Re: IISState Log Interpretation

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 04/19/04 

Date: Mon, 19 Apr 2004 17:23:29 +1000

You mean MS?

What is the name of this tool that we should ask for? I have not heard
anything about this. I know there are some new tracing options in Windows
2003 SP1, but that doesn't help analysing dumps.

Cheers
Ken

"John Cesta" <support@serverautomationtools.com> wrote in message
news:nsi6809ordtbmjd4e7u6el7o7r9o2jdrh6@4ax.com...
:
:
: M$ has a new tool to analyze the crash. They can find the problem
: pretty quick right down to the site. If this is a production server I
: would not hesitate to contact them. They tell me that they are going
: to be releasing a new tool WE can use to make it a little easier to
: analyze the dumps.
:
: John Cesta
:
: ---------------------------------
: The CPU Checker - Maximize Server Uptime
: LogFileManager - The only IIS Logfile Management Tool
: DomainReportIt PRO - Helps Convert IIS Installs
: http://www.serverautomationtools.com
:
:
: On Sat, 17 Apr 2004 20:21:54 -0700, "Ronnie"
: <anonymous@discussions.microsoft.com> wrote:
:
: >Can someone please interpret this log generated by
: >IISState, and share with me what is causing my trouble?
: >Thanks in advance.
: >========================================
: >
: >Opened log file 'C:\iisstate\output\IISState-156.log'
: >
: >***********************
: >Starting new log output
: >IISState version 3.3.1
: >
: >Sat Apr 17 20:01:01 2004
: >
: >OS = NT4
: >Executable: inetinfo.exe
: >PID = 156
: >
: >Note: Thread times are formatted as HH:MM:SS.ms
: >
: >***********************
: >
: >
: >IIS has crashed...
: >Beginning Analysis
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\System32\inetsrv\w3svc.dll -
: >DLL (!FunctionName) that failed: w3svc!
: >HTTP_REQ_BASE::QueryPhysicalPathStr
: >
: >
: >
: >
: >Thread ID: 39
: >System Thread ID: 105
: >Kernel Time: 0:0:0.70
: >User Time: 0:0:0.30
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\System32\inetsrv\ISATQ.dll -
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 2079feb8 68c045eb w3svc!
: >HTTP_REQ_BASE::QueryPhysicalPathStr+0x46c
: >01 2079fec8 68c0a118 w3svc!
: >HTTP_REQ_BASE::QueryPhysicalPathStr+0x23d
: >02 2079fee8 68c0ad66 w3svc!ScanForTerminator+0x180
: >03 2079fef8 68c09ed5 w3svc!CLIENT_CONN::Disconnect+0x86b
: >04 2079ff14 68c09e99 w3svc!
: >HTTP_REQ_BASE::CheckForBasicAuthenticationHeader+0x3207
: >05 2079ff54 686270ff w3svc!
: >HTTP_REQ_BASE::CheckForBasicAuthenticationHeader+0x31cb
: >06 2079ff88 6862731c ISATQ!AtqBandwidthGetInfo+0x41f
: >07 2079ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x63c
: >08 2079ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >Closing open log file C:\iisstate\output\IISState-156.log
: >Opened log file 'C:\iisstate\output\IISState-156.log'
: >
: >***********************
: >Starting new log output
: >IISState version 3.3.1
: >
: >Sat Apr 17 20:01:06 2004
: >
: >OS = NT4
: >Executable: inetinfo.exe
: >PID = 156
: >
: >Note: Thread times are formatted as HH:MM:SS.ms
: >
: >***********************
: >
: >
: >
: >
: >Thread ID: 0
: >System Thread ID: 77
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0006fd44 77f0d291 ntdll!NtReadFile+0xb
: >01 0006fdb0 77dd8a61 KERNEL32!ReadFile+0x1a6
: >02 0006fde4 77dd84ad ADVAPI32!ScGetPipeInput+0x28
: >03 0006fe48 77dd82ca ADVAPI32!ScDispatcherLoop+0x46
: >04 0006fe6c 0100182c ADVAPI32!
