: rpcrt4.dll
ProductVersion: 5.2.3790.137
FileVersion: 5.2.3790.137 (srv03_gdr.040116-1702)
FileDescription: Remote Procedure Call Runtime
LegalCopyright: © Microsoft Corporation. All rights reserved.
77d00000 77d8f000 USER32 (deferred)
Image path: C:\WINDOWS\system32\USER32.dll
Timestamp: Wed Aug 06 17:43:59 2003 (3F31769F) Checksum: 0008FBF9
File version: 5.2.3790.73
Product version: 5.2.3790.73
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: user32
OriginalFilename: user32
ProductVersion: 5.2.3790.73
FileVersion: 5.2.3790.73 (srv03_gdr.030614-1004)
FileDescription: Windows USER API Client DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
77da0000 77e30000 ADVAPI32 (deferred)
Image path: C:\WINDOWS\system32\ADVAPI32.dll
Timestamp: Tue Mar 25 04:42:45 2003 (3E802495) Checksum: 00097775
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: advapi32.dll
OriginalFilename: advapi32.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Advanced Windows 32 Base API
LegalCopyright: © Microsoft Corporation. All rights reserved.
77e40000 77f34000 kernel32 (deferred)
Image path: C:\WINDOWS\system32\kernel32.dll
Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000F488C
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: kernel32
OriginalFilename: kernel32
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: Windows NT BASE API Client DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
77f40000 77ffa000 ntdll (export symbols)
C:\WINDOWS\system32\ntdll.dll
Loaded symbol image file: C:\WINDOWS\system32\ntdll.dll
Image path: C:\WINDOWS\system32\ntdll.dll
Timestamp: Tue Mar 25 04:42:44 2003 (3E802494) Checksum: 000B6DBA
File version: 5.2.3790.0
Product version: 5.2.3790.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 5.2.3790.0
FileVersion: 5.2.3790.0 (srv03_rtm.030324-2048)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
780c0000 78121000 MSVCP60 (deferred)
Image path: C:\WINDOWS\system32\MSVCP60.dll
Timestamp: Wed May 29 17:00:05 2002 (3CF54155) Checksum: 0006243E
File version: 6.5.2144.0
Product version: 6.5.2144.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
CompanyName: Microsoft Corporation
ProductName: Microsoft (R) Visual C++
InternalName: MSVCP60.DLL
OriginalFilename: MSVCP60.DLL
ProductVersion: 6.05.2144.0
FileVersion: 6.05.2144.0
FileDescription: Microsoft (R) C++ Runtime Library
LegalCopyright: Copyright (C) Microsoft Corp. 1981-2002
Unloaded modules:
0:000> ~*kv50
. 0 Id: 1fc0.1718 Suspend: 1 Teb: 7ffde000 Unfrozen
ChildEBP RetAddr Args to Child
0006fe58 77f43741 77e41817 00000150 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\kernel32.dll -
WARNING: Stack unwind information not available. Following frames may
be wrong.
0006fecc 77e4168f 00000150 ffffffff 00000000
ntdll!NtWaitForSingleObject+0xc
010012a0 72617453 00000074 6f727245 6f6c2072
kernel32!WaitForSingleObject+0xf
33576c55 00000000 00000000 00000000 00000000 0x72617453
1 Id: 1fc0.678 Suspend: 1 Teb: 7ffdd000 Unfrozen
ChildEBP RetAddr Args to Child
0097fea0 77f4372d 77f6c86c 00000002 0097fef0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
0097ff48 77f6d7f5 00000002 0097ff70 00000000
ntdll!ZwWaitForMultipleObjects+0xc
0097ffb8 77e4a990 00000000 00000000 00000000
ntdll!EtwRegisterTraceGuidsW+0x8e3
0097ffec 00000000 77f6d651 00000000 00000000
kernel32!FlsSetValue+0x779
2 Id: 1fc0.7d4 Suspend: 1 Teb: 7ffdc000 Unfrozen
ChildEBP RetAddr Args to Child
009bff9c 77f4262b 77f6b5b2 00000001 009bffb0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
009bffb8 77e4a990 00000000 00000000 00000000
ntdll!NtDelayExecution+0xc
009bffec 00000000 77f6b56d 00000000 00000000
kernel32!FlsSetValue+0x779
3 Id: 1fc0.1ed0 Suspend: 1 Teb: 7ffdb000 Unfrozen
ChildEBP RetAddr Args to Child
009fff70 77f430c7 77f7e6ae 000000c0 009fffb0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
009fffb8 77e4a990 00000000 00000000 00000000
ntdll!ZwRemoveIoCompletion+0xc
009fffec 00000000 77f7e673 00000000 00000000
kernel32!FlsSetValue+0x779
4 Id: 1fc0.1820 Suspend: 1 Teb: 7ffda000 Unfrozen
ChildEBP RetAddr Args to Child
00a6fe20 77f4313f 77c57b85 00000108 00a6ff7c
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\system32\RPCRT4.dll -
WARNING: Stack unwind information not available. Following frames may
be wrong.
