Re: Inetinfo.exe 100% cpu

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 01/22/05


Date: Sat, 22 Jan 2005 00:56:24 -0800

Follow documentation from http://www.microsoft.com/ddk/debugging on how to
set up debugger to access the public Microsoft symbols server, which is the
easiest way to have the correct symbols show up with little effort. Symbols
server handles all the searching/matching.

The machine looks like IIS5 on W2K since most threads are still from ISATQ,
and extrace is still in inetinfo.exe. At this point, I suggest setting up
access the symbols and take a IIS State snapshot when it next plateaus at
100%. There's just too much random noise from lack of symbols to get
anything constructive. Something is going on with thread 31, but without
symbols, we really cannot tell what.

Please believe me when I say that I commiserate with your plight -- I hate
to see customer systems that are not working. However, I just want to
highlight the sorts of support options that you actually have:
1. Debug the issue yourself. This assumes you have the technical expertise
and time to debug but costs you no out-of-pocket money
2. Contact free volunteer peer support like this newsgroup for assistance.
There are lots of technical experts here as well as MS employees in IIS and
PSS, but since this is volunteer, there are no guarantees on responsiveness
nor correctness. We just try to help as much as we can, but ultimately you
are still responsible.
3. Contact Microsoft PSS for assistance. For a fee, there will be an
incident open and technical experts will also look at the issue with a
guarantee on responsiveness and a drive to resolve your issue by either
finding a work-around or a hotfix. If the issue ends up being an Microsoft
bug, you obviously won't get charged.
4. Have a support contract with MS. For even more money, you will get
better hand-holding with a TAM assigned to you, even better guarantee of
responsiveness, access, and support.

It is ultimately your choice for level of support. Just please do not try
to push it and try to extract PSS-level responsive support from free
volunteers or MS employees on their own personal time (i.e. "I am a hosting
company cannot afford downtime"). I think you happen to be in a business
with high technical risk (allowing users to run random code on the server),
so you need to mitigate accordingly... If you cannot afford downtime and
need a service guarantee, having in-house tech-support or paying for PSS is
how you should mitigate that risk.

Good luck with this issue.