: >StartServiceCtrlDispatcherA+0x82
: >05 0006fea4 010015d5 inetinfo!StartDispatchTable+0x61
: >06 0006ff70 01001e7f inetinfo!main+0x2a5
: >07 0006ffc0 77f1bb7c inetinfo!mainCRTStartup+0xff
: >08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x40
: >
: >
: >
: >
: >Thread ID: 1
: >System Thread ID: 9f
: >Kernel Time: 0:0:0.50
: >User Time: 0:0:0.40
: >Thread Status: Thread is in a WAIT state.
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0085fe2c 77f1cf95 ntdll!NtWaitForSingleObject+0xb
: >01 0085fe54 77f04f44 KERNEL32!WaitForSingleObjectEx+0x73
: >02 0085fe64 683a18fe KERNEL32!WaitForSingleObject+0xf
: >03 0085fe80 0100175d iisadmin!ServiceEntry+0x11b
: >04 0085ffa8 77dd8c41 inetinfo!InetinfoStartService+0xfb
: >05 0085ffb8 77f04eeb ADVAPI32!ScSvcctrlThreadA+0xe
: >06 0085ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 2
: >System Thread ID: a5
: >Kernel Time: 0:0:0.30
: >User Time: 0:0:0.20
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\System32
: >\inetsrv\INFOCOMM.dll -
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 00e0fd28 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 00e0fd80 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 00e0fddc 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 00e0fdf8 685992a3 USER32!MsgWaitForMultipleObjects+0x1d
: >04 00e0fe40 68c1a718 INFOCOMM!
: >IIS_SERVICE::StartServiceOperation+0xd4
: >05 00e0fe80 0100175d w3svc!ServiceEntry+0x105
: >06 00e0ffa8 77dd8c41 inetinfo!InetinfoStartService+0xfb
: >07 00e0ffb8 77f04eeb ADVAPI32!ScSvcctrlThreadA+0xe
: >08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 3
: >System Thread ID: a6
: >Kernel Time: 0:0:0.510
: >User Time: 0:0:0.560
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 00e4fe9c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 00e4fef4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 00e4ff50 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 00e4ff6c 68624ab9 USER32!MsgWaitForMultipleObjects+0x1d
: >04 00e4ffb8 77f04eeb ISATQ!ScheduleAdjustTime+0x116
: >05 00e4ffc4 000c000a KERNEL32!BaseThreadStart+0x51
: >WARNING: Frame IP not in any known module. Following
: >frames may be wrong.
: >06 00000001 00000000 0xc000a
: >
: >
: >
: >
: >Thread ID: 4
: >System Thread ID: a7
: >Kernel Time: 0:0:0.420
: >User Time: 0:0:0.320
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 00e8fe9c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 00e8fef4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 00e8ff50 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 00e8ff6c 68624ab9 USER32!MsgWaitForMultipleObjects+0x1d
: >04 00e8ffb8 77f04eeb ISATQ!ScheduleAdjustTime+0x116
: >05 00e8ffc4 000c000a KERNEL32!BaseThreadStart+0x51
: >WARNING: Frame IP not in any known module. Following
: >frames may be wrong.
: >06 00000001 00000000 0xc000a
: >
: >
: >
: >
: >Thread ID: 5
: >System Thread ID: a8
: >Kernel Time: 0:0:0.200
: >User Time: 0:0:0.120
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 00ecff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 00ecff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 00ecffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 00ecffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 6
: >System Thread ID: a9
: >Kernel Time: 0:0:1.642
: >User Time: 0:0:0.500
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 00f0ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 00f0ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 00f0ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 7
: >System Thread ID: aa
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 00f4ff30 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 00f4ff88 685a7e80 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 00f4ffb8 77f04eeb INFOCOMM!
: >TS_OPEN_FILE_INFO::MakeStrongETag+0x7d3
: >03 00f4ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 8
: >System Thread ID: ab
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: *** ERROR: Symbol file could not be
: >found. Defaulted to export symbols for C:\WINNT\System32
: >\inetsrv\asp.dll -
: >ASP.dll symbols not found. Unable to locate ASP page.
: >Continuing with other analysis.
: >
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\system32\ole32.dll -
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 00f8fdec 77e17f96 ntdll!NtReplyWaitReceivePort+0xb
: >01 00f8ff90 77e17f38 RPCRT4!
