Port 1043 with IIS

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ IIS
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - IIS 6.0 CPU at 100% Fist of all thanks in advance for your help. It is greatly appreciated. Below is a log from IISState. The CPU will be @ 100% and our web site will all but stop responding. # ChildEBP RetAddr 00 032fff7c 77f430c7 SharedUserData!SystemCallStub+0x4 01 032fff80 71b246f7 ntdll!ZwRemoveIoCompletion+0xc 02 032fffb8 77e4a990 mswsock!SockAsyncThread+0x67 03 032fffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 24 System Thread ID: b14 Kernel Time: 0:0:0.187 User Time: 0:0:0.93 Thread Status: Thread is in a WAIT state. Thread Type: Other # ChildEBP RetAddr 00 0333ff08 77f4372d SharedUserData!SystemCallStub+0x4 01 0333ff0c 76ab7204 ntdll!NtWaitForMultipleObjects+0xc 02 0333ffb8 77e4a990 WINMM!timeThread+0x37 03 0333ffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 25 System Thread ID: cbc Kernel Time: 0:0:2.843 User Time: 0:0:6.156 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 049afdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 049afdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 049afe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 049afed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 049afef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 049aff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 049affb8 77e4a990 msvcrt!_endthreadex+0x95 07 049affec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 26 System Thread ID: ab8 Kernel Time: 0:0:2.265 User Time: 0:0:5.546 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 049efdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 049efdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 049efe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 049efed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 049efef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 049eff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 049effb8 77e4a990 msvcrt!_endthreadex+0x95 07 049effec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 27 System Thread ID: fa8 Kernel Time: 0:0:2.890 User Time: 0:0:8.906 Thread Type: SQL Query. Possible ASP page Executing Page: C:\INETPUB\WWWROOT\NTEL_REVERSEPHONE.ASP # ChildEBP RetAddr 00 04a2e4a8 77f43741 SharedUserData!SystemCallStub+0x4 01 04a2e4ac 71b23988 ntdll!ZwWaitForSingleObject+0xc 02 04a2e4e8 71b2b13e mswsock!SockWaitForSingleObject+0x38 03 04a2e560 71c0134f mswsock!WSPRecv+0x1f0 04 04a2e59c 71bb1151 WS2_32!WSARecv+0x75 05 04a2e5c8 6d56130e WSOCK32!recv+0x31 06 04a2e608 02e42195 DBNETLIB!ConnectionRead+0x2ca 07 04a2e63c 02e421f4 sqloledb!CDataSource::ConnectionRead+0x35 08 04a2e688 02e4256a sqloledb!CDBConnection::GetBytes+0x267 09 04a2e6d4 02e482a6 sqloledb!CDBConnection::ProcessTDSStream+0x155 0a 04a2e78c 02e48384 sqloledb!CStmt::ExecDirect+0x732 0b 04a2e7a0 02e48b31 sqloledb!CStmt::SQLExecDirect+0x25 0c 04a2e7c8 02e48f99 sqloledb!CCommand::ExecuteHelper+0x155 0d 04a2e84c 02e49216 sqloledb!CCommand::Execute+0x780 0e 04a2e88c 02aea141 sqloledb!CImpICommandText::Execute+0xf3 0f 04a2e8cc 02ae9da8 msado15!CConnection::Execute+0x9b 10 04a2ea8c 02ae9c47 msado15!_ExecuteAsync+0x17e 11 04a2ea9c 02ae99ee msado15!ExecuteAsync+0x1f 12 04a2eb68 02ae9bee msado15!CQuery::Execute+0xa25 13 04a2ebc8 02b1da97 msado15!CCommand::_Execute+0x147 14 04a2ec40 02b186a5 msado15!CConnection::OpenRecordset+0xd7 15 04a2ed80 02b016ac msado15!CConnection::Execute+0x3f5 16 04a2f004 7348b427 msado15!CConnection::Invoke+0x8ba 17 04a2f058 7347f39c vbscript!CatchIDispatchInvoke+0x46 18 04a2f0a4 7346368c vbscript!IDispatchInvoke+0x95 19 04a2f1b8 73462f95 vbscript!InvokeDispatch+0x138 1a 04a2f1dc 73465d5b vbscript!InvokeByName+0x40 1b 04a2f4b8 73463c33 vbscript!CScriptRuntime::Run+0x2581 1c 04a2f5bc 7346c57f vbscript!CScriptEntryPoint::Call+0x65 1d 04a2f890 73463c33 vbscript!CScriptRuntime::Run+0x20ce 1e 04a2f994 73463d42 vbscript!CScriptEntryPoint::Call+0x65 1f 04a2f9f8 73464081 vbscript!CSession::Execute+0xb6 20 04a2fa48 734640ee vbscript!COleScript::ExecutePendingScripts+0x14a 21 04a2fa64 709e5e87 vbscript!COleScript::SetScriptState+0x14e 22 04a2fa90 709e5ee1 asp!CActiveScriptEngine::TryCall+0x17 23 04a2facc 709e5f21 asp!CActiveScriptEngine::Call+0x31 24 04a2fae0 709e6227 asp!CallScriptFunctionOfEngine+0x21 25 04a2fb18 709e6393 asp!ExecuteRequest+0x138 26 04a2fb60 709e5573 asp!Execute+0x16a 27 04a2fbb0 709e5726 asp!CHitObj::ViperAsyncCallback+0x3ec 28 04a2fbd0 75633107 asp!CViperAsyncRequest::OnCall+0x8c 29 04a2fbec 77204ea7 comsvcs!CSTAActivityWork::STAActivityWorkHelper+0x30 2a 04a2fc38 772055da ole32!EnterForCallback+0xc0 2b 04a2fd98 771e0448 ole32!SwitchForCallback+0x194 2c 04a2fdc4 771a656c ole32!PerformCallback+0x52 2d 04a2fe48 77207c0f ole32!CObjectContext::InternalContextCallback+0x140 2e 04a2fe68 756332b3 ole32!CObjectContext::DoCallback+0x1a 2f 04a2fed4 756337ad comsvcs!CSTAActivityWork::DoWork+0x137 30 04a2fee8 75633f71 comsvcs!CSTAThread::DoWork+0x14 31 04a2ff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30 Thread ID: 28 System Thread ID: fdc Kernel Time: 0:0:1.0 User Time: 0:0:2.828 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 04a6fdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 04a6fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 04a6fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 04a6fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 04a6fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 04a6ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 04a6ffb8 77e4a990 msvcrt!_endthreadex+0x95 07 04a6ffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 29 System Thread ID: dd8 Kernel Time: 0:0:1.781 User Time: 0:0:21.875 Thread Type: SQL Query. Possible ASP page Executing Page: C:\INETPUB\WWWROOT\NTEL_RESULTS.ASP # ChildEBP RetAddr 00 04aae7a8 77f43741 SharedUserData!SystemCallStub+0x4 01 04aae7ac 71b23ac3 ntdll!ZwWaitForSingleObject+0xc 02 04aae7e8 71b2b13e mswsock!SockWaitForSingleObject+0x19b 03 04aae860 71c0134f mswsock!WSPRecv+0x1f0 04 04aae89c 71bb1151 WS2_32!WSARecv+0x75 05 04aae8c8 6d56130e WSOCK32!recv+0x31 06 04aae908 02e42195 DBNETLIB!ConnectionRead+0x2ca 07 04aae93c 02e421f4 sqloledb!CDataSource::ConnectionRead+0x35 08 04aae988 02e4256a sqloledb!CDBConnection::GetBytes+0x267 09 04aae9d4 02e482a6 sqloledb!CDBConnection::ProcessTDSStream+0x155 0a 04aaea8c 02e48384 sqloledb!CStmt::ExecDirect+0x732 0b 04aaeaa0 02e48b31 sqloledb!CStmt::SQLExecDirect+0x25 0c 04aaeac8 02e7c9f7 sqloledb!CCommand::ExecuteHelper+0x155 0d 04aaeafc 02e737e4 sqloledb!CCommand::ReExecute+0x37 0e 04aaeb44 03343480 sqloledb!CImpIRowsetScroll::RestartPosition+0x2bc 0f 04aaeb60 02af5aab msadrh15!CRowsetHelper::RestartPosition+0x55 10 04aaeba4 02af27a7 msado15!CRecordset::_MoveFirst+0xd2 11 04aaebe4 02aff54a msado15!CRecordset::MoveFirst+0xfe 12 04aaf004 7348b427 msado15!CRecordset::Invoke+0x11b5 13 04aaf058 7347f39c vbscript!CatchIDispatchInvoke+0x46 14 04aaf0a4 7346368c vbscript!IDispatchInvoke+0x95 15 04aaf1b8 73462f95 vbscript!InvokeDispatch+0x138 16 04aaf1dc 734635ef vbscript!InvokeByName+0x40 17 04aaf4b8 73463c33 vbscript!CScriptRuntime::Run+0x2625 18 04aaf5bc 7346c05b vbscript!CScriptEntryPoint::Call+0x65 19 04aaf890 73463c33 vbscript!CScriptRuntime::Run+0x1f02 1a 04aaf994 73463d42 vbscript!CScriptEntryPoint::Call+0x65 1b 04aaf9f8 73464081 vbscript!CSession::Execute+0xb6 1c 04aafa48 734640ee vbscript!COleScript::ExecutePendingScripts+0x14a 1d 04aafa64 709e5e87 vbscript!COleScript::SetScriptState+0x14e 1e 04aafa90 709e5ee1 asp!CActiveScriptEngine::TryCall+0x17 1f 04aafacc 709e5f21 asp!CActiveScriptEngine::Call+0x31 20 04aafae0 709e6227 asp!CallScriptFunctionOfEngine+0x21 21 04aafb18 709e6393 asp!ExecuteRequest+0x138 22 04aafb60 709e5573 asp!Execute+0x16a 23 04aafbb0 709e5726 asp!CHitObj::ViperAsyncCallback+0x3ec 24 04aafbd0 75633107 asp!CViperAsyncRequest::OnCall+0x8c 25 04aafbec 77204ea7 comsvcs!CSTAActivityWork::STAActivityWorkHelper+0x30 26 04aafc38 772055da ole32!EnterForCallback+0xc0 27 04aafd98 771e0448 ole32!SwitchForCallback+0x194 28 04aafdc4 771a656c ole32!PerformCallback+0x52 29 04aafe48 77207c0f ole32!CObjectContext::InternalContextCallback+0x140 2a 04aafe68 756332b3 ole32!CObjectContext::DoCallback+0x1a 2b 04aafed4 756337ad comsvcs!CSTAActivityWork::DoWork+0x137 2c 04aafee8 75633f71 comsvcs!CSTAThread::DoWork+0x14 2d 04aaff04 7563423b comsvcs!CSTAThread::ProcessQueueWork+0x30 2e 04aaff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x17a 2f 04aaffb8 77e4a990 msvcrt!_endthreadex+0x95 30 04aaffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 30 System Thread ID: d28 Kernel Time: 0:0:2.390 User Time: 0:0:6.515 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 039cfdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 039cfdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 039cfe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 039cfed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 039cfef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 039cff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 039cffb8 77e4a990 msvcrt!_endthreadex+0x95 07 039cffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 31 System Thread ID: d84 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Status: Thread is in a WAIT state. Thread Type: Other # ChildEBP RetAddr 00 0508fec4 77f4372d SharedUserData!SystemCallStub+0x4 01 0508fec8 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 0508ff70 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a 03 0508ff88 75976644 kernel32!WaitForMultipleObjects+0x17 04 0508ffb8 77e4a990 USERENV!NotificationThread+0x5f 05 0508ffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 32 System Thread ID: 144 Kernel Time: 0:0:1.109 User Time: 0:0:4.406 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 050dfdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 050dfdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 050dfe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 050dfed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 050dfef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 050dff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 050dffb8 77e4a990 msvcrt!_endthreadex+0x95 07 050dffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 33 System Thread ID: c58 Kernel Time: 0:0:6.15 User Time: 0:0:29.921 Thread Status: Thread is in a WAIT state. Thread Type: Idle ASP thread # ChildEBP RetAddr 00 0529fdcc 77f4372d SharedUserData!SystemCallStub+0x4 01 0529fdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc 02 0529fe78 77d076f5 kernel32!WaitForMultipleObjectsEx+0x11a 03 0529fed4 77d077f5 USER32!RealMsgWaitForMultipleObjectsEx+0x13f 04 0529fef0 756342a4 USER32!MsgWaitForMultipleObjects+0x1d 05 0529ff84 77bc91ed comsvcs!CSTAThread::WorkerLoop+0x1e3 06 0529ffb8 77e4a990 msvcrt!_endthreadex+0x95 07 0529ffec 00000000 kernel32!BaseThreadStart+0x34 Thread ID: 34 System Thread ID: a24 Kernel Time: 0:32:24.687 User Time: 0:6:49.390 Thread Type: Other # ChildEBP RetAddr 00 052ee01c 00000000 SharedUserData!SystemCallStub+0x4 GetContextState failed, 0x8007001F GetContextState failed, 0x8007001F GetContextState failed, 0x8007001F Thread ID: 35 System Thread ID: 0 Kernel Time: 0:41:16.984 User Time: 0:8:32.281 GetContextState failed, 0x8007001F GetStackTrace failed, 0x8007001F Tag: Port 1043 with IIS Tag: 359313
  - 2
    - IIS error? Hello, we've seen this IIS error once before. Does anyone know about this? Thanks!! ---------------------------------- The web server was throwing an internal server error. I restarted IIS and the problem resolved itself. I found the following error in the event log: Event Type: Error Event Source: Active Server Pages Event Category: None Event ID: 5 Date: 3/30/2005 Time: 1:26:23 PM User: N/A Computer: WEB-03 Description: Error: File /NR/exeres/000000bbtomzbbanplbmrltg/Login.asp Script Engine Exception. A ScriptEngine threw expection 'C00000FD' in 'IActiveScriptParse::ParseScriptText()' from 'CActiveScriptEngine::AddScriptlet()'.. For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp. Tag: Port 1043 with IIS Tag: 359312
  - 3
    - I can't make it work........ I have an exchange server with OWA setup and running. It's fine. (uses the default web page) I want to add a web site for internal use only on this IIS I created a page in frontpage.. Started IIs on this server called exchange Added a website. Added a hostheader called 'onsite' Used port 80 for both the default site and 'onsite' both sites are running...... my defualt page is called index.htm and is listed in the site properties documents page (1st one) I go to another system on the local network and open a browser, but i cannot access the page.. (get the page not found error) Im really not sure of the correct syntax, but in my browser i've tried; http://onsite http://exchange/onsite http://exchange/onsite/index.htm http://onsite/index.htm nothing works.................. I can go to http://exchange and get the default site under construction page........ But I cannot get to the new site.. what can i be doing wrong?? Tag: Port 1043 with IIS Tag: 359310
  - 4