00a6ff8c 77c60829 77c60771 00099c48 00000000
ntdll!NtReplyWaitReceivePortEx+0xc
00a6ffb0 77c60857 00089f98 77e4a990 00099e88
RPCRT4!NdrRangeUnmarshall+0x5a9
00a6ffec 00000000 77c60840 00099e88 00000000
RPCRT4!NdrRangeUnmarshall+0x5d7
5 Id: 1fc0.1a3c Suspend: 1 Teb: 7ffd9000 Unfrozen
ChildEBP RetAddr Args to Child
00aaff10 77f4262b 77e418ea 00000000 00aaff54
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
00aaff7c 77e416ee 0000ea60 00000000 77162501
ntdll!NtDelayExecution+0xc
00000000 00000000 00000000 00000000 00000000 kernel32!Sleep+0xb
6 Id: 1fc0.fe4 Suspend: 1 Teb: 7ffd8000 Unfrozen
ChildEBP RetAddr Args to Child
00c6ff28 77f430c7 77e430bc 00000148 00c6ff84
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for c:\windows\system32\inetsrv\W3TP.dll -
WARNING: Stack unwind information not available. Following frames may
be wrong.
00c6ff58 5a302360 00000148 00c6ff80 00c6ff84
ntdll!ZwRemoveIoCompletion+0xc
00c6ff90 5a302531 00000000 002682c8 00c6ffec
W3TP!THREAD_POOL::PostCompletion+0x78
00c6ffec 00000000 5a301cf2 002682c8 00000000
W3TP!THREAD_POOL::~THREAD_POOL+0x11c
7 Id: 1fc0.a48 Suspend: 1 Teb: 7ffd7000 Unfrozen
ChildEBP RetAddr Args to Child
00caff28 77f430c7 77e430bc 00000148 00caff84
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
00caff58 5a302360 00000148 00caff80 00caff84
ntdll!ZwRemoveIoCompletion+0xc
00caff90 5a302531 00000000 002682e8 00caffec
W3TP!THREAD_POOL::PostCompletion+0x78
00caffec 00000000 5a301cf2 002682e8 00000000
W3TP!THREAD_POOL::~THREAD_POOL+0x11c
8 Id: 1fc0.164c Suspend: 1 Teb: 7ffd6000 Unfrozen
ChildEBP RetAddr Args to Child
00ceff28 77f430c7 77e430bc 00000148 00ceff84
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
00ceff58 5a302360 00000148 00ceff80 00ceff84
ntdll!ZwRemoveIoCompletion+0xc
00ceff90 5a302531 00000000 00268308 00ceffec
W3TP!THREAD_POOL::PostCompletion+0x78
00ceffec 00000000 5a301cf2 00268308 00000000
W3TP!THREAD_POOL::~THREAD_POOL+0x11c
9 Id: 1fc0.d84 Suspend: 1 Teb: 7ffd5000 Unfrozen
ChildEBP RetAddr Args to Child
00d2ff28 77f430c7 77e430bc 00000148 00d2ff84
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
00d2ff58 5a302360 00000148 00d2ff80 00d2ff84
ntdll!ZwRemoveIoCompletion+0xc
00d2ff90 5a302531 00000000 002684f0 00d2ffec
W3TP!THREAD_POOL::PostCompletion+0x78
00d2ffec 00000000 5a301cf2 002684f0 00000000
W3TP!THREAD_POOL::~THREAD_POOL+0x11c
10 Id: 1fc0.1fa0 Suspend: 1 Teb: 7ffd4000 Unfrozen
ChildEBP RetAddr Args to Child
00defcec 77f4372d 77f75297 00000003 00defd34
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
00deffb8 77e4a990 00000000 00000000 00000000
ntdll!ZwWaitForMultipleObjects+0xc
00deffec 00000000 77f75155 00000000 00000000
kernel32!FlsSetValue+0x779
11 Id: 1fc0.12a4 Suspend: 1 Teb: 7ffaf000 Unfrozen
ChildEBP RetAddr Args to Child
00e2fed8 77f430c7 77e430bc 00000170 00e2ffac
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for \\?\C:\IISDebugTools\IISCHAgent.dll -
WARNING: Stack unwind information not available. Following frames may
be wrong.