: >WMSG_ADDRESS::ReceiveLotsaCalls+0x5b
: >02 00f8ff94 77e17b56 RPCRT4!RecvLotsaCallsWrapper+0x9
: >03 00f8ffac 77e17c09 RPCRT4!BaseCachedThreadRoutine+0x22
: >04 00f8ffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >05 00f8ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 9
: >System Thread ID: ac
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Status: Thread is in a WAIT state.
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 00fcfd20 776689ce ntdll!NtWaitForSingleObject+0xb
: >01 00fcfd78 77664a12 msafd!SockWaitForSingleObject+0x204
: >02 00fcfea0 776ba274 msafd!WSPSelect+0x28e
: >03 00fcfef0 74fa21e2 WS2_32!select+0xfc
: >04 00fcff2c 77e20fae RpcLtScm!
: >COMMON_ServerReceiveAny+0x2b8
: >05 00fcff60 77e1da44 RPCRT4!
: >TRANS_ADDRESS::TransReceive+0x7c
: >06 00fcff90 77e1f495 RPCRT4!
: >OSF_ADDRESS::ReceiveLotsaCalls+0x1e
: >07 00fcff94 77e17b56 RPCRT4!ReceiveLotsaCallsWrapper+0x9
: >08 00fcffac 77e17c09 RPCRT4!BaseCachedThreadRoutine+0x22
: >09 00fcffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >0a 00fcffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 10
: >System Thread ID: ad
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 0114fee8 77e013c4 ntdll!ZwWaitForMultipleObjects+0xb
: >01 0114ff2c 77e20fae rpclts1!ServerReceiveAny+0x133
: >02 0114ff60 77e1da44 RPCRT4!
: >TRANS_ADDRESS::TransReceive+0x7c
: >03 0114ff90 77e1f495 RPCRT4!
: >OSF_ADDRESS::ReceiveLotsaCalls+0x1e
: >04 0114ff94 77e17b56 RPCRT4!ReceiveLotsaCallsWrapper+0x9
: >05 0114ffac 77e17c09 RPCRT4!BaseCachedThreadRoutine+0x22
: >06 0114ffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >07 0114ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 11
: >System Thread ID: b2
: >Kernel Time: 0:0:0.30
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0118fe70 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 0118fec8 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 0118ff24 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 0118ff40 68c22d44 USER32!MsgWaitForMultipleObjects+0x1d
: >04 0118ff84 7800bee4 w3svc!HTTP_HEADERS::Cleanup+0x2f55
: >05 0118ffb8 77f04eeb MSVCRT!_beginthread+0xce
: >06 0118ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 12
: >System Thread ID: b3
: >Kernel Time: 0:0:0.60
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 011cfea8 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 011cff00 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 011cff5c 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 011cff78 68c1acea USER32!MsgWaitForMultipleObjects+0x1d
: >04 011cffb8 77f04eeb w3svc!ServiceEntry+0x6d7
: >05 011cffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 13
: >System Thread ID: f5
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Status: Thread is in a WAIT state.
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0135ff58 77f1cf95 ntdll!NtWaitForSingleObject+0xb
: >01 0135ff80 77f04f44 KERNEL32!WaitForSingleObjectEx+0x73
: >02 0135ff90 69a21998 KERNEL32!WaitForSingleObject+0xf
: >03 0135ffb8 77f04eeb MtxDm!PingThread+0x98
: >04 0135ffc4 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 14
: >System Thread ID: f6
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 013cfe70 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 013cfec8 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 013cff24 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 013cff40 680c5fa5 USER32!MsgWaitForMultipleObjects+0x1d
: >04 013cff84 7800bee4 asp!AspStatusHtmlDump+0x276d
: >05 013cffb8 77f04eeb MSVCRT!_beginthread+0xce
: >06 013cffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 15
: >System Thread ID: f7
: >Kernel Time: 0:0:0.20
: >User Time: 0:0:0.0
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 0140fe70 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 0140fec8 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 0140ff24 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 0140ff40 680bbf64 USER32!MsgWaitForMultipleObjects+0x1d
: >04 0140ff84 7800bee4 asp!DllCanUnloadNow+0x2ff0
: >05 0140ffb8 77f04eeb MSVCRT!_beginthread+0xce
: >06 0140ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 16
: >System Thread ID: f8
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.10
: >*** WARNING: Unable to verify checksum for
: >C:\WINNT\System32\pdm.dll
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\System32\pdm.dll -
: >Thread Type: PDM (Debugger) Thread.