    - IIS Admin Service - changing Logon account Within IIS 6, I am trying to change the Logon account for all of the IIS services (IIS Admin, HTTP SSL, and WWW) from the Local System account to a custom account in the Administrators group. Whenever I try to start IIS Admin, the service terminates with an error in the Event Log: "Access is Denied". When I set the Logon account back to the Local System account, services start. The Administrators group has the required permissions on inetinfo.exe and the system32 and inetsrv directories. In the Local Security Policy, I've tried giving the Administrators group the "replace a process level token" and "adjust memory quotas for a process" rights (Administrators group has most rights already). After researching on Microsoft's site, I ran the command line below: sc query IISADMIN It showed that the STATE was "STOPPED" and the WIN32_EXIT_CODE was 5. Does anyone have any ideas? Tag: Port 1043 with IIS Tag: 359309
  - 5
    - IIS version and Update I am putting the original IIS from Win2000 on my machine as a learning tool. Question is: How can I tell what version IIS I have? How can I upgrade to the latest version? Thanks...... Jim Tag: Port 1043 with IIS Tag: 359308
  - 6
    - Symantec & IIS SMTP server Does anyone know which (if any) Norton product will run on an IIS SMTP server to filter out virus' from incoming mail? We do not have exchange or Domino on this machine. It simply acts as a gateway to our actula SMTP & POP servers. Thanks. Tag: Port 1043 with IIS Tag: 359307
  - 7
    - Unable to Create web project 'test1'.not found I am running windows 2003 server web edition. I created a Web Application using Net 2003 on my XP Machine. When I use Copy project from my Net 2003 I am getting this error. In the above error test1 is my application name. Please Help Tanweer Tag: Port 1043 with IIS Tag: 359306
  - 8
    - ASP stops responding Everything runs smoothly for a while (weeks, sometimes only days), and then IIS stops processing requests for ASP pages. I don't see any error messages in either the Event Log or the W3SVC log. The W3SVC log doesn't even show attempts to load (GET) the ASP files, although it does show HTML files loading just fine. I'm running Windows 2000 SP4 and IIS 5.0. I'm up to date with Microsoft Updates. There are several Virtual Directories, most of which include lots of ASP pages. Some of those ASP pages use COM DLLs written in Visual Basic. CPU and memory look fine. The first time this happened, I tried to start the IIS Console so I could cycle IIS, but the IIS Console wouldn't start--I had to reboot to make everything right again. The second time this happened, the IIS Console started, but after it had been running for 10 minutes or so, when I tried to display the Default Web Site Properties, it hung. I had to reboot. Once the IIS Console is hung, I can't stop the WWW Publishing Service, probably because it wants to stop the IIS Admin Service, which is hung with the IIS Console. I can reproduce this on my test server using the Web Application Stress Tool, although it sometimes takes several runs to make it happen. I've seen it happen on my production server when the system has been pretty idle, though, so I'm not sure it's related to stressing the server. I originally posted this problem report at WindowsITPro, and Tom Kaminski suggested I install and run IISstate and post the dump here. I'm not sure how to post the dump file (I don't see a way to upload or attach a file), but the IISstate log file is below. I'd appreciate any help you could give me! Thanks- MJ. The IISstate log file: Opened log file 'C:\Program Files\IISstate\output\IISState-1876.log' *********************** Starting new log output IISState version 3.3.1 Wed Mar 30 12:31:02 2005 OS = Windows 2000 Executable: inetinfo.exe PID = 1876 Note: Thread times are formatted as HH:MM:SS.ms *********************** Thread ID: 0 System Thread ID: 75c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0006f89c 7c5862e9 ntdll!ZwReadFile+0xb 01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181 02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28 03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a 04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d 05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1 06 0006ff70 01002fbf inetinfo!main+0x654 07 0006ffc0 7c59893d inetinfo!mainCRTStartup+0xff 08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d Thread ID: 1 System Thread ID: 2c4 Kernel Time: 0:0:0.0 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 005dfd1c 7c599fe4 ntdll!ZwWaitForSingleObject+0xb 01 005dfd44 7c57b3db KERNEL32!WaitForSingleObjectEx+0x71 02 005dfd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf 03 005dfd70 01002440 iisadmin!ServiceEntry+0x156 04 005dffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 05 005dffb4 7c57b388 ADVAPI32!ScSvcctrlThreadW+0xe 06 005dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 2 System Thread ID: 6e0 Kernel Time: 0:0:0.484 User Time: 0:0:0.218 Thread Type: Other # ChildEBP RetAddr 00 0071fe5c 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0071feac 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0071ff08 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0071ffb4 7c57b388 MSVCRT!_endthreadex+0xc1 06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 3 System Thread ID: 680 Kernel Time: 0:0:0.609 User Time: 0:0:0.156 Thread Type: Other # ChildEBP RetAddr 00 0075fe5c 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0075feac 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0075ff08 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0075ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0075ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0075ffb4 7c57b388 MSVCRT!_endthreadex+0xc1 06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 4 System Thread ID: bbc Kernel Time: 0:0:0.328 User Time: 0:0:0.187 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 00bcfe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 00bcff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 00bcff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 00bcffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 00bcffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18 05 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 5 System Thread ID: 1c4 Kernel Time: 0:0:0.78 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 00e5fc1c 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 00e5fc6c 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 00e5fcc8 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 00e5fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d 04 00e5fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209 05 00e5fd70 01002440 w3svc!ServiceEntry+0x1b5 06 00e5ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 07 00e5ffb4 7c57b388 ADVAPI32!ScSvcctrlThreadW+0xe 08 00e5ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 6 System Thread ID: 73c Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 00e9fc1c 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 00e9fc6c 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 00e9fcc8 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 00e9fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d 04 00e9fd30 6fc6b2f0 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209 05 00e9fd70 01002440 ftpsvc2!ServiceEntry+0xc7 06 00e9ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 07 00e9ffb4 7c57b388 ADVAPI32!ScSvcctrlThreadW+0xe 08 00e9ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 7 System Thread ID: 850 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 00fdff5c 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 00fdff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27 02 00fdffb4 7c57b388 ISATQ!I_AtqOplockThreadFunc+0x32 03 00fdffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 8 System Thread ID: 998 Kernel Time: 0:0:0.109 User Time: 0:0:0.406 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0104ff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 0104ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0104ffb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 9 System Thread ID: 738 Kernel Time: 0:0:0.93 User Time: 0:0:0.453 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0108ff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 0108ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0108ffb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 10 System Thread ID: bb8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0120feb8 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 0120fee4 77d31394 KERNEL32!GetQueuedCompletionStatus+0x27 02 0120ff20 77d3e93f RPCRT4!COMMON_ProcessCalls+0x9e 03 0120ff74 77d3e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99 04 0120ff78 77d35924 RPCRT4!ProcessIOEventsWrapper+0x9 05 0120ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 06 0120ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18 07 0120ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 11 System Thread ID: bc0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0144fd20 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0144fd70 7c59a0c2 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0144fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17 03 0144ffb4 7c57b388 RTUTILS!TraceServerThread+0xde 04 0144ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 12 System Thread ID: 780 Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0149ff00 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0149ff50 75037871 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0149ff6c 6fc66e80 WS2_32!WSAWaitForMultipleEvents+0x18 03 0149ffb4 7c57b388 ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x39 04 0149ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 13 System Thread ID: 7d4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Compression Thread # ChildEBP RetAddr 00 014eff5c 7c599fe4 ntdll!ZwWaitForSingleObject+0xb 01 014eff84 7c57b3db KERNEL32!WaitForSingleObjectEx+0x71 02 014eff94 732c3366 KERNEL32!WaitForSingleObject+0xf 03 014effb4 7c57b388 compfilt!CompressionThread+0x29 04 014effc0 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 14 System Thread ID: e60 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0161fdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 0161fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 0161ff24 750312f5 msafd!WSPSelect+0x24e 03 0161ff88 6d7075bd WS2_32!select+0xe7 04 0161ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22 05 0161ffb4 7c57b388 ISATQ!BmonThreadFunc+0x9 06 0161ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 15 System Thread ID: a74 Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0165fe70 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0165fec0 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0165ff1c 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0165ff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d 04 0165ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42 05 0165ffb4 7c57b388 MSVCRT!_endthread+0xc6 06 0165ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 16 System Thread ID: e64 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0169fea8 7c59a1af ntdll!ZwWaitForMultipleObjects+0xb 01 0169fef8 77e1e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0169ff54 77e1e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0169ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d 04 0169ffb4 7c57b388 w3svc!OleHackThread+0x88 05 0169ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 17 System Thread ID: 6c4 Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0172ff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 0172ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0172ffb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 0172ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 18 System Thread ID: bb4 Kernel Time: 0:0:0.156 User Time: 0:0:0.250 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0176ff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 0176ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0176ffb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 0176ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 19 System Thread ID: bb0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 017aff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 017aff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 017affb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 017affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 20 System Thread ID: ba8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 017eff50 7c5853d7 ntdll!ZwRemoveIoCompletion+0xb 01 017eff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 017effb4 7c57b388 ISATQ!AtqPoolThread+0x40 03 017effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 21 System Thread ID: eac Kernel Time: 0:0:0.328 User Time: 0:0:0.171 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0186fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0186ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0186ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0186ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0186ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18 05 0186ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 22 System Thread ID: f04 Kernel Time: 0:0:0.328 User Time: 0:0:0.93 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 01acfe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 01acff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 01acff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 01acffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 01acffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18 05 01acffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 23 System Thread ID: f1c Kernel Time: 0:0:0.203 User Time: 0:0:0.187 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 01b0fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 01b0ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 01b0ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 01b0ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 01b0ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18 05 01b0ffec 00000000 KERNEL32!BaseThreadStart+0x52 ***** Dump name is formatted as: PID-Timestamp.dmp Creating C:\Program Files\IISstate\output\1876-1112203929.dmp - mini user dump ***** Closing open log file C:\Program Files\IISstate\output\IISState-1876.log Tag: Port 1043 with IIS Tag: 359305