00e2ff08 67306fab 00000170 00e2ff98 00e2ffac
ntdll!ZwRemoveIoCompletion+0xc
00e2ffb8 77e4a990 00000000 00000000 00000000
IISCHAgent!ConfigFileMonitor+0x15b
00e2ffec 00000000 67306e50 00000000 00000000
kernel32!FlsSetValue+0x779
12 Id: 1fc0.15f8 Suspend: 1 Teb: 7ffae000 Unfrozen
ChildEBP RetAddr Args to Child
01a9ff14 77f43741 77e41817 00000168 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
01a9ff88 77e4168f 00000168 ffffffff 00000000
ntdll!NtWaitForSingleObject+0xc
77f420c6 4affc033 89217508 90900c42 f0909090
kernel32!WaitForSingleObject+0xf
0424548b 00000000 00000000 00000000 00000000 0x4affc033
13 Id: 1fc0.1d74 Suspend: 1 Teb: 7ffad000 Unfrozen
ChildEBP RetAddr Args to Child
01aefe20 77f4313f 77c57b85 00000108 01aeff7c
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
01aeff8c 77c60829 77c60771 00099c48 00000000
ntdll!NtReplyWaitReceivePortEx+0xc
01aeffb0 77c60857 00089f98 77e4a990 000a2718
RPCRT4!NdrRangeUnmarshall+0x5a9
01aeffec 00000000 77c60840 000a2718 00000000
RPCRT4!NdrRangeUnmarshall+0x5d7
14 Id: 1fc0.15c Suspend: 1 Teb: 7ffac000 Unfrozen
ChildEBP RetAddr Args to Child
01b2ff8c 77f4262b 77f6f0fc 00000001 01b2ffac
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
01b2ffb8 77e4a990 000b1c38 00000000 00000000
ntdll!NtDelayExecution+0xc
01b2ffec 00000000 77f6f0bf 000b1c38 00000000
kernel32!FlsSetValue+0x779
15 Id: 1fc0.a50 Suspend: 1 Teb: 7ffab000 Unfrozen
ChildEBP RetAddr Args to Child
01dbff7c 77f430c7 71b246f7 00000248 01dbffc0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
01dbffb8 77e4a990 71b26970 00000000 00000000
ntdll!ZwRemoveIoCompletion+0xc
01dbffec 00000000 71b24690 000be858 00000000
kernel32!FlsSetValue+0x779
16 Id: 1fc0.15f4 Suspend: 1 Teb: 7ffaa000 Unfrozen
ChildEBP RetAddr Args to Child
02c1ff88 77f4372d 71c63620 00000002 02c1ffb0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
02c1ffb8 77e4a990 00000000 00000000 00000000
ntdll!ZwWaitForMultipleObjects+0xc
02c1ffec 00000000 71c635af 00000000 00000000
kernel32!FlsSetValue+0x779
17 Id: 1fc0.1640 Suspend: 1 Teb: 7ffa8000 Unfrozen
ChildEBP RetAddr Args to Child
02c9ff28 77f430c7 77e430bc 00000148 02c9ff84
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
02c9ff58 5a302360 00000148 02c9ff80 02c9ff84
ntdll!ZwRemoveIoCompletion+0xc
02c9ff90 5a302531 00000000 01828e78 02c9ffec
W3TP!THREAD_POOL::PostCompletion+0x78
02c9ffec 00000000 5a301cf2 01828e78 00000000
W3TP!THREAD_POOL::~THREAD_POOL+0x11c
18 Id: 1fc0.12ac Suspend: 1 Teb: 7ffa7000 Unfrozen
ChildEBP RetAddr Args to Child
02cdff70 77f430c7 77f7e6ae 000000c0 02cdffb0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
02cdffb8 77e4a990 00000000 00000000 00000000
ntdll!ZwRemoveIoCompletion+0xc
02cdffec 00000000 77f7e673 00000000 00000000