: > # ChildEBP RetAddr
: >00 0144fdd8 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 0144fe30 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 0144fe8c 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 0144fea8 4a003b19 USER32!MsgWaitForMultipleObjects+0x1d
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >04 77e7ae7f 0110247c pdm+0x3b19
: >05 83ec8b55 00000000 0x110247c
: >
: >
: >
: >
: >Thread ID: 17
: >System Thread ID: ee
: >Kernel Time: 0:0:1.271
: >User Time: 0:0:2.383
: >*** ERROR: Symbol file could not be found. Defaulted to
: >export symbols for C:\WINNT\system32\vbscript.dll -
: >Thread Status: Thread is in a WAIT state.
: >Other information: Thread is waiting for a lock to be
: >released. Looking for lock owner.
: >Owning thread System ID: e0
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 014ee050 77f6cfe2 ntdll!NtWaitForSingleObject+0xb
: >01 014ee0c0 77f67646 ntdll!RtlpWaitForCriticalSection+0xa5
: >02 014ee0c8 6f06c56e ntdll!RtlEnterCriticalSection+0x46
: >03 014ee0dc 6536b686 cdo!CDispatchObj::Release+0x1e
: >04 014ee0f0 6b6174b7 OLEAUT32!VariantClear+0xa6
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >05 014ee104 6b62adf0 vbscript!DllCanUnloadNow+0xc062
: >06 011e2fc8 00000000 vbscript!DllCanUnloadNow+0x1f99b
: >
: >
: >
: >
: >Thread ID: 18
: >System Thread ID: 31
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0184fefc 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 0184ff54 77f1d06b KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 0184ff70 65352a46 KERNEL32!WaitForMultipleObjects+0x16
: >03 0184ffb8 77f04eeb OLEAUT32!RegistryWatchThread+0x86
: >04 0184ffc4 77f3fd50 KERNEL32!BaseThreadStart+0x51
: >05 77f4181f 416d6f74 KERNEL32!
: >_NULL_IMPORT_DESCRIPTOR+0x1b28
: >WARNING: Frame IP not in any known module. Following
: >frames may be wrong.
: >06 41646441 00000000 0x416d6f74
: >
: >
: >
: >
: >Thread ID: 19
: >System Thread ID: e8
: >Kernel Time: 0:0:1.962
: >User Time: 0:0:1.972
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 0188ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 0188ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 0188ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 0188ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 20
: >System Thread ID: e5
: >Kernel Time: 0:0:2.213
: >User Time: 0:0:5.477
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 018cfe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 018cfeb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 018cff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 018cff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 018cff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 018cff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 018cff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 00f0fa80 e7ffffff ole32!CoGetTIDFromIPID+0x338e
: >08 00f0fa80 e7ffffff 0xe7ffffff
: >09 001d0004 02020603 0xe7ffffff
: >0a 00000000 00000000 0x2020603
: >
: >
: >
: >
: >Thread ID: 21
: >System Thread ID: db
: >Kernel Time: 0:0:0.20
: >User Time: 0:0:0.20
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 01f1fe14 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 01f1fe6c 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 01f1fec8 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 01f1fee4 6fae6526 USER32!MsgWaitForMultipleObjects+0x1d
: >04 01f1ff28 6fae8492 MAPI32!
: >NtfyWaitForMultipleObjects+0x86
: >05 01f1ffb8 77f04eeb MAPI32!NtfyWorkerThreadFunc+0x72
: >06 01f1ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 22
: >System Thread ID: 4c
: >Kernel Time: 0:0:0.30
: >User Time: 0:0:0.10
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 01f5fe14 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 01f5fe6c 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 01f5fec8 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 01f5fee4 6fae6526 USER32!MsgWaitForMultipleObjects+0x1d
: >04 01f5ff28 6fae8492 MAPI32!
: >NtfyWaitForMultipleObjects+0x86
: >05 01f5ffb8 77f04eeb MAPI32!NtfyWorkerThreadFunc+0x72
: >06 01f5ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 23
: >System Thread ID: df
: >Kernel Time: 0:0:0.20
: >User Time: 0:0:0.10
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 01f9fe14 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 01f9fe6c 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 01f9fec8 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 01f9fee4 6fae6526 USER32!MsgWaitForMultipleObjects+0x1d
: >04 01f9ff28 6fae8492 MAPI32!