  - 9
    - How-To for FrontPage 2003 on Windows Server 2003? Any good info or How-To's for FrontPage 2003 on Windows Server 2003? I just ordered both to support a client. I've done OWA front/back end setup before so I'm not new.... but I've got only a couple weeks to move an existing site from a remote system currently using extensions 2002 on LINUX and webmaster says he's using FP 2000 to code. Many thanks! Tag: Port 1043 with IIS Tag: 359304
  - 10
    - IIS Caching Problem - etags and server farms I have run across an IIS/caching problem, and would like any help available in resolving it. The scenario is as follows: 1. Windows 2003 server farm running IIS 6.0 ( 4 servers in the farm ) 2. We are manually (through IIS - Http Headers tab) adding a "Cache-Control: Private" header on all images to allow the browser to cache them. 3. IIS automatically adds a "Last-Modified: xxx" header, and a "ETag: xxx" header to the image response. The problem is as follows: The response for an image will sometimes come back as a 200 "OK" and occasionally a 304 "Not Modified" depending on which server in the farm it hits. This is because of the etag header that gets returned with the image. The IIS etag is made up of two parts (xxxxx:yyy), the first part (xxxxx) being a unique identifier based off of the last modified date, and the second part (yyy) is some kind of a server identifier based on how many times IIS has been restarted. If any part of the etag differs from what the browser has cached, the entire image is again returned from the server (even though nothing has changed). The etag should be based only on the content/date of the files themselves, and not have anything to do with the server. I have found a couple of articles suggesting that Microsoft knows about this. The following links all discuss this problem: http://dotnetjunkies.com/WebLog/leon/archive/2005/02/16/54630.asp http://groups-beta.google.com/group/microsoft.public.inetserver.iis/browse_thread/thread/d8bafa15a91c5654/90083cb60d696b62?q=iis+farm+etag&rnum=1#90083cb60d696b62 http://support.microsoft.com/?scid=kb;en-us;823544&spid=2097&sid=49 One of these links refers to an internal article: SOX020114700100 that supposedly has a fix to this problem. There is also supposedly a hot fix available that will patch a flaw in IIS 6.0 related to this problem. Both of these solutions require opening up a support ticket with Microsoft to get the internal articles/files. I was wondering if anyone has come across an easier way to handle this issue? P.S. There is also a third party ISAPI that addresses this problem... http://www.isapilabs.com/products/ETagFix/index.htm. Obviously I would prefer a Microsoft solution if one exists. Thanks, S. Erisman Tag: Port 1043 with IIS Tag: 359303
  - 11
    - Can someone help me with troubleshooting a Server Error in '/' Application issue I'm not well versed with IIS or web admin tasks so this may be real easy for you all but over my head. And I'm getting nowhere posting this to the Small Business Server 2003 site. From workstations I get: Server Error in '/' Application. ---------------------------------------------------------------------------- ---- Runtime Error Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine. Details: To enable the details of this specific error message to be viewable on remote machines, please create a <customErrors> tag within a "web.config" configuration file located in the root directory of the current web application. This <customErrors> tag should then have its "mode" attribute set to "Off".  <configuration> <system.web> <customErrors mode="Off"/> </system.web> </configuration> Notes: The current error page you are seeing can be replaced by a custom error page by modifying the "defaultRedirect" attribute of the application's <customErrors> configuration tag to point to a custom error page URL.  <configuration> <system.web> <customErrors mode="RemoteOnly" defaultRedirect="mycustompage.htm"/> </system.web> </configuration> From the Server I get: Server Error in '/' Application. ---------------------------------------------------------------------------- ---- Runtime Error Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed. Details: To enable the details of this specific error message to be viewable on the local server machine, please create a <customErrors> tag within a "web.config" configuration file located in the root directory of the current web application. This <customErrors> tag should then have its "mode" attribute set to "RemoteOnly". To enable the details to be viewable on remote machines, please set "mode" to "Off".  <configuration> <system.web> <customErrors mode="RemoteOnly"/> </system.web> </configuration> Notes: The current error page you are seeing can be replaced by a custom error page by modifying the "defaultRedirect" attribute of the application's <customErrors> configuration tag to point to a custom error page URL.  <configuration> <system.web> <customErrors mode="On" defaultRedirect="mycustompage.htm"/> </system.web> </configuration> Tag: Port 1043 with IIS Tag: 359299
  - 12
    - email form I was tasked to create a form that will send email to selected addresses. Can somebody provide me a step by step how tos? Im not sure if im on the right channel, but...Thanks a lot Tag: Port 1043 with IIS Tag: 359297
  - 13
    - Problems using wfetch I cannot get meaningful results from wfetch. I followed the direction on page 928 of the IIS 6.0 Resource Kit book, with www.contoso.com for host, GET and path of "/" Here is what I get back: started.... WWWConnect::Connect("www.contoso.com","80")\n 0x2749 (A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket using a sendto call) no address was supplied.): connect() 0x2749 (A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket using a sendto call) no address was supplied.): connect() finished. Tag: Port 1043 with IIS Tag: 359295
  - 14
    - Unexpected performance improvement. Hi Guys! I applyied some patches to my develop IIS 5.0 servers (W2KS), to keep it secure, and.. now it uses less CPU!!! How can this be possible? I use my own stress application, serving ISAPI and ASP pages, and it uses half of CPU than before!!! This is the list of patchtes applied. Thanks! P. -------------------------------------------------------------------------------------------------- Internet Information Services 5.0 Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151) Bulletin ID: MS04-030 Microsoft Knowledge Base Article: Q824151 Windows 2000 Advanced Server Vulnerability in OLE and COM Could Allow Remote Code Execution (873333) Bulletin ID: MS05-012 Microsoft Knowledge Base Article: Q873333 Internet Explorer 6 Cumulative Security Update for Outlook Express (823353) Bulletin ID: MS04-018 Microsoft Knowledge Base Article: Q823353 Windows 2000 Advanced Server Vulnerability in Utility Manager Could Allow Code Execution (842526) Bulletin ID: MS04-019 Microsoft Knowledge Base Article: Q842526 Windows 2000 Advanced Server Vulnerability in POSIX Could Allow Code Execution (841872) Bulletin ID: MS04-020 Microsoft Knowledge Base Article: Q841872 Windows 2000 Advanced Server Vulnerability in Task Scheduler Could Allow Code Execution (841873) Bulletin ID: MS04-022 Microsoft Knowledge Base Article: Q841873 Windows 2000 Advanced Server Vulnerability in HTML Help Could Allow Code Execution (840315) Bulletin ID: MS04-023 Microsoft Knowledge Base Article: Q840315 Windows 2000 Advanced Server Vulnerability in Windows Shell Could Allow Remote Code Execution (839645) Bulletin ID: MS04-024 Microsoft Knowledge Base Article: Q839645 Internet Explorer 6 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) Bulletin ID: MS04-028 Microsoft Knowledge Base Article: Q833989 .NET Framework 1.1 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) Bulletin ID: MS04-028 Microsoft Knowledge Base Article: Q830348 Internet Information Services 5.0 Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151) Bulletin ID: MS04-030 Microsoft Knowledge Base Article: Q824151 Windows 2000 Advanced Server Vulnerability in NetDDE Could Allow Remote Code Execution (841533) Bulletin ID: MS04-031 Microsoft Knowledge Base Article: Q841533 Windows 2000 Advanced Server Security Update for Microsoft Windows (840987) Bulletin ID: MS04-032 Microsoft Knowledge Base Article: Q840987 Windows 2000 Advanced Server Vulnerability in Windows Shell Could Allow Remote Code Execution (841356) Bulletin ID: MS04-037 Microsoft Knowledge Base Article: Q841356 Windows 2000 Advanced Server Vulnerability in WordPad Could Allow Code Execution (885836) Bulletin ID: MS04-041 Microsoft Knowledge Base Article: Q885836 Windows 2000 Advanced Server Vulnerability in HyperTerminal Could Allow Code Execution (873339) Bulletin ID: MS04-043 Microsoft Knowledge Base Article: Q873339 Windows 2000 Advanced Server Vulnerabilities in Windows Kernel and LSASS Could Allow Elevation of Privilege (885835) Bulletin ID: MS04-044 Microsoft Knowledge Base Article: Q885835 Windows 2000 Advanced Server Vulnerability in HTML Help Could Allow Code Execution (890175) Bulletin ID: MS05-001 Microsoft Knowledge Base Article: Q890175 Windows 2000 Advanced Server Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711) Bulletin ID: MS05-002 Microsoft Knowledge Base Article: Q891711 Windows 2000 Advanced Server Vulnerability in the Indexing Service Could Allow Remote Code Execution (871250) Bulletin ID: MS05-003 Microsoft Knowledge Base Article: Q871250 .NET Framework 1.1 ASP.NET Path Validation Vulnerability (887219) Bulletin ID: MS05-004 Microsoft Knowledge Base Article: Q886904 Windows 2000 Advanced Server Vulnerability in Windows Shell Could Allow Remote Code Execution (890047) Bulletin ID: MS05-008 Microsoft Knowledge Base Article: Q890047 Windows 2000 Advanced Server Vulnerability in the License Logging Service Could Allow Code Execution (885834) Bulletin ID: MS05-010 Microsoft Knowledge Base Article: Q885834 Windows 2000 Advanced Server Vulnerability in Server Message Block Could Allow Remote Code Execution (885250) Bulletin ID: MS05-011 Microsoft Knowledge Base Article: Q885250 Windows 2000 Advanced Server Vulnerability in OLE and COM Could Allow Remote Code Execution (873333) Bulletin ID: MS05-012 Microsoft Knowledge Base Article: Q873333 Windows 2000 Advanced Server Vulnerability in the DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (891781) Bulletin ID: MS05-013 Microsoft Knowledge Base Article: Q891781 Internet Explorer 6 Cumulative Security Update for Internet Explorer (867282) Bulletin ID: MS05-014 Microsoft Knowledge Base Article: Q867282 Windows 2000 Advanced Server Vulnerability in Hyperlink Object Library Could Allow Remote Code Execution (888113) Bulletin ID: MS05-015 Microsoft Knowledge Base Article: Q888113 Tag: Port 1043 with IIS Tag: 359291
  - 15
    - IIS 5.0, GZIP compression of html? Hi there ... I've tried all that I can, getting the compression feature in IIS 5 to work - read the two KB articles that turns up on compfilt.dll - however all attempts so far has been in vain. I've made sure that compression is enabled in the www master properties, and that the directory exists. I don't understand, does this compression feature in IIS 5 work at all, if not, then why hasn't there been released a patch? PS. OS is Windows 2000 Server SP4 with all updates installed. -- I doubt, therefore I might be. Tag: Port 1043 with IIS Tag: 359289
  - 16
    - Error opening site metabase key: 0x80070003 In windows 2003 web edition with IIS6 resource kit installed, when i tried to create a self ssl using selfssl.exe i receieve the Error: "Error opening site metabase key: 0x80070003" I tested in my windows xp PC and it worked just fine. Please if anyone knows how to fix this error i'd very much appreciate it Thanks Tag: Port 1043 with IIS Tag: 359288
  - 17