kernel32!FlsSetValue+0x779
19 Id: 1fc0.17ec Suspend: 1 Teb: 7ffa6000 Unfrozen
ChildEBP RetAddr Args to Child
02d1ff70 77f430c7 77f7e6ae 000000c0 02d1ffb0
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
02d1ffb8 77e4a990 00000000 00000000 00000000
ntdll!ZwRemoveIoCompletion+0xc
02d1ffec 00000000 77f7e673 00000000 00000000
kernel32!FlsSetValue+0x779
20 Id: 1fc0.129c Suspend: 1 Teb: 7ffa9000 Unfrozen
ChildEBP RetAddr Args to Child
02c5ff18 77f43741 77e41817 000004a0 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may
be wrong.
02c5ff8c 77e4168f 000004a0 0000ea60 00000000
ntdll!NtWaitForSingleObject+0xc
02c5ffb8 77e4a990 01e85da0 00000000 00000000
kernel32!WaitForSingleObject+0xf
02c5ffec 00000000 1005038e 01e85da0 00000000
kernel32!FlsSetValue+0x779
0:000> !iisdbg.ifclr managed.def
!ifclr uses MSCORLIB.DLL to determine if this is a managed process.
This module is not loaded in this process.
Managed extensions will not be executed. Status: 80004002
Closing open log file
\\?\C:\IISDebugTools\logs\20040817-161955\8128_w3wp_DefaultAppPool.log
***************************** END OF FILE
*******************************
"Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message news:<us59wUOhEHA.536@TK2MSFTNGP11.phx.gbl>...
> Run iisapp.vbs located in %systemroot%\system32 to get a list of defined web
> apps, and the PIDs of the w3wp.exe that they are running in.
>
> Then use IISState with -hc or -sc switch against that PID
>
> HTH
>
> Cheers
> Ken
>
> "Rich" <rherring@tampabay.rr.com> wrote in message
> news:94874d4b.0408171146.5570d20f@posting.google.com...
> > Hi,
> > I am having trouble pinpointing the cause of w3wp.exe processes
> > crashing.
> > I am running Win2003, IIS 6.0, and have my own ISAPI filter running.
> > My filter performs a lookup in AD, spawns a thread to watch a queue,
> > and opens a backchannel request to another http port on the same box.
> > I am using the Default App Pool with 5 processes in the garden. I
> > also have it setup that after 5 process failures in 5 minutes to
> > disable the App Pool. I have the recycle time set to 1 minute (just
> > to trigger the problem faster).
> >
> > I only see this behavior under extreme loads, perhaps I'm just
> > impatient.
> >
> > I have run the IISDump utility but the process ids from the .dmp files
> > not match the process ids in the Event log for event 1009.
> >
> > I would like to see the call stack from the w3wp processes that crash.
> > Is there any way to gather this information after the process has
> > crashed. The only way I know which process to run IISState against is
> > by looking at the event log, after it has crashed.
> >
> > Any help would be greatly appreciated.
> >
> > Rihard