: >NtfyWaitForMultipleObjects+0x86
: >05 01f9ffb8 77f04eeb MAPI32!NtfyWorkerThreadFunc+0x72
: >06 01f9ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 24
: >System Thread ID: 3e
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 01fdfe14 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 01fdfe6c 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 01fdfec8 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 01fdfee4 6fae6526 USER32!MsgWaitForMultipleObjects+0x1d
: >04 01fdff28 6fae8492 MAPI32!
: >NtfyWaitForMultipleObjects+0x86
: >05 01fdffb8 77f04eeb MAPI32!NtfyWorkerThreadFunc+0x72
: >06 01fdffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 25
: >System Thread ID: 41
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 0219ff70 77f1d1e8 ntdll!NtDelayExecution+0xb
: >01 0219ff90 77f1d1b1 KERNEL32!SleepEx+0x34
: >02 0219ff9c 77e32c0d KERNEL32!Sleep+0xb
: >03 0219ffa4 77e31610 RPCRT4!PauseExecution+0xa
: >04 0219ffac 77e17c09 RPCRT4!GarbageCollectionThread+0x16
: >05 0219ffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >06 0219ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 26
: >System Thread ID: e0
: >Kernel Time: 1:30:25.261
: >User Time: 1:42:13.880
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 02b2fd80 6fa9ad2c MAPI32!HrMergeRowSets+0x72
: >01 02b2fda0 6f089008 MAPI32!HrQueryAllRows+0x14c
: >02 02b2fe78 6f088d85 cdo!CSession::M_ScGetOlkFB+0x1b8
: >03 02b2feb0 6fad6fbf cdo!CSchedCache::FIdleFlushFB+0x175
: >04 02b2fee0 6fa976cb MAPI32!FDoNextIdleTaskIntNT+0x15f
: >05 02b2feec 6fa976a5 MAPI32!FDoNextIdleTask+0x1b
: >06 02b2fef0 6fa97693 MAPI32!IdleTimerProc+0x5
: >07 02b2ff04 77e71416 MAPI32!IdleWndProc+0x33
: >08 02b2ff28 77e769ef USER32!DispatchMessageWorker+0x120
: >09 02b2ff34 69a92f04 USER32!DispatchMessageW+0xb
: >0a 02b2ff3c 697f1e09 MTxInfr1!
: >VipThunkDispatchMessageW+0x14
: >0b 02b2ff78 697f22d2 mtxex!CViperThread::MainLoop+0xab
: >0c 02b2ff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >0d 02b2ff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >0e 00f0f358 00000000 ole32!CoGetTIDFromIPID+0x338e
: >
: >
: >
: >
: >Thread ID: 27
: >System Thread ID: 115
: >Kernel Time: 0:0:0.360
: >User Time: 0:0:0.731
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 02cbfe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 02cbfeb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 02cbff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 02cbff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 02cbff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 02cbff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 02cbff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 00f0fa80 e7ffffff ole32!CoGetTIDFromIPID+0x338e
: >08 00f0fa80 e7ffffff 0xe7ffffff
: >09 001d0004 02020603 0xe7ffffff
: >0a 00000000 00000000 0x2020603
: >
: >
: >
: >
: >Thread ID: 28
: >System Thread ID: 63
: >Kernel Time: 0:0:0.20
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 083dfea0 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 083dfef8 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 083dff54 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 083dff70 6fad7316 USER32!MsgWaitForMultipleObjects+0x1d
: >04 083dffb8 77f04eeb MAPI32!FDoNextIdleTaskIntNT+0x4b6
: >05 083dffc4 02b2de78 KERNEL32!BaseThreadStart+0x51
: >WARNING: Frame IP not in any known module. Following
: >frames may be wrong.