    - Errors installing IIS on Win2k Windows 2000 Pro with all updates installed. I am trying to install the SMTP service component of IIS. I could not see the virtual server in the snapin. I have worked backwards to some errors I see in the IIS install log (C:\WINNT\iis5.log). I completely removed IIS, renamed the log file and installed from the MSDN Windows 2000 Pro CD. Here is the beginning bits of the log files followed by the two errors I see: [3/30/2005 10:51:7] LogFile Open. [***** Search on FAIL/MessageBox keywords for failures *****]. [3/30/2005 10:51:7] Initial thread locale=409 [3/30/2005 10:51:7] returned from France fix with locale 409 [3/30/2005 10:51:7] OC_PREINITIALIZE:[iis] End. Return=1 (OCFLAG_UNICODE) [3/30/2005 10:51:7] OC_INIT_COMPONENT:[iis,(null)] Start. [3/30/2005 10:51:7] OC_INIT_COMPONENT:9/10/2003 19:30:08 A_______ 5.0.2195.6681: 5.00.0984: x86: C:\WINNT\system32\Setup\iis.dll [3/30/2005 10:51:7] OC_INIT_COMPONENT:Set UnAttendFlag:OFF (File='') [3/30/2005 10:51:7] OC_INIT_COMPONENT:CmdLine="C:\WINNT\system32\sysocmgr.exe" /i:C:\WINNT\system32\sysoc.inf [3/30/2005 10:51:7] OC_INIT_COMPONENT:DebugLevel=3. [3/30/2005 10:51:7] OC_INIT_COMPONENT:DebugValidateHeap=1. [3/30/2005 10:51:7] OC_INIT_COMPONENT:GlobalFastLoad=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:DebugLevel=3. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:DebugValidateHeap=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:GlobalFastLoad=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:======================= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csMachineName=\\mymachine [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csUsersDomain=mydomain [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csUsersAccount=myuser [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csWinDir=C:\WINNT [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csSysDir=C:\WINNT\system32 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csSysDrive=C: [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathNTSrcDir=C:\ [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathSource=C:\WINNT\system32 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathOldInetsrv=C:\WINNT\system32\inetsrv [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathInetsrv=C:\WINNT\system32\inetsrv [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathInetpub=C:\Inetpub [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathFTPRoot=C:\Inetpub\ftproot [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathWWWRoot=C:\Inetpub\wwwroot [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathWebPub=C:\Inetpub\webpub [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathProgramFiles=C:\Program Files [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathIISSamples=C:\Inetpub\iissamples [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathScripts=C:\Inetpub\Scripts [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathASPSamp=C:\Inetpub\ASPSamp [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathAdvWorks=C:\Inetpub\ASPSamp\AdvWorks [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathIASDocs=C:\WINNT\system32\inetsrv\Docs [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathOldPWSFiles= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathOldPWSSystemFiles= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:OS=NT [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_eNTOSType=OT_NTW (Workstation) [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPlatform=x86 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_dwNumberOfProcessors=1 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:OSVersion=5 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_dwOSBuild=0 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_dwOSServicePack=0x0 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fTCPIP Exists=1 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_eUpgradeType=UT_NONE [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_eInstallMode=IM_MAINTENANCE [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_dwSetupMode=SETUPMODE_MAINTENANCE [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_dwSetupMode=SETUPMODE_MAINTENANCE | SETUPMODE_ADDREMOVE [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_bPleaseDoNotInstallByDefault=0 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_eAction=AT_DO_NOTHING [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fNTOperationFlags=0x10 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fNTGuiMode=0 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fInvokedByNT=1 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fNtWorkstation=1 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_fUnattended=0 [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csUnattendFile= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:m_csPathSrcDir= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:======================= [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:[iis,(null)] Start. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_common] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_inetmgr] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_pwmgr] = AT_DO_NOTHING. Original=0, Current=0. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_www] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_doc] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_ftp] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_ftp] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_www] = AT_INSTALL_FRESH. Original=0, Current=1. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:Action of [iis_core] = AT_INSTALL_FRESH. [3/30/2005 10:51:59] OC_QUEUE_FILE_OPS:ProcessSection.[OC_QUEUE_FILE_OPS].Start. The errors: [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll(C:\WINNT\system32\inets rv\iscomlog.dll): DllRegisterServer [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:iOleInitialize: Succeeded: 0. MakeSure to call OleUninitialize. [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll: Calling 'DllRegisterServer'.Start [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll: Calling 'DllRegisterServer'.End.SUCCESS. [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:------------------ [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:...ProcessEntry:100=86... [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:...ProcessEntry:100=2... [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:------------------ [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll(C:\WINNT\system32\inets rv\logscrpt.dll): DllRegisterServer [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:iOleInitialize: Succeeded: 0. MakeSure to call OleUninitialize. [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll: Calling 'DllRegisterServer'.Start [3/30/2005 10:54:56] OC_COMPLETE_INSTALLATION:iis_core:MyMessageBox: Title:IIS Setup Error, Msg:Error calling procedure 'DllRegisterServer()' in file 'C:\WINNT\system32\inetsrv\logscrpt.dll'. 0x8007007e=The specified module could not be found. [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:!FAIL! [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll: Calling 'DllRegisterServer'.End.FAILED. Err=8007007e. [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:------------------ [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:MyMessageBox: Title:IIS Setup Error, Msg:Do you want to retry? [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:...ProcessEntry:100=2... [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:------------------ [3/30/2005 10:54:57] OC_COMPLETE_INSTALLATION:iis_core:CallProcedureInDll(C:\WINNT\system32\inets rv\admexs.dll): DllRegisterServer [3/30/2005 10:55:21] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll(C:\WINNT\system32\inetsr v\asp.dll): DllRegisterServer [3/30/2005 10:55:21] OC_COMPLETE_INSTALLATION:iis_www:iOleInitialize: Succeeded: 0. MakeSure to call OleUninitialize. [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll: Calling 'DllRegisterServer'.Start [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll: Calling 'DllRegisterServer'.End.SUCCESS. [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:------------------ [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:...ProcessEntry:100=2... [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:------------------ [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll(C:\WINNT\system32\inetsr v\asptxn.dll): DllRegisterServer [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:iOleInitialize: Succeeded: 0. MakeSure to call OleUninitialize. [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll: Calling 'DllRegisterServer'.Start [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:MyMessageBox: Title:IIS Setup Error, Msg:Error calling procedure 'DllRegisterServer()' in file 'C:\WINNT\system32\inetsrv\asptxn.dll'. 0x8007007e=The specified module could not be found. [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:!FAIL! [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll: Calling 'DllRegisterServer'.End.FAILED. Err=8007007e. [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:------------------ [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:MyMessageBox: Title:IIS Setup Error, Msg:Do you want to retry? [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:...ProcessEntry:100=2... [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:------------------ [3/30/2005 10:55:22] OC_COMPLETE_INSTALLATION:iis_www:CallProcedureInDll(C:\WINNT\system32\inetsr v\adrot.dll): DllRegisterServer Any thoughts on why these two dlls won't register? TIA Tag: Port 1043 with IIS Tag: 359285
  - 18
    - IIS and .NET State Hello -- I'm using IIS on four W2K3 servers in a network load balancing server farm. There is one back-end state server running the .NET State Server. Each IIS server is configured with "StateServer" parameter pointing to the state server. My question is this... does anyone know of any scripts and/or programs to determine what IIS server a particular user is on? I'm trying to troubleshoot problems and want a reliable way to determine what server a user is accessing when a problem occurs. I've created a showip.htm file on each server that has the server's IP address in it so I can identify. Opinions? Tag: Port 1043 with IIS Tag: 359283
  - 19
    - NTLast Has anyone had success using Foundstone's NTLast for audit and/or review of IIS 5, and IIS 6 logs? I've used this utility in the past for IIS 4 log monitoring, but am receiving the following error when attempting to use on IIS 5, IIS 6: "No Records - Check to see if auditing is on". Auditing is on, logs are populated with events. Any thoughts are appreciated. Tag: Port 1043 with IIS Tag: 359282
  - 20
    - IIS inetinfo.exe problem hi all, These 2 days when I start to use my IIS, I found that there is a process called "inetinfo.exe" eats up 100% of my CPU, it didn't happen before, wondering how am I going to fix it as it just stopped me from loading my page properly. Many thanks for any input and opinions. Tag: Port 1043 with IIS Tag: 359281
  - 21
    - need a script to zip the logfiles from the day before hi all, anyone knows a script to compress & archive the iis logfiles from the day before. so after ziping the file it can be deleted. would be nice to have such a script. i dont need application with 5000 features. thx for your good ideas :) and keep good work up people!!! Tag: Port 1043 with IIS Tag: 359277
  - 22
    - IIS: configuring secure FTP service Hello, I would like to know whether it is possible to configure IIS to do Secure FTP so as to make it compatible with the Unix scp (secure copy) and sftp (secure ftp) commands as well as the pscp and psftp commands from the putty family of windows clients found at: http://www.chiark.greenend.org.uk/~sgtatham/putty/ Thanks, Neil Tag: Port 1043 with IIS Tag: 359274
  - 23
    - Where can I download IIS 5.0 Anyone? Where can I download IIS 5.0? Tag: Port 1043 with IIS Tag: 359269
  - 24
    - Results of ADPlus Hello, I ran "ADPLus.vbs -iis -hang" when my IIS site froze recently, and now have a .dmp and a .log file. How can I analyse these to actually find out what is causing my site to lock up? The site is running on W2K IIS5 in High (Isolated) mode. The site isn't completely locked up, .htm displays fine and sometimes even .asp pages will display - but users are unable to login (which is where the site first talks to the database - SQL 7 on a separate server). Resetting IIS resumes service. Help! This has been going on for over a year but is now becoming more frequent as usage increases, so that it has happened only 2 days apart. Tag: Port 1043 with IIS Tag: 359259
  - 25
    - Why is IIS giving me a password prompt? I cannot seem to get rid of the password dialog box when making connections to IIS. It wasnt doing it at first, but then i installed php and phpbb and it starting asking for a username and password. i thought it was just password protecting the phpbb directory but later found out that all web services handled by IIS are responging with a password prompt. Can someone please email me a little step by step instruction to get rid of this password box liljdirty@gmail.com Tag: Port 1043 with IIS Tag: 359256
- Next
  - 1