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"shukei98" <shukei98@hotmail.com> wrote in message
news:ezqgF%23EAFHA.2572@tk2msftngp13.phx.gbl...
Hi Ken,
What's wrong with thread 31?
It says, "Stack unwind information not available. Following frames may be
wrong."
This is a repeated error, I wonder do this cause my IIS hung?? Please
revert...
Talking about symbols, how do I install it?
Regards,
Steve
"Ken Schaefer" <kenREMOVE@THISadopenstatic.com> wrote in message
news:urKrY5EAFHA.2572@tk2msftngp13.phx.gbl...
> Thread 31 maybe your culprit since it's used 15 minutes of kernel time -
> most other threads have used only a few seconds (or a few minutes)
>
> However, I don't think you have symbols available...
>
> Pat can (probably) tell you more.
>
> Cheers
> Ken
>
> "Shukei98" <shukei98@hotmail.com> wrote in message
> news:eR%2376UCAFHA.3424@TK2MSFTNGP11.phx.gbl...
>> Hi,
>>
>> Here's my iisstate log while my cpu was running 100% on inetinfo.exe
>> process
>> recently. Everytime I need to restart the server to bring back IIS. I am
>> a
>> hosting company can't afford to have that down time..
>>
>>
>> ***********************
>> Starting new log output
>> IISState version 3.0
>>
>> Fri Jan 21 18:59:45 2005
>>
>> OS = Windows 2003 Server
>> Executable: inetinfo.exe
>> PID =  868
>>
>> Note: Thread times are formatted as HH:MM:SS.ms
>>
>> ***********************
>>
>>
>>
>>
>> Thread ID: 0
>> System Thread ID: 370
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\ntdll.dll -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\ADVAPI32.dll -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\inetinfo.exe -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\kernel32.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0006fa08 77f5718b ntdll!KiFastSystemCallRet
>> 01 0006fa34 77f57015 ADVAPI32!SetServiceStatus+0x285
>> 02 0006faa8 77faf759 ADVAPI32!SetServiceStatus+0x10f
>> 03 0006fcec 010027ae ADVAPI32!StartServiceCtrlDispatcherA+0xf7
>> 04 0006fe1c 01002959 inetinfo+0x27ae
>> 05 0006ff44 01003380 inetinfo+0x2959
>> 06 0006ffc0 77e51331 inetinfo!IPM_MESSAGE_PIPE::operator=+0x8fd
>> 07 0006fff0 00000000 kernel32!IsProcessorFeaturePresent+0x44
>>
>>
>>
>>
>> Thread ID: 1
>> System Thread ID: 3f8
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 007efe88 77e6b012 ntdll!KiFastSystemCallRet
>> 01 007efe9c 01002eaf kernel32!WaitForSingleObject+0x12
>> 02 007effb8 77e60638 inetinfo!IPM_MESSAGE_PIPE::operator=+0x42c
>> 03 007effec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 2
>> System Thread ID: 3fc
>> Kernel Time: 0:0:0.109
>> User Time: 0:0:0.453
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\iisadmin.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0082fd2c 77e6b012 ntdll!KiFastSystemCallRet
>> 01 0082fd40 649f2684 kernel32!WaitForSingleObject+0x12
>> 02 0082fd68 010024a3 iisadmin!ServiceEntry+0x28a
>> 03 0082ffa4 77f56fa8 inetinfo+0x24a3
>> 04 0082ffb8 77e60638 ADVAPI32!SetServiceStatus+0xa2
>> 05 0082ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 3
>> System Thread ID: 52c
>> Kernel Time: 0:0:0.187
>> User Time: 0:0:0.46
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00bfffb8 77e60638 ntdll!KiFastSystemCallRet
>> 01 00bfffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 4
>> System Thread ID: 588
>> Kernel Time: 0:0:0.15
>> User Time: 0:0:0.31
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\COADMIN.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00d0ff58 77e565fc ntdll!KiFastSystemCallRet
>> 01 00d0ff74 56f951cf kernel32!WaitForMultipleObjects+0x18
>> 02 00d0ffa0 56f969e6 COADMIN+0x51cf
>> 03 00d0ffb8 77e60638 COADMIN+0x69e6
>> 04 00d0ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 5
>> System Thread ID: 76c
>> Kernel Time: 0:0:3.140
>> User Time: 0:0:3.359
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\RPCRT4.dll -
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\ole32.dll -
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0167ff8c 77c71c04 ntdll!KiFastSystemCallRet
>> 01 0167ffac 77c71c3c RPCRT4!I_RpcParseSecurity+0xa15
>> 02 0167ffb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 03 0167ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 6
>> System Thread ID: afc
>> Kernel Time: 0:0:0.250
>> User Time: 0:0:0.687
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\USER32.dll -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\INFOCOMM.dll -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\SMTPSVC.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 016ffc64 773979c5 ntdll!KiFastSystemCallRet
>> 01 016ffcc0 77397a23 USER32!PeekMessageW+0x1b3
>> 02 016ffcdc 6c7d63c5 USER32!MsgWaitForMultipleObjects+0x1f
>> 03 016ffd28 726053e6 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x231
>> 04 016ffd68 010024a3 SMTPSVC!ServiceEntry+0x12b
>> 05 016fffa4 77f56fa8 inetinfo+0x24a3
>> 06 016fffb8 77e60638 ADVAPI32!SetServiceStatus+0xa2
>> 07 016fffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 7
>> System Thread ID: df0
>> Kernel Time: 0:0:58.906
>> User Time: 0:0:9.734
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 01a2ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 01a2ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 01a2ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 8