: >06 ffffffff 00000000 0x2b2de78
: >
: >
: >
: >
: >Thread ID: 29
: >System Thread ID: 123
: >Kernel Time: 0:38:6.147
: >User Time: 0:36:44.590
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 03cff248 6fa9ad2c MAPI32!HrMergeRowSets+0x72
: >01 03cff268 6f089008 MAPI32!HrQueryAllRows+0x14c
: >02 03cff340 6f088d85 cdo!CSession::M_ScGetOlkFB+0x1b8
: >03 03cff378 6f088af9 cdo!CSchedCache::FIdleFlushFB+0x175
: >04 03cff384 6f08653b cdo!CSchedCache::~CSchedCache+0x29
: >05 03cff3bc 6f083726 cdo!CSession::M_ScLogoff+0x1b
: >06 03cff3c0 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
: >07 03cff3d0 6b61869d cdo!CDispatchObj::Invoke+0xa0
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >08 03cff40c 680e2a8b vbscript!DllCanUnloadNow+0xd248
: >09 03cff47c 653b2783 asp!DllUnregisterServer+0x1af4c
: >0a 03cff498 65367a09 OLEAUT32!
: >CTypeInfo2::GetIDsOfNames+0x37
: >0b 03cff4ac 6f06ccd9 OLEAUT32!DispGetIDsOfNames+0x19
: >0c 03cff4dc 6b618238 cdo!CDispatchObj::GetIDsOfNames+0x79
: >0d 03cff520 6b632fc4 vbscript!DllCanUnloadNow+0xcde3
: >0e 03cffb34 00289460 vbscript!DllCanUnloadNow+0x27b6f
: >0f 0028edd0 00289460 0x289460
: >10 00000009 00000000 0x289460
: >
: >
: >
: >
: >Thread ID: 30
: >System Thread ID: 123
: >Kernel Time: 0:38:6.147
: >User Time: 0:36:44.590
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 03cff248 6fa9ad2c MAPI32!HrMergeRowSets+0x72
: >01 03cff268 6f089008 MAPI32!HrQueryAllRows+0x14c
: >02 03cff340 6f088d85 cdo!CSession::M_ScGetOlkFB+0x1b8
: >03 03cff378 6f088af9 cdo!CSchedCache::FIdleFlushFB+0x175
: >04 03cff384 6f08653b cdo!CSchedCache::~CSchedCache+0x29
: >05 03cff3bc 6f083726 cdo!CSession::M_ScLogoff+0x1b
: >06 03cff3c0 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
: >07 03cff3d0 6b61869d cdo!CDispatchObj::Invoke+0xa0
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >08 03cff40c 680e2a8b vbscript!DllCanUnloadNow+0xd248
: >09 03cff47c 653b2783 asp!DllUnregisterServer+0x1af4c
: >0a 03cff498 65367a09 OLEAUT32!
: >CTypeInfo2::GetIDsOfNames+0x37
: >0b 03cff4ac 6f06ccd9 OLEAUT32!DispGetIDsOfNames+0x19
: >0c 03cff4dc 6b618238 cdo!CDispatchObj::GetIDsOfNames+0x79
: >0d 03cff520 6b632fc4 vbscript!DllCanUnloadNow+0xcde3
: >0e 03cffb34 00289460 vbscript!DllCanUnloadNow+0x27b6f
: >0f 0028edd0 00289460 0x289460
: >10 00000009 00000000 0x289460
: >
: >
: >
: >
: >Thread ID: 31
: >System Thread ID: 107
: >Kernel Time: 0:0:0.220
: >User Time: 0:0:0.841
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 02f9fe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 02f9feb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 02f9ff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 02f9ff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 02f9ff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 02f9ff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 02f9ff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 00f0fa30 026c0008 ole32!CoGetTIDFromIPID+0x338e
: >08 00f0fa30 026c0008 0x26c0008
: >09 00000000 00000000 0x26c0008
: >
: >
: >
: >
: >Thread ID: 32
: >System Thread ID: 101
: >Kernel Time: 0:0:0.711
: >User Time: 0:0:1.952
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 03bffe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 03bffeb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 03bfff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 03bfff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 03bfff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 03bfff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 03bfff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 0188fa80 e7ffffff ole32!CoGetTIDFromIPID+0x338e
: >08 0188fa80 e7ffffff 0xe7ffffff
: >09 001d0004 02020603 0xe7ffffff
: >0a 00000000 00000000 0x2020603
: >
: >
: >
: >
: >Thread ID: 33
: >System Thread ID: ed
: >Kernel Time: 0:0:1.231
: >User Time: 0:0:5.127
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 0309fe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 0309feb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 0309ff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 0309ff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 0309ff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 0309ff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 0309ff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 0188fa30 00000000 ole32!CoGetTIDFromIPID+0x338e
: >
: >
: >
: >
: >Thread ID: 34
: >System Thread ID: 10a
: >Kernel Time: 0:0:1.171
: >User Time: 0:0:4.105
: >Thread Status: Thread is in a WAIT state.