    - How to setup to host 2 web pages I have created 2 webpages using FP2003--and I am self-hosting them using IIS. The first web page, www.gradygroup.com, works great. I just transferred the DNS of the second web page, www.gradysgrillhouse.com, to my web server. I created a sub web for the new web page, but I am stuck on how to configure it. Both wepages are now being sent to the first webpage's index.htm. Advanced IP Properties in IIS have 2 entries: first, IP Adress is Default, Port 80 and Host Header name is empty. I have the second as IP Addres Default, Port 80, and Host Header as www.gradysgrillhouse.com. I obviously am not sure about what I am doing! Any advice, or pointing me to a Kb article would be welcomed. This also may very well be the wrong group to post this in. I could not find a IIS link-so redirect me if necessary. TIA Chris Tag: Port 1043 with IIS Tag: 359255
  - 2
    - Upgrade IIS in Windows XP Pro? Is it possible to install IIS 6 onto Windows XP Pro? If not, is it possible to upgrade the IIS5.1 to add more powerful features such as hosting multiple websites? Any idea as to how this can be done? Tag: Port 1043 with IIS Tag: 359245
  - 3
    - multiple ips not working Using IIS 6.0. I'm running two sites on a server. Using one NIC per site. Both NICS register in the AD domain and some users are unable to hit one of the sites because they're resolving the machine name to the wrong IP. I've tried not pointing one of the NICs towards any DNS server, but after a while it re-registers and the problem starts again. How do I set this up to work correctly? thanks Tag: Port 1043 with IIS Tag: 359230
  - 4
    - Best steps to diagnose problems I just recently started having a LOT of problems with my IIS server. Scripts are taking forever to run, session variables keep blanking out, etc. What are the best steps for me to try to diagnose the problem? Is there a guide somewhere? I set up a new app pool for the site, but how do I know what ID it is, and how do I attatch IISState. After I have that dump information, what do I do with it? I guess I'm kind of lost at this point as this is the first time I've had any problems with IIS. Thanks for any direction. -Phil Tag: Port 1043 with IIS Tag: 359221
  - 5
    - no display of files on drive with asp/localhost Tried to display with an asp file, files stored on my drive C: On internet DL several different asp scripts. All same thing. ASP Script with viewing drives: no problem ASP Script with viewing folders: no problem ASP Script with viewing files: big problem ! When I run the Asp Script, I only see "waiting for localhost". I have tried several differnet PC's on different locations (not same network or so.) All With XP Prof and IIS running. Also seen the same script(s) working on a PC with a different webserver. Is this something you have to change within the IIS settings, or is this just not possible with IIS? Any help would be very much appreciated, Kind regards, Edwin Tag: Port 1043 with IIS Tag: 359220
  - 6
    - IISState - IIS has crashed... I was wondering is someone can help me diagnose this IISState log file Opened log file 'C:\iisstate\output\IISState-1912.log' *********************** Starting new log output IISState version 3.3.1 Tue Mar 29 11:44:45 2005 OS = Windows 2000 Executable: inetinfo.exe PID = 1912 Note: Thread times are formatted as HH:MM:SS.ms *********************** IIS has crashed... Beginning Analysis DLL (!FunctionName) that failed: ntdll!DbgBreakPoint Thread ID: 62 System Thread ID: 4ec Kernel Time: 0:0:0.453 User Time: 0:0:0.843 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0956f544 77fb76aa ntdll!DbgBreakPoint 01 0956f54c 77fcfb72 ntdll!RtlpBreakPointHeap+0x26 02 0956f56c 77fcd020 ntdll!RtlpFindAndCommitPages+0x1f0 03 0956f5a4 77fccdc1 ntdll!RtlpExtendHeap+0x9e 04 0956f780 77a65512 ntdll!RtlAllocateHeap+0x3b6 05 0956f790 77a65540 ole32!CRetailMalloc_Alloc+0x12 06 0956f79c 77d38b34 ole32!CoTaskMemAlloc+0xf 07 0956f7a8 77d38291 RPCRT4!NdrOleAllocate+0xb 08 0956f7bc 77d3756b RPCRT4!NdrAllocate+0x3d 09 0956f7d8 77d934d9 RPCRT4!NdrOutInit+0x7f 0a 0956fa54 77d93a2c RPCRT4!NdrStubCall2+0x534 0b 0956fab8 77b24584 RPCRT4!CStdStubBuffer_Invoke+0xc8 0c 0956fafc 77b2485f ole32!SyncStubInvoke+0x61 0d 0956fb44 77ab7881 ole32!StubInvoke+0xa8 0e 0956fba8 77aa9c8f ole32!CCtxComChnl::ContextInvoke+0xbb 0f 0956fbc4 77b24469 ole32!MTAInvoke+0x18 10 0956fbf4 77b24bab ole32!AppInvoke+0xb5 11 0956fcb4 77b22360 ole32!ComInvokeWithLockAndIPID+0x2b5 12 0956fcf4 77d321e0 ole32!ThreadInvoke+0x1b7 13 0956fd2c 77d320fe RPCRT4!DispatchToStubInC+0x32 14 0956fd84 77d32021 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x100 15 0956fda4 77d389cc RPCRT4!RPC_INTERFACE::DispatchToStub+0x5e 16 0956fdd4 77d37526 RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0xa9 17 0956fe10 77d37030 RPCRT4!LRPC_SCALL::DealWithRequestMessage+0x1cd 18 0956fe28 77d37c1d RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0x10c 19 0956ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x229 1a 0956ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 1b 0956ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 1c 0956ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 1d 0956ffec 00000000 KERNEL32!BaseThreadStart+0x52 Closing open log file C:\iisstate\output\IISState-1912.log Opened log file 'C:\iisstate\output\IISState-1912.log' *********************** Starting new log output IISState version 3.3.1 Tue Mar 29 11:44:46 2005 OS = Windows 2000 Executable: inetinfo.exe PID = 1912 Note: Thread times are formatted as HH:MM:SS.ms *********************** Thread ID: 0 System Thread ID: 774 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb 01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181 02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28 03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a 04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d 05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1 06 0006ff70 01002fbf inetinfo!main+0x654 07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff 08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d Thread ID: 1 System Thread ID: 790 Kernel Time: 0:0:0.46 User Time: 0:0:0.93 Thread Type: Other # ChildEBP RetAddr 00 005dfd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 005dfd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 005dfd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf 03 005dfd70 01002440 iisadmin!ServiceEntry+0x156 04 005dffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 05 005dffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe 06 005dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 2 System Thread ID: 7ac Kernel Time: 0:2:10.453 User Time: 0:0:39.562 Thread Type: Other # ChildEBP RetAddr 00 0071fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0071feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0071ff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0071ffb4 7c57438b MSVCRT!_endthreadex+0xc1 06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 3 System Thread ID: 7b0 Kernel Time: 0:2:10.109 User Time: 0:0:39.218 Thread Type: Other # ChildEBP RetAddr 00 0075fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0075feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0075ff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 0075ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0075ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0075ffb4 7c57438b MSVCRT!_endthreadex+0xc1 06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 4 System Thread ID: 7c4 Kernel Time: 0:0:0.140 User Time: 0:0:0.62 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 00e4fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 00e4fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 00e4fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 00e4fce4 769c4e3f USER32!MsgWaitForMultipleObjects+0x1d 04 00e4fd30 6b561a78 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209 05 00e4fd70 01002440 SMTPSVC!ServiceEntry+0x136 06 00e4ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 07 00e4ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe 08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 5 System Thread ID: 7c8 Kernel Time: 0:0:0.140 User Time: 0:0:0.187 Thread Type: Other # ChildEBP RetAddr 00 00e8fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 00e8fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 00e8fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 00e8fce4 769c4e3f USER32!MsgWaitForMultipleObjects+0x1d 04 00e8fd30 65f2d991 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209 05 00e8fd70 01002440 w3svc!ServiceEntry+0x1b5 06 00e8ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd 07 00e8ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe 08 00e8ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 6 System Thread ID: 848 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0104ff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0104ff88 6d70b2fa KERNEL32!GetQueuedCompletionStatus+0x27 02 0104ffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32 03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 7 System Thread ID: 8a0 Kernel Time: 0:0:22.515 User Time: 0:0:13.93 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0108ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0108ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0108ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 8 System Thread ID: 8a4 Kernel Time: 0:0:9.312 User Time: 0:0:6.796 Thread Type: HTTP Listener # ChildEBP RetAddr 00 010cff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 010cff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 010cffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 010cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 9 System Thread ID: 8b4 Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0140fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0140ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0140ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0140ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f 04 0140ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0140ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 10 System Thread ID: 8b8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0148fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0148fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 0148fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17 03 0148ffb4 7c57438b RTUTILS!TraceServerThread+0xde 04 0148ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 11 System Thread ID: 8bc Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 014dfeb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 014dfee4 77d31394 KERNEL32!GetQueuedCompletionStatus+0x27 02 014dff20 77d3e93f RPCRT4!COMMON_ProcessCalls+0x9e 03 014dff74 77d3e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99 04 014dff78 77d35924 RPCRT4!ProcessIOEventsWrapper+0x9 05 014dffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 06 014dffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 07 014dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 12 System Thread ID: 8c8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0151ff20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0151ff70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 0151ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17 03 0151ffb4 7c57438b exstrace!RegNotifyThread+0x6f 04 0151ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 13 System Thread ID: 8cc Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0155ff24 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0155ff74 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 0155ff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17 03 0155ffb4 7c57438b exstrace!WriteTraceThread+0x2f 04 0155ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 14 System Thread ID: 8d0 Kernel Time: 0:0:0.156 User Time: 0:0:2.234 Thread Type: Other # ChildEBP RetAddr 00 016dff64 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 016dff8c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 016dff9c 6ff2841e KERNEL32!WaitForSingleObject+0xf 03 016dffb4 7c57438b FCACHDLL!CScheduleThread::ScheduleThread+0x22 04 016dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 15 System Thread ID: 8d4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 0181ff18 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 0181ff68 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 0181ff80 6b57b026 KERNEL32!WaitForMultipleObjects+0x17 03 0181ffb4 7c57438b SMTPSVC!TcpRegNotifyThread+0x136 04 0181ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 16 System Thread ID: 8d8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 0185ff68 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 0185ff90 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 0185ffa0 6b57ae5a KERNEL32!WaitForSingleObject+0xf 03 0185ffb4 7c57438b SMTPSVC!FreeLibThread+0x1d 04 0185ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 17 System Thread ID: 8e0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Compression Thread # ChildEBP RetAddr 00 0191ff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 0191ff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 0191ff94 732c3366 KERNEL32!WaitForSingleObject+0xf 03 0191ffb4 7c57438b compfilt!CompressionThread+0x29 04 0191ffc0 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 18 System Thread ID: 80c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 01a3fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 01a3fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 01a3fe08 750312f5 msafd!WSPSelect+0x24e 03 01a3fe6c 6e2b3b6e WS2_32!select+0xe7 04 01a3ffb4 7c57438b inetsloc!SocketListenThread+0x51 05 01a3ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 19 System Thread ID: 828 Kernel Time: 0:0:0.46 User Time: 0:0:0.93 Thread Type: Other # ChildEBP RetAddr 00 01aefe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 01aefec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 01aeff1c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 01aeff38 65f38b60 USER32!MsgWaitForMultipleObjects+0x1d 04 01aeff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42 05 01aeffb4 7c57438b MSVCRT!