I'm having a problem with IIS 5 crashing and getting these types of
errors in the System Log. I ran the IISState tool and created a dump
file below and was wondering if someone could please look at it and
help me determine what's causing these problems. Thanks.
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 37
Date: 3/3/2004
Time: 1:46:37 PM
User: N/A
Computer: WWWTCL1
Description:
Out of process application '/LM/W3SVC/15/Root' terminated
unexpectedly.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
IISState Log file:
Opened log file 'C:\IISSTATE\output\IISState-2548.log'
***********************
Starting new log output
IISState version 3.3.1
Wed Mar 03 13:56:36 2004
OS = Windows 2000
Executable: inetinfo.exe
PID = 2548
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: 384
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c586235 ntdll!ZwReadFile+0xb
01 0006f910 7c2e0135 KERNEL32!ReadFile+0x181
02 0006f93c 7c2dffbb ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e1995 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c5987e7 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
Thread ID: 1
System Thread ID: 694
Kernel Time: 0:0:0.31
User Time: 0:0:0.62
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0059fd1c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0059fd44 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
04 0059ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
05 0059ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 2
System Thread ID: 4e8
Kernel Time: 0:0:0.109
User Time: 0:0:0.93
Thread Type: Other
# ChildEBP RetAddr
00 006dfe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 006dfeac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 006dff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 006dffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 3
System Thread ID: 4a4
Kernel Time: 0:0:0.46
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 4
System Thread ID: 5a4
Kernel Time: 0:0:0.187
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 00b7fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00b7ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b7ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b7ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b7ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 5
System Thread ID: 500
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bbff5c 7c59a0ed ntdll!NtDelayExecution+0xb
01 00bbff7c 7c59a0b8 KERNEL32!SleepEx+0x32
02 00bbff88 77ab85fc KERNEL32!Sleep+0xb
03 00bbff90 77ab46fb ole32!CROIDTable::WorkerThreadLoop+0xc
04 00bbffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 00bbffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 00bbffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 6
System Thread ID: a08
Kernel Time: 0:0:0.78
User Time: 0:0:0.109
Thread Type: Other
# ChildEBP RetAddr
00 00e0fc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00e0fc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e0fcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e0fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e0fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e0fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e0ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 00e0ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 7
System Thread ID: a00
Kernel Time: 0:0:0.0
User Time: 0:0:0.62
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 00e4fc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00e4fc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e4fcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e4fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e4fd30 6b561a78 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e4fd70 01002440 SMTPSVC!ServiceEntry+0x136
06 00e4ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 00e4ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 8
System Thread ID: 494
Kernel Time: 0:0:0.31
User Time: 0:0:0.62
Thread Type: Other
# ChildEBP RetAddr
00 00e8fc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00e8fc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e8fcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e8fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e8fd30 6fc6b2f0 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e8fd70 01002440 ftpsvc2!ServiceEntry+0xc7
06 00e8ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 00e8ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 00e8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 9
System Thread ID: 7cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f8ff5c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 00f8ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
02 00f8ffb4 7c57b382 ISATQ!I_AtqOplockThreadFunc+0x32
03 00f8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 10
System Thread ID: 158
Kernel Time: 0:0:0.203
User Time: 0:0:0.265
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00fcff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 00fcff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00fcffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 00fcffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 11
System Thread ID: 97c
Kernel Time: 0:0:0.156
User Time: 0:0:0.156
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0104ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0104ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0104ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 12
System Thread ID: a74
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0130feb8 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0130fee4 77d809da KERNEL32!GetQueuedCompletionStatus+0x27
02 0130ff20 77d50ede RPCRT4!COMMON_ProcessCalls+0x9e
03 0130ff74 77d50d17 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0130ff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
05 0130ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
06 0130ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
07 0130ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 13
System Thread ID: 350
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 013cfe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 013cff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 013cff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 013cffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 013cffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 013cffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 14
System Thread ID: 4d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0140fd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0140fd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0140fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0140ffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 0140ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 15
System Thread ID: adc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0145ff20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0145ff70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0145ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17
03 0145ffb4 7c57b382 exstrace!RegNotifyThread+0x6f
04 0145ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 16
System Thread ID: b64
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0149ff24 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0149ff74 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0149ff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17
03 0149ffb4 7c57b382 exstrace!WriteTraceThread+0x2f
04 0149ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 17
System Thread ID: 438
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 015dff00 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 015dff50 75037871 KERNEL32!WaitForMultipleObjectsEx+0xea
02 015dff6c 6fc66e80 WS2_32!WSAWaitForMultipleEvents+0x18
03 015dffb4 7c57b382
ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x39
04 015dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 18
System Thread ID: a88