: >Other information: Thread is waiting for a lock to be
: >released. Looking for lock owner.
: >Owning thread System ID: e5
: >Thread Type: ASP
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: > # ChildEBP RetAddr
: >00 04a7ef7c 77f6cfe2 ntdll!NtWaitForSingleObject+0xb
: >01 04a7efec 77f67646 ntdll!RtlpWaitForCriticalSection+0xa5
: >02 04a7eff4 6fff19a3 ntdll!RtlEnterCriticalSection+0x46
: >03 04a7f008 6fff13a6 EXCHMEM!MpHeapReAlloc+0x23
: >04 04a7f018 627ac940 EXCHMEM!ExchMHeapReAlloc+0x16
: >05 04a7f024 627ac9ea EMSMDB32!LH_IntHeapReAlloc+0x10
: >06 04a7f038 62737b57 EMSMDB32!LH_ExtHeapReAlloc+0x1a
: >07 04a7f15c 6273dfbf EMSMDB32!CNCT::EcAppendHcot+0x127
: >08 04a7f1b0 62756d74 EMSMDB32!CNCT::EcQueryRows+0x1f
: >09 04a7f21c 6f0dfd8a EMSMDB32!
: >UNKOBJ::HresSetLastError+0x14
: >0a 04a7f298 6f0dfb9c cdo!CFreeBusy::EcFindRow+0xea
: >0b 04a7f304 6f0df6ab cdo!CFreeBusy::EcMsgOfSrchKey+0x33c
: >0c 04a7f340 6f088ce0 cdo!CFreeBusy::EcInitMe+0x4b
: >0d 04a7f378 6f088af9 cdo!CSchedCache::FIdleFlushFB+0xd0
: >0e 04a7f384 6f08653b cdo!CSchedCache::~CSchedCache+0x29
: >0f 04a7f3bc 6f083726 cdo!CSession::M_ScLogoff+0x1b
: >10 04a7f3c0 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
: >11 04a7f3d0 6b61869d cdo!CDispatchObj::Invoke+0xa0
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >12 04a7f40c 680e2a8b vbscript!DllCanUnloadNow+0xd248
: >13 04a7f47c 653b2783 asp!DllUnregisterServer+0x1af4c
: >14 04a7f498 65367a09 OLEAUT32!
: >CTypeInfo2::GetIDsOfNames+0x37
: >15 04a7f4ac 6f06ccd9 OLEAUT32!DispGetIDsOfNames+0x19
: >16 04a7f4dc 6b618238 cdo!CDispatchObj::GetIDsOfNames+0x79
: >17 04a7f520 6b632fc4 vbscript!DllCanUnloadNow+0xcde3
: >18 04a7fb34 002a43e0 vbscript!DllCanUnloadNow+0x27b6f
: >19 002a47e0 002a43e0 0x2a43e0
: >1a 00000009 00000000 0x2a43e0
: >
: >
: >
: >
: >Thread ID: 35
: >System Thread ID: 106
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 06d8fdec 77e17f96 ntdll!NtReplyWaitReceivePort+0xb
: >01 06d8ff90 77e17f38 RPCRT4!
: >WMSG_ADDRESS::ReceiveLotsaCalls+0x5b
: >02 06d8ff94 77e17b56 RPCRT4!RecvLotsaCallsWrapper+0x9
: >03 06d8ffac 77e17c09 RPCRT4!BaseCachedThreadRoutine+0x22
: >04 06d8ffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >05 06d8ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 36
: >System Thread ID: 129
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Possible ASP page. Possible DCOM activity
: >Executing Page: ASP.dll symbols not found. Unable to
: >locate ASP page.
: >Continuing with other analysis.
: >
: >OLE32.dll Symbols not found. Unable to proceed with DCOM
: >check.