_endthread+0xc6 06 01aeffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 20 System Thread ID: 7f4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 01b2fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 01b2fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea 02 01b2ff54 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153 03 01b2ff70 65f2e74b USER32!MsgWaitForMultipleObjects+0x1d 04 01b2ffb4 7c57438b w3svc!OleHackThread+0x88 05 01b2ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 21 System Thread ID: 998 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 01beff54 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 01beff7c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 01beff8c 741a99cd KERNEL32!WaitForSingleObject+0xf 03 01beffb4 7c57438b aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce 04 01beffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 22 System Thread ID: 9a0 Kernel Time: 0:0:0.62 User Time: 0:0:0.31 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 01c6fed0 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 01c6ff20 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 01c6ff38 741900e1 KERNEL32!WaitForMultipleObjects+0x17 03 01c6ff9c 6b56dccd aqueue!CConnMgr::GetNextConnection+0x1da 04 01c6ffb4 7c57438b SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x23 05 01c6ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 23 System Thread ID: 9ac Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 01d0fdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 01d0fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 01d0ff24 750312f5 msafd!WSPSelect+0x24e 03 01d0ff88 6d7062b4 WS2_32!select+0xe7 04 01d0ffb0 6d706605 ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22 05 01d0ffb4 7c57438b ISATQ!BmonThreadFunc+0x9 06 01d0ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 24 System Thread ID: 7f0 Kernel Time: 0:0:0.31 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 01d4ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb 01 01d4ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9 02 01d4ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 25 System Thread ID: 9b0 Kernel Time: 0:0:0.46 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 01d8ff9c 77f842c4 ntdll!NtDelayExecution+0xb 01 01d8ffb4 7c57438b ntdll!RtlpTimerThread+0x42 02 01d8ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 26 System Thread ID: 9c0 Kernel Time: 0:0:18.703 User Time: 0:0:10.968 Thread Type: HTTP Listener # ChildEBP RetAddr 00 01e8ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 01e8ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 01e8ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 01e8ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 27 System Thread ID: 9c4 Kernel Time: 0:0:18.828 User Time: 0:0:9.406 Thread Type: HTTP Listener # ChildEBP RetAddr 00 01ecff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 01ecff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 01ecffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 01ecffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 28 System Thread ID: 51c Kernel Time: 0:0:16.750 User Time: 0:0:9.46 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0329ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0329ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0329ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0329ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 29 System Thread ID: 95c Kernel Time: 0:0:0.109 User Time: 0:0:0.46 Thread Type: Idle ASP thread # ChildEBP RetAddr 00 034dff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 034dff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 034dff70 787f58ce KERNEL32!WaitForMultipleObjects+0x17 03 034dffb4 7c57438b COMSVCS!CEventDispatcher::PushEvents+0x4e 04 034dffc0 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 30 System Thread ID: 940 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. Remote call is either to a MTA object or object not initialized. Also, possible utility thread. DCOM call being made to Process ID: 2572 Waiting on thread id: ffffffff # ChildEBP RetAddr 00 0351fb68 77d4256d ntdll!ZwRequestWaitReplyPort+0xb 01 0351fb94 77d3ac56 RPCRT4!LRPC_CCALL::SendReceive+0x11e 02 0351fba0 77b25b87 RPCRT4!I_RpcSendReceive+0x2c 03 0351fbc0 77b25a52 ole32!ThreadSendReceive+0xef 04 0351fbd8 77b22ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14f 05 0351fc18 77b258c6 ole32!CRpcChannelBuffer::SendReceive2+0x96 06 0351fc28 77a6cb5d ole32!CRpcChannelBuffer::SendReceive+0x11 07 0351fc88 77ab74c3 ole32!CAptRpcChnl::SendReceive+0xa9 08 0351fce0 77d94c1a ole32!CCtxComChnl::SendReceive+0x124 09 0351fcfc 77d9487d RPCRT4!NdrProxySendReceive+0x4c 0a 0351ff44 77d95136 RPCRT4!NdrClientCall2+0x4f5 0b 0351ff60 77d46e75 RPCRT4!ObjectStublessClient+0x76 0c 0351ff70 787f5818 RPCRT4!ObjectStubless+0xf 0d 0351ffb4 7c57438b COMSVCS!CEventDispatcher::GetEventServerInfoThread+0x118 0e 0351ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 31 System Thread ID: aec Kernel Time: 0:0:20.765 User Time: 0:0:11.671 Thread Type: HTTP Listener # ChildEBP RetAddr 00 035dff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 035dff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 035dffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 035dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 32 System Thread ID: af8 Kernel Time: 0:0:28.750 User Time: 0:0:17.421 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0365ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0365ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0365ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0365ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 33 System Thread ID: b08 Kernel Time: 0:0:19.250 User Time: 0:0:13.421 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0371ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0371ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0371ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0371ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 34 System Thread ID: a54 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0947ff20 77f838a5 ntdll!ZwRemoveIoCompletion+0xb 01 0947ffb4 7c57438b ntdll!RtlpWorkerThread+0x6b 02 0947ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 35 System Thread ID: b88 Kernel Time: 0:0:13.15 User Time: 0:0:8.875 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0381ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0381ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0381ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0381ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 36 System Thread ID: b94 Kernel Time: 0:0:27.281 User Time: 0:0:16.15 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0385ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0385ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0385ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0385ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 37 System Thread ID: b9c Kernel Time: 0:0:16.671 User Time: 0:0:10.203 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0389ee80 7c573b28 ntdll!ZwWaitForSingleObject+0xb 01 0389eea8 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71 02 0389eeb8 65f17181 KERNEL32!WaitForSingleObject+0xf 03 0389f678 65f16cf0 w3svc!HTTP_REQUEST::ProcessCGI+0x404 04 0389fd48 65f281b8 w3svc!HTTP_REQUEST::ProcessGateway+0x3b9 05 0389fec4 65f19a4e w3svc!HTTP_REQUEST::DoWork+0x43f 06 0389fee4 65f193e0 w3svc!CLIENT_CONN::DoWork+0x1aa 07 0389ff08 65f192ff w3svc!CreateClient+0x7b 08 0389ff4c 6d708753 w3svc!W3OnConnectEx+0x118 09 0389ff80 6d708a43 ISATQ!AtqpProcessContext+0x23e 0a 0389ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8 0b 0389ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 38 System Thread ID: ba8 Kernel Time: 0:0:17.812 User Time: 0:0:9.765 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0391ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0391ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0391ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0391ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 39 System Thread ID: bb4 Kernel Time: 0:0:19.375 User Time: 0:0:12.843 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03b9ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 03b9ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 03b9ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 03b9ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 40 System Thread ID: bb0 Kernel Time: 0:0:22.531 User Time: 0:0:12.703 Other information: Thread is waiting for a lock to be released. Looking for lock owner. Owning thread System ID: 4ec Thread Type: HTTP Listener # ChildEBP RetAddr 00 03b5eb48 77f8822a ntdll!ZwWaitForSingleObject+0xb 01 03b5ebbc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e 02 03b5ebc4 77fcc21a ntdll!RtlEnterCriticalSection+0x46 03 03b5ed9c 7c5763ef ntdll!RtlAllocateHeap+0x177 04 03b5edb8 7c5767de KERNEL32!GetEnvironmentStringsW+0x52 05 03b5ee3c 7c5768f8 KERNEL32!LoadLibraryExW+0x187 06 03b5ee4c 7c57692b KERNEL32!LoadLibraryExA+0x1d 07 03b5ee6c 7c2f6a4c KERNEL32!LoadLibraryA+0xaa 08 03b5ee94 65f171b1 ADVAPI32!CreateProcessAsUserA+0x10e 09 03b5f678 65f16cf0 w3svc!HTTP_REQUEST::ProcessCGI+0x434 0a 03b5fd48 65f281b8 w3svc!HTTP_REQUEST::ProcessGateway+0x3b9 0b 03b5fec4 65f19a4e w3svc!HTTP_REQUEST::DoWork+0x43f 0c 03b5fee4 65f193e0 w3svc!CLIENT_CONN::DoWork+0x1aa 0d 03b5ff08 65f192ff w3svc!CreateClient+0x7b 0e 03b5ff4c 6d708753 w3svc!W3OnConnectEx+0x118 0f 03b5ff80 6d708a43 ISATQ!AtqpProcessContext+0x23e 10 03b5ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8 11 03b5ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 41 System Thread ID: c08 Kernel Time: 0:0:29.562 User Time: 0:0:16.484 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03bdff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 03bdff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 03bdffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 03bdffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 42 System Thread ID: 718 Kernel Time: 0:0:19.156 User Time: 0:0:13.640 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03c1ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 03c1ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 03c1ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 03c1ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 43 System Thread ID: c28 Kernel Time: 0:0:21.843 User Time: 0:0:12.671 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03eaff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 03eaff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 03eaffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 03eaffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 44 System Thread ID: c2c Kernel Time: 0:0:30.687 User Time: 0:0:19.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03eeff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 03eeff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 03eeffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 03eeffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 45 System Thread ID: c3c Kernel Time: 0:0:27.125 User Time: 0:0:18.421 Thread Type: HTTP Listener # ChildEBP RetAddr 00 03f6f85c 7c5789be ntdll!ZwReadFile+0xb 01 03f6f8d0 769da3c3 KERNEL32!ReadFile+0x125 02 03f6f914 769d9453 INFOCOMM!ReadFileIntoMemoryCache+0xdd 03 03f6fbc8 769d9165 INFOCOMM!TspOpenCachedFileHelper+0x281 04 03f6fbec 769d8d03 INFOCOMM!TspOpenCachedFile+0x73 05 03f6fd18 769d8e59 INFOCOMM!TsCreateFile+0x130 06 03f6fd48 65f1bfef INFOCOMM!TsCreateFileFromURI+0x10a 07 03f6fda8 65f28214 w3svc!HTTP_REQUEST::DoGet+0x1c4 08 03f6ff18 65f19a4e w3svc!HTTP_REQUEST::DoWork+0x49b 09 03f6ff38 65f1a895 w3svc!CLIENT_CONN::DoWork+0x1aa 0a 03f6ff4c 6d70877b w3svc!W3Completion+0x43 0b 03f6ff80 6d708a43 ISATQ!AtqpProcessContext+0x266 0c 03f6ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8 0d 03f6ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 46 System Thread ID: c5c Kernel Time: 0:0:16.968 User Time: 0:0:11.250 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0402ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0402ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0402ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0402ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 47 System Thread ID: c60 Kernel Time: 0:0:17.0 User Time: 0:0:10.