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0173ff64 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0173ff8c 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0173ff9c 6ff2841e KERNEL32!WaitForSingleObject+0xf
03 0173ffb4 7c57b382 FCACHDLL!CScheduleThread::ScheduleThread+0x22
04 0173ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 19
System Thread ID: 778
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0187ff18 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0187ff68 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0187ff80 6b57b026 KERNEL32!WaitForMultipleObjects+0x17
03 0187ffb4 7c57b382 SMTPSVC!TcpRegNotifyThread+0x136
04 0187ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 20
System Thread ID: 608
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 018bff68 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 018bff90 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 018bffa0 6b57ae5a KERNEL32!WaitForSingleObject+0xf
03 018bffb4 7c57b382 SMTPSVC!FreeLibThread+0x1d
04 018bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 21
System Thread ID: 9dc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0197ff5c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0197ff84 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0197ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0197ffb4 7c57b382 compfilt!CompressionThread+0x29
04 0197ffc0 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 22
System Thread ID: acc
Kernel Time: 0:0:0.31
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 01a3fe70 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01a3fec0 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 01a3ff1c 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 01a3ff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 01a3ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 01a3ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 01a3ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 23
System Thread ID: 2f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01a7fea8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01a7fef8 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 01a7ff54 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 01a7ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 01a7ffb4 7c57b382 w3svc!OleHackThread+0x88
05 01a7ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 24
System Thread ID: b6c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01affce0 74fd1394 ntdll!NtWaitForSingleObject+0xb
01 01affd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 01affe08 750312f5 msafd!WSPSelect+0x24e
03 01affe6c 6e2b3b6e WS2_32!select+0xe7
04 01afffb4 7c57b382 inetsloc!SocketListenThread+0x51
05 01afffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 25
System Thread ID: a78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 01b3fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 01b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 01b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 01b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 01b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 01b3ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 26
System Thread ID: 904
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 01b7fdfc 74fd1394 ntdll!NtWaitForSingleObject+0xb
01 01b7fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 01b7ff24 750312f5 msafd!WSPSelect+0x24e
03 01b7ff88 6d7075bd WS2_32!select+0xe7
04 01b7ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 01b7ffb4 7c57b382 ISATQ!BmonThreadFunc+0x9
06 01b7ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 27
System Thread ID: 814
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01bcff54 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 01bcff7c 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 01bcff8c 741a99cd KERNEL32!WaitForSingleObject+0xf
03 01bcffb4 7c57b382
aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce
04 01bcffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 28
System Thread ID: 2fc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 01c4fed0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01c4ff20 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 01c4ff38 741900e1 KERNEL32!WaitForMultipleObjects+0x17
03 01c4ff9c 6b56dccd aqueue!CConnMgr::GetNextConnection+0x1da
04 01c4ffb4 7c57b382 SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x23
05 01c4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 29
System Thread ID: 228
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 01feff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 01feff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 01feffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 01feffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 30
System Thread ID: a8c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0202fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0202ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0202ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0202ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0202ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0202ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 31
System Thread ID: 338
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0207ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 0207ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 0207ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 32
System Thread ID: 790
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 020cff1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 020cff6c 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 020cff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 020cffb4 7c57b382 USERENV!NotificationThread+0x5f
04 020cffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 33
System Thread ID: 804
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0261ff08 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0261ff58 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0261ff70 787f37d4 KERNEL32!WaitForMultipleObjects+0x17
03 0261ffb4 7c57b382 comsvcs!CEventDispatcher::PushEvents+0x44
04 0261ffc0 00000008 KERNEL32!BaseThreadStart+0x52
Thread ID: 34
System Thread ID: 6a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
Remote call is either to a MTA object or object not initialized. Also,
possible utility thread.
DCOM call being made to Process ID: 1768
Waiting on thread id: ffffffff
# ChildEBP RetAddr
00 0265fb68 77d4ec77 ntdll!NtRequestWaitReplyPort+0xb
01 0265fb94 77d3a2c7 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 0265fba0 77b23b2c RPCRT4!I_RpcSendReceive+0x2c
03 0265fbc0 77b239f7 ole32!ThreadSendReceive+0xef
04 0265fbd8 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14a
05 0265fc18 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 0265fc28 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
07 0265fc88 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
08 0265fce0 77d90328 ole32!CCtxComChnl::SendReceive+0x124
09 0265fcfc 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
0a 0265ff44 77d95f85 RPCRT4!NdrClientCall2+0x4f5
0b 0265ff60 77d77fcb RPCRT4!ObjectStublessClient+0x76
0c 0265ff70 787f372e RPCRT4!ObjectStubless+0xf
0d 0265ffb4 7c57b382
comsvcs!CEventDispatcher::GetEventServerInfoThread+0x10e
0e 0265ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 35
System Thread ID: 1cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 026dfef8 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 026dff20 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 026dff30 67de6ddf KERNEL32!WaitForSingleObject+0xf
03 026dff70 67f6cf08 fp4amsft!VmetabaseSinkThread::t_main+0x102
04 026dff7c 780085bc fp4Autl!Vthread::top+0xd
05 026dffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 026dffec 00000000 KERNEL32!BaseThreadStart+0x52
*****
Dump name is formatted as: PID-Timestamp.dmp
Creating C:\IISSTATE\output\2548-1078340401.dmp - mini user dump
*****
Closing open log file C:\IISSTATE\output\IISState-2548.log