: >Continuing other analysis.
: >
: > # ChildEBP RetAddr
: >00 065bfdec 77e17f96 ntdll!NtReplyWaitReceivePort+0xb
: >01 065bff90 77e17f38 RPCRT4!
: >WMSG_ADDRESS::ReceiveLotsaCalls+0x5b
: >02 065bff94 77e17b56 RPCRT4!RecvLotsaCallsWrapper+0x9
: >03 065bffac 77e17c09 RPCRT4!BaseCachedThreadRoutine+0x22
: >04 065bffb8 77f04eeb RPCRT4!ThreadStartRoutine+0x17
: >05 065bffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 37
: >System Thread ID: 40
: >Kernel Time: 0:0:0.40
: >User Time: 0:0:0.20
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 06e7ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 06e7ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 06e7ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 06e7ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 38
: >System Thread ID: 97
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 2075ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 2075ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 2075ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 2075ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 39
: >System Thread ID: 105
: >Kernel Time: 0:0:0.70
: >User Time: 0:0:0.30
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 2079feb8 68c045eb w3svc!
: >HTTP_REQ_BASE::QueryPhysicalPathStr+0x46c
: >01 2079fec8 68c0a118 w3svc!
: >HTTP_REQ_BASE::QueryPhysicalPathStr+0x23d
: >02 2079fee8 68c0ad66 w3svc!ScanForTerminator+0x180
: >03 2079fef8 68c09ed5 w3svc!CLIENT_CONN::Disconnect+0x86b
: >04 2079ff14 68c09e99 w3svc!
: >HTTP_REQ_BASE::CheckForBasicAuthenticationHeader+0x3207
: >05 2079ff54 686270ff w3svc!
: >HTTP_REQ_BASE::CheckForBasicAuthenticationHeader+0x31cb
: >06 2079ff88 6862731c ISATQ!AtqBandwidthGetInfo+0x41f
: >07 2079ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x63c
: >08 2079ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 40
: >System Thread ID: 12b
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 207dff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 207dff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 207dffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 207dffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 41
: >System Thread ID: 110
: >Kernel Time: 0:0:0.10
: >User Time: 0:0:0.0
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 2081ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 2081ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 2081ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 2081ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 42
: >System Thread ID: 111
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 2085ff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 2085ff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 2085ffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 2085ffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >
: >
: >
: >Thread ID: 43
: >System Thread ID: 119
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: Other
: > # ChildEBP RetAddr
: >00 2089fe5c 77f1d15e ntdll!ZwWaitForMultipleObjects+0xb
: >01 2089feb4 77e7ae57 KERNEL32!
: >WaitForMultipleObjectsEx+0xef
: >02 2089ff10 77e7ae9c USER32!
: >MsgWaitForMultipleObjectsEx+0x127
: >03 2089ff2c 697f1dbe USER32!MsgWaitForMultipleObjects+0x1d
: >04 2089ff78 697f22d2 mtxex!CViperThread::MainLoop+0x60
: >05 2089ff84 7800bee4 mtxex!CViperThreadMainProc+0x12
: >06 2089ff90 77b306de MSVCRT!_beginthread+0xce
: >WARNING: Stack unwind information not available.
: >Following frames may be wrong.
: >07 00ecf358 00ecf37c ole32!CoGetTIDFromIPID+0x338e
: >08 00ecf358 00ecf37c 0xecf37c
: >09 00000001 00000000 0xecf37c
: >
: >
: >
: >
: >Thread ID: 44
: >System Thread ID: 112
: >Kernel Time: 0:0:0.0
: >User Time: 0:0:0.0
: >Thread Type: HTTP Listener
: > # ChildEBP RetAddr
: >00 208dff54 77f0c2a0 ntdll!NtRemoveIoCompletion+0xb
: >01 208dff84 686272c6 KERNEL32!
: >GetQueuedCompletionStatus+0x27
: >02 208dffb8 77f04eeb ISATQ!AtqBandwidthGetInfo+0x5e6
: >03 208dffec 00000000 KERNEL32!BaseThreadStart+0x51
: >
: >*****
: >
: >Dump name is formatted as: PID-Timestamp.dmp
: >
: >Creating C:\iisstate\output\156-1082257313.dmp - mini
: >user dump
:

Relevant Pages