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0406ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0406ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0406ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0406ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 48 System Thread ID: cc0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0412fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0412ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0412ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0412ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f 04 0412ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0412ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 49 System Thread ID: ec0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 04a5ff58 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 04a5ff84 65f0fab2 KERNEL32!GetQueuedCompletionStatus+0x27 02 04a5ffb0 65f0ff9e w3svc!W3_LIMIT_JOB_THREAD::LimitThreadProc+0x20 03 04a5ffb4 7c57438b w3svc!W3_LIMIT_JOB_THREAD::LimitThreadProcStub+0x9 04 04a5ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 50 System Thread ID: e90 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 056fff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb 01 056fff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea 02 056fff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17 03 056fffb4 7c57438b USERENV!NotificationThread+0x5f 04 056fffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 51 System Thread ID: 440 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: WebDav Worker Thread # ChildEBP RetAddr 00 0730ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0730ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27 02 0730ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23 03 0730ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30 04 0730ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 52 System Thread ID: e48 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: WebDav Worker Thread # ChildEBP RetAddr 00 0734ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0734ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27 02 0734ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23 03 0734ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30 04 0734ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 53 System Thread ID: dd0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: WebDav Worker Thread # ChildEBP RetAddr 00 0738ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0738ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27 02 0738ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23 03 0738ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30 04 0738ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 54 System Thread ID: 9b8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: WebDav Worker Thread # ChildEBP RetAddr 00 073cff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 073cff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27 02 073cff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23 03 073cffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30 04 073cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 55 System Thread ID: f20 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: WebDav Worker Thread # ChildEBP RetAddr 00 0740ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0740ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27 02 0740ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23 03 0740ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30 04 0740ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 56 System Thread ID: ad8 Kernel Time: 0:0:19.156 User Time: 0:0:11.437 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0774ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0774ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0774ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0774ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 57 System Thread ID: e98 Kernel Time: 0:0:30.921 User Time: 0:0:19.156 Thread Type: HTTP Listener # ChildEBP RetAddr 00 07b6f85c 7c5789be ntdll!ZwReadFile+0xb 01 07b6f8d0 769da3c3 KERNEL32!ReadFile+0x125 02 07b6f914 769d9453 INFOCOMM!ReadFileIntoMemoryCache+0xdd 03 07b6fbc8 769d9165 INFOCOMM!TspOpenCachedFileHelper+0x281 04 07b6fbec 769d8d03 INFOCOMM!TspOpenCachedFile+0x73 05 07b6fd18 769d8e59 INFOCOMM!TsCreateFile+0x130 06 07b6fd48 65f1bfef INFOCOMM!TsCreateFileFromURI+0x10a 07 07b6fda8 65f28214 w3svc!HTTP_REQUEST::DoGet+0x1c4 08 07b6ff18 65f19a4e w3svc!HTTP_REQUEST::DoWork+0x49b 09 07b6ff38 65f1a895 w3svc!CLIENT_CONN::DoWork+0x1aa 0a 07b6ff4c 6d70877b w3svc!W3Completion+0x43 0b 07b6ff80 6d708a43 ISATQ!AtqpProcessContext+0x266 0c 07b6ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8 0d 07b6ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 58 System Thread ID: d38 Kernel Time: 0:0:11.265 User Time: 0:0:6.625 Thread Type: HTTP Listener # ChildEBP RetAddr 00 092bff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 092bff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 092bffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 092bffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 59 System Thread ID: afc Kernel Time: 0:0:9.796 User Time: 0:0:5.921 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0997ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0997ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0997ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0997ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 60 System Thread ID: 10cc Kernel Time: 0:0:13.375 User Time: 0:0:8.953 Thread Type: HTTP Listener # ChildEBP RetAddr 00 09a9ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 09a9ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 09a9ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 09a9ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 61 System Thread ID: f10 Kernel Time: 0:0:11.187 User Time: 0:0:5.609 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0acaff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0acaff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0acaffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0acaffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 62 System Thread ID: 4ec Kernel Time: 0:0:0.453 User Time: 0:0:0.843 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0956f544 77fb76aa ntdll!DbgBreakPoint 01 0956f54c 77fcfb72 ntdll!RtlpBreakPointHeap+0x26 02 0956f56c 77fcd020 ntdll!RtlpFindAndCommitPages+0x1f0 03 0956f5a4 77fccdc1 ntdll!RtlpExtendHeap+0x9e 04 0956f780 77a65512 ntdll!RtlAllocateHeap+0x3b6 05 0956f790 77a65540 ole32!CRetailMalloc_Alloc+0x12 06 0956f79c 77d38b34 ole32!CoTaskMemAlloc+0xf 07 0956f7a8 77d38291 RPCRT4!NdrOleAllocate+0xb 08 0956f7bc 77d3756b RPCRT4!NdrAllocate+0x3d 09 0956f7d8 77d934d9 RPCRT4!NdrOutInit+0x7f 0a 0956fa54 77d93a2c RPCRT4!NdrStubCall2+0x534 0b 0956fab8 77b24584 RPCRT4!CStdStubBuffer_Invoke+0xc8 0c 0956fafc 77b2485f ole32!SyncStubInvoke+0x61 0d 0956fb44 77ab7881 ole32!StubInvoke+0xa8 0e 0956fba8 77aa9c8f ole32!CCtxComChnl::ContextInvoke+0xbb 0f 0956fbc4 77b24469 ole32!MTAInvoke+0x18 10 0956fbf4 77b24bab ole32!AppInvoke+0xb5 11 0956fcb4 77b22360 ole32!ComInvokeWithLockAndIPID+0x2b5 12 0956fcf4 77d321e0 ole32!ThreadInvoke+0x1b7 13 0956fd2c 77d320fe RPCRT4!DispatchToStubInC+0x32 14 0956fd84 77d32021 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x100 15 0956fda4 77d389cc RPCRT4!RPC_INTERFACE::DispatchToStub+0x5e 16 0956fdd4 77d37526 RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0xa9 17 0956fe10 77d37030 RPCRT4!LRPC_SCALL::DealWithRequestMessage+0x1cd 18 0956fe28 77d37c1d RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0x10c 19 0956ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x229 1a 0956ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 1b 0956ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 1c 0956ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 1d 0956ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 63 System Thread ID: e70 Kernel Time: 0:0:1.406 User Time: 0:0:2.78 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 093aff74 77d359a3 ntdll!NtDelayExecution+0xb 01 093affa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0xc3 02 093affb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 03 093affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 64 System Thread ID: c34 Kernel Time: 0:0:5.578 User Time: 0:0:2.984 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0aceff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0aceff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0aceffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0aceffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 65 System Thread ID: 11ac Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 095aff80 74fd6363 ntdll!ZwRemoveIoCompletion+0xb 01 095affb4 7c57438b msafd!SockAsyncThread+0x52 02 095affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 66 System Thread ID: cb4 Kernel Time: 0:0:4.625 User Time: 0:0:5.546 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0ad7fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0ad7ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0ad7ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0ad7ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f 04 0ad7ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0ad7ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 67 System Thread ID: 1038 Kernel Time: 0:0:4.640 User Time: 0:0:6.703 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0adffe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0adfff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0adfff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0adfffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f 04 0adfffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0adfffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 68 System Thread ID: 1038 Kernel Time: 0:0:4.640 User Time: 0:0:6.703 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0adffe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0adfff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0adfff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0adfffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f 04 0adfffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0adfffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 69 System Thread ID: dd8 Kernel Time: 0:0:7.828 User Time: 0:0:5.203 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0a3eff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0a3eff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0a3effb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0a3effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 70 System Thread ID: fd0 Kernel Time: 0:0:11.906 User Time: 0:0:8.156 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0a42ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb 01 0a42ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27 02 0a42ffb4 7c57438b ISATQ!AtqPoolThread+0x40 03 0a42ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 71 System Thread ID: 123c Kernel Time: 0:0:0.31 User Time: 0:0:0.46 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0962fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0962ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0962ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0962ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0962ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0962ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 72 System Thread ID: 123c Kernel Time: 0:0:0.31 User Time: 0:0:0.46 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0962fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0962ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0962ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9 03 0962ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0962ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18 05 0962ffec 00000000 KERNEL32!BaseThreadStart+0x52 Closing open log file C:\iisstate\output\IISState-1912.log Tag: Port 1043 with IIS Tag: 359217
  - 7
    - HTTP Status Code 206 I have been reviewing our logs lately and have come across a status code that I am unable to make sense of, so I was hoping to get some thoughts from others. I am running IIS 6.0 on Windows 2003 Standard Server. The server has several virtual hosts, one of which servers as a download mirror. When someone downloads /dl/###.exe, they will typically get status code 200. However, there are occasions when someone gets status code 206. I don't see any correlation so I'm hoping someone can offer some insight. Thanks, Jason Williard Tag: Port 1043 with IIS Tag: 359216
  - 8
    - iisdump and iisdbg Hello All: I have an iis dump created by iisdump that tells me !iisdbg.clientconns and which pages are being run and then I use windbg that tells me which threads (by id) are problematic (for example using !locks). Does anyone know how I tie a connection to a thread id? For example, in the iisdump log I have: Item# 4, UL_NATIVE_REQUEST = E77998 Request State: 2 (NREQ_STATE_PROCESS) Client: IP= 66.50.24.8 / Port= 1770 (0x6EA) Server: IP= 10.50.10.4 / Port= 80 (0x50) [Not SSL/Secure] ----------------------------- GET /search.asp?q=data HTTP/1.1 How do I tell which thread this is on. Also, I have asked this before but iisdump seems to be able to run iisdbg.clientconns but I can't run it from windbg even though I'm using the same iisdbg.dll extension and the same symbol files. Thanks, Jay from iisdump logs: ================== 0:000> !version Version 5.2 (Build 3790) Multiprocessor Free 0:000> !iisdbg.clientconns from windbg: ================================================== 0:000> !iisdbg.clientconns UL_NATIVE_REQUEST listhead at: 5a369060 ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: w3dt!UL_NATIVE_REQUEST *** *** *** ************************************************************************* Unable to find NREQ state offset. Tag: Port 1043 with IIS Tag: 359214
  - 9
    - why IIS ask me for a user/pwd ? hi i'm in the development server i have full permissions... but any day, IIS began to ask me for my usr/pwd... (even) if i accept the window with blanks usr/pwd i get the pages correctly but if i cancel the window i IIS don't bring to me the page with a 401.3 ACL error i suspect the problem arise in image files since, sometimes, that user/pwd window appears several times within a page, showing a new image each time i want to test the site in the development server with no interference i have full permissions thanks -- atte, Hernán Castelo SGA - UTN - FRBA Tag: Port 1043 with IIS Tag: 359212
  - 10
    - diagnosing slow downs Will IISState info be useful for diagnosing slow downs? We have a third-party application running on IIS 6 (IIS 5 isolation mode), W2K Server Enterprise which uses a combination of ASP and static files. I restarted IIS about 30 minutes ago, and the responsiveness is noticeably slower for both static and dynamic files. It doesn't seem to get to a point where it quits serving content, but if I restart IIS the system snaps back. If I run IIS in IIS 6 worker process mode, the slowdown is actually immediate. I've looked at both the IIS and ASP performance counters on the server, and I'm not seeing anything that appears to follow the performance trends. The SQL server backend is on another box, and it's very responsive. The CPU, disk %, memory usage, etc., on both servers isn't even close to stressed. I know I can use perfmon to see indications of a memory leak in IIS, but I haven't done that yet. In addition to checking for a memory leak, is there any way I can nail down what's causing the problem? TIA! Tag: Port 1043 with IIS Tag: 359211
  - 11
    - Windows 2003 Web Edition serving ASP.NET pages painfully slow... This is a multi-part message in MIME format. ------=_NextPart_000_0013_01C53458.37CC9D10 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have a Windows 2003 Web Edition box which has asp.net and asp pages = both accessing serviced components. The components don't seem to run = slow, but the pages which are written in asp.net are rendered painfully = slow. The classic ASP pages are rendered relatively quickly. The pages are all below 35kb and include the same headers and footers = the classic ASP pages include. Also, they access through a serviced = component a couple of database stored procedure. The serviced component = calls and the stored procedure calls all take about 10 milliseconds to = run. Then the pages are served painfully slow. The same installation = is done on Windows 2003 Standard Edition and, we do not experience this. = However, the customer wants it run on the Web Edition. Any suggestions? Thanks, Rob --=20 Robert Sedor ------=_NextPart_000_0013_01C53458.37CC9D10 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2900.2604" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D2> <DIV><FONT face=3DArial size=3D2>I have a Windows 2003 Web Edition box = which has=20 asp.net and asp pages both accessing serviced components.  The = components=20 don't seem to run slow, but the pages which are written in asp.net are = rendered=20 painfully slow.  The classic ASP pages are rendered relatively=20 quickly.</FONT></DIV> <DIV> </DIV> <DIV>The pages are all below 35kb and include the same headers and = footers the=20 classic ASP pages include.  Also, they access through a serviced = component=20 a couple of database stored procedure.  The serviced component = calls and=20 the stored procedure calls all take about 10 milliseconds to run.  = Then the=20 pages are served painfully slow.  The same installation is done on = Windows=20 2003 Standard Edition and, we do not experience this.  However, the = customer wants it run on the Web Edition.</DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>Any suggestions?</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>Thanks,</FONT></DIV> <DIV><FONT face=3DArial size=3D2>Rob</FONT></DIV></FONT></DIV> <DIV><FONT face=3DArial size=3D2><BR>-- <BR>Robert = Sedor</FONT></DIV></BODY></HTML> ------=_NextPart_000_0013_01C53458.37CC9D10-- Tag: Port 1043 with IIS Tag: 359208
  - 12
    - Web Site setup Hi, I have got my web site all set up on SBS 2003 Std edition with my T1 running. For testing purposes, how come when I go to another network and type my http://ip_address I can only see my small business server welcome page? Tag: Port 1043 with IIS Tag: 359206
  - 13
    - IISAdmin Starts By Itself I am using Windows XP Professional. I have installed the IIS components to do some development. However, when I am not developing, I do not want any IIS stuff to be running, including the IIS Admin service. I have set this to manual startup in the services console. But after about 2 minutes it starts by itself. I stop the service, and check a couple of minutes later, and voila! it is running again. The only way I can keep this from happening is to disable the service. I would rather not do that since I want to do some development from time to time. How can I keep this service from starting itself when it is set to manually start? Thanks for all your help! Tag: Port 1043 with IIS Tag: 359204
  - 14
    - SBS 2003, IIS 6, Host Headers Created a new web site per microsoft knowledge base for small business server 2003 std and IIS 6. Every time I attempt to turn on my site with host header it disables "default web site"? Any help greatly appreciated Tag: Port 1043 with IIS Tag: 359202
  - 15
    - Increase CPU Allocation? I have an application where the company is using their intranet to deliver ASP reports run against their databases. Some of the more involved reports are taking quite a bit of time to create, over 5 minutes. I've been increasing the ScriptTimeout, but it has now exceeded the Connection Timeout. This report doesn't get run often, so special measures to get it working can be considered. I noticed when the report was running that there was still alot of idle CPU time. Is there a way to let IIS take more CPU time to process ASP pages? Thanks, Bernie Tag: Port 1043 with IIS Tag: 359196
  - 16
    - sql hosted on remote ASDL/SDSL for IIS asp to query ? Hi, I was wondering if someone could help. Im installing SSL in a test environment to mimic how I need to setup sql server and many different sites. The idea is to support the following: (Domain1)--->(IP 1.1.1.1 on dedicated server1)--->(Website1)--->(ASP pages website1)==SSL==>(remote sql server) (Domain2)--->(IP 1.1.1.2 on dedicated server1)--->(Website2)--->(ASP pages website2)==SSL==>(remote sql server) i.e dedicated server hosts many sites. Each site has own site and asp pages. ASP pages query own SQL SERVER using SSL. I was using the following article to understand how SSL is configured: http://support.microsoft.com/default.aspx?scid=kb;en-us;316898 1. Should I be using SPECIFIC CLIENT encryption or ENCRYPTION AT SERVER ? i.e only this dedicated server will query the sql server and only the IP can access the ssl port. i.e the asp pages query sql server using standard web user/pass. 2. This diagram shows no ssl involved in the user login to web site. To configure this should i setup my dedicated server with ENCRYPTION AT SERVER SSL host ? 3. Each SQL server will be hosted on an ADSL/SDSL conneciton and will feed back XML files to ASP pages. Does this sound feasible ? NOTE: sites would not be in public domain - limited user access. Thanks for any help. Scott Tag: Port 1043 with IIS Tag: 359195
  - 17
    - SP4 issue After upgrading a database server running Advanced Server from SP2 to SP4, I get an IIS error as explained here: http://support.microsoft.com/default.aspx?scid=kb;en-us;829427 Wondering if Microsoft has made this available for download anywhere or if it must be obtained via a call to MS staff. Does not seem like a chargeable incident, but want to be sure before I waste 2 hours on the phone... Tag: Port 1043 with IIS Tag: 359191
  - 18
    - Is this possible with IIS 5 ? Hi all ! I'm in front of a big problem with IIS. I'm trying to create a website which is located on an other computer : - my IIS server is in a domain and use "shared folder" functionnality - my "shared folder" is, in fact, a NetApp filer which is in a workgroup. Is it possible that IIS 5 accesses to shared folder whereas it is in a domain and not in the client workgroup ? Is there any doc ? I've read a lot of documentation but nothing seems to work : my NetApp always displays :"Authentification by Null login". Any help will be appreciated. Thanks :) -- Alexis Tag: Port 1043 with IIS Tag: 359181
  - 19
    - Website Question Hello All: I need to host 5 sites and only have a single external IP. If I point all 5 sites to this single IP in DNS and configure the sites to use any available IP, will this work?? Tag: Port 1043 with IIS Tag: 359177
  - 20
    - setting the home directory through dos/exe Hi I currently developing to web application simultaneously. When in development, both have to be set as the main home directory (mainly to keep site images links working - /image/image.gif) Now when switching between apps, I have to keep going into IIS and resetting the home directory. Any ideas of an easier way to do this. I imagine I could make an executable/batch file to just change the directory unless there is a cleverer way to set this up in IIS. TIA Grant Tag: Port 1043 with IIS Tag: 359169
  - 21
    - Specific 404 for single file Hi all, I need to produce a specific error for a single file that no longer exists on our site. Is this possible on IIS6? And how? I'd replace the file with the content of the error page but I really need it to produce a proper 404 for the search engines. -- Sean. Tag: Port 1043 with IIS Tag: 359168
  - 22
    - Properties changed not saved Hi all, I have a folder that has a redirect to a URL. In the redirected folder I create a Virtual Directory and select the folder it is supposed to point to. Problem is it always ends up configured as "A redirection to a URL" pointing to the same URL as the folder it's in is pointing to. What's going on? It's not saving the setting. Is there another interface as the MMC isn't makin the grade. I have tried picking different folders as the target, different URLs as the target but the setting always reverts to "A redirection to a URL" with the same URL as the folder it's in. -- Sean. Tag: Port 1043 with IIS Tag: 359167
  - 23
    - Virtual Directory I have set up a virtual directory on another server which is a member of the same domain. At the moment, everyone has full control to that folder. If you set up anonymous access to the folder via IIS you can access it. If you disable anonymous access, you cannot access the folder even though you are entering the admin username and password for the domain. This works internally mind you but not from the web. i have tried all permutaions of admin logons but to no avail. Tag: Port 1043 with IIS Tag: 359157
  - 24
    - WebDav and Drive mapping HowTo How can i map a secure WebDav drive under Xp. Server side is a 2003, ISS 6.0 Webdav Enabled server. Every thing works Ok. But. Net use q: http://83.xx.xx.xx/WebDav Works Ok. Net use q: https://83.... Does not work With ie you can open the webfolder, but how can i transform this map to a drive mapping as in net use? Th eintension is that only SSL layer may be used for security. Port 80 is blocked. THX.. Tag: Port 1043 with IIS Tag: 359155
  - 25
    - ASP Script Timeout Setting Where is the ASP script timeout setting in IIS? I know I can set a time out paramater in the script, but the error says there is a setting in IIS that can also be increased. Thanks, Bernie Tag: Port 1043 with IIS Tag: 359152

Hello, everyone. Is port 1043 used in any IIS implementation (any version)?
Thank you for your assistance.

Re: Port 1043 with IIS by Ken

Ken
Thu Mar 31 06:55:04 CST 2005

Ports greater than 1024 are generally dynamically assigned to various RPC
services. The client contacts the RPC port mapper on port 135 to find out
what high-order port the RPC service is listening on.

I believe that IIS does listen on a high-order port for remote
administration purposes (via the IIS Manager)

Cheers
Ken

--
Blog: www.adopenstatic.com/cs/blogs/ken/
Web: www.adopenstatic.com

"ThorPrime" <ThorPrime@discussions.microsoft.com> wrote in message
news:EFF4CC24-8821-4153-BC37-FC5AAB4377A9@microsoft.com...
: Hello, everyone. Is port 1043 used in any IIS implementation (any
version)?
: Thank you for your assistance.

Top