>> System Thread ID: df4
>> Kernel Time: 0:0:28.234
>> User Time: 0:0:5.406
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 01a6ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 01a6ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 01a6ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 9
>> System Thread ID: e38
>> Kernel Time: 0:0:2.406
>> User Time: 0:0:2.984
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 01e6ff8c 77c71c04 ntdll!KiFastSystemCallRet
>> 01 01e6ffac 77c71c3c RPCRT4!I_RpcParseSecurity+0xa15
>> 02 01e6ffb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 03 01e6ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 10
>> System Thread ID: e60
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\exstrace.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 01eaff70 77e565fc ntdll!KiFastSystemCallRet
>> 01 01eaff8c 695324c7 kernel32!WaitForMultipleObjects+0x18
>> 02 01eaffb8 77e60638 exstrace!TermAsyncTrace+0x576
>> 03 01eaffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 11
>> System Thread ID: e64
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 01eeff74 77e565fc ntdll!KiFastSystemCallRet
>> 01 01eeff90 695319ed kernel32!WaitForMultipleObjects+0x18
>> 02 01eeffb8 77e60638 exstrace!DebugAssert+0x50c
>> 03 01eeffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 12
>> System Thread ID: e68
>> Kernel Time: 0:0:0.453
>> User Time: 0:0:5.62
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\FCACHDLL.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0202ff8c 77e6b012 ntdll!KiFastSystemCallRet
>> 01 0202ffa0 73068f5e kernel32!WaitForSingleObject+0x12
>> 02 0202ffec 00000000 FCACHDLL!ReleaseNameCache+0x5ac
>>
>>
>>
>>
>> Thread ID: 13
>> System Thread ID: e70
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.31
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0216ff68 77e565fc ntdll!KiFastSystemCallRet
>> 01 0216ff84 7261eff3 kernel32!WaitForMultipleObjects+0x18
>> 02 0216ffb8 77e60638 SMTPSVC!IIS_SERVICE::GetServiceConfigInfoSize+0x6ac8
>> 03 0216ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 14
>> System Thread ID: e74
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 021aff90 77e6b012 ntdll!KiFastSystemCallRet
>> 01 021affa4 7261ee90 kernel32!WaitForSingleObject+0x12
>> 02 021affec 00000000 SMTPSVC!IIS_SERVICE::GetServiceConfigInfoSize+0x6965
>>
>>
>>
>>
>> Thread ID: 15
>> System Thread ID: 7a4
>> Kernel Time: 0:0:0.484
>> User Time: 0:0:0.203
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\ftpsvc2.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0262fc64 773979c5 ntdll!KiFastSystemCallRet
>> 01 0262fcc0 77397a23 USER32!PeekMessageW+0x1b3
>> 02 0262fcdc 6c7d63c5 USER32!MsgWaitForMultipleObjects+0x1f
>> 03 0262fd28 6930e65a INFOCOMM!IIS_SERVICE::StartServiceOperation+0x231
>> 04 0262fd68 010024a3 ftpsvc2!ServiceEntry+0xae
>> 05 0262ffa4 77f56fa8 inetinfo+0x24a3
>> 06 0262ffb8 77e60638 ADVAPI32!SetServiceStatus+0xa2
>> 07 0262ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 16
>> System Thread ID: 3f4
>> Kernel Time: 0:0:0.265
>> User Time: 0:0:0.171
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0266ff70 69308db4 ntdll!KiFastSystemCallRet
>> 01 0266ffb8 77e60638 ftpsvc2!COMMON_METADATA::SetAccessPerms+0x2156
>> 02 0266ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 17
>> System Thread ID: 8e0
>> Kernel Time: 0:0:3.812
>> User Time: 0:0:5.843
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 026aff84 77c6cf20 ntdll!KiFastSystemCallRet
>> 01 026aff8c 77c71bb9 RPCRT4!NdrComplexArrayFree+0x175
>> 02 026affac 77c71c3c RPCRT4!I_RpcParseSecurity+0x9ca
>> 03 026affb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 04 026affec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 18
>> System Thread ID: 8e4
>> Kernel Time: 0:0:0.31
>> User Time: 0:0:0.15
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 026effb8 77e60638 ntdll!KiFastSystemCallRet
>> 01 026effec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 19
>> System Thread ID: adc
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\mswsock.dll -
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\WS2_32.dll -
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 028afe4c 71b23776 ntdll!KiFastSystemCallRet
>> 01 028aff3c 71c028ca mswsock+0x3776
>> 02 028aff8c 63ec4696 WS2_32!select+0xa1
>> 03 028affb4 63ec4700 ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
>> 04 028affb8 77e60638 ISATQ!BmonThreadFunc+0x9
>> 05 028affc4 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 20
>> System Thread ID: b54
>> Kernel Time: 0:0:0.15
>> User Time: 0:0:0.0
>> *** ERROR: Symbol file could not be found.  Defaulted to export symbols
>> for
>> C:\WINDOWS\system32\inetsrv\aqueue.dll -
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 028fff80 77e6b012 ntdll!KiFastSystemCallRet
>> 01 028fff94 4f52f97c kernel32!WaitForSingleObject+0x12
>> 02 028fffb8 77e60638 aqueue!HrAdvQueueDeinitialize+0x256e6
>> 03 028fffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 21
>> System Thread ID: c58
>> Kernel Time: 0:0:0.46
>> User Time: 0:0:0.62
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0293ff28 77e565fc ntdll!KiFastSystemCallRet
>> 01 0293ff44 4f50cbf0 kernel32!WaitForMultipleObjects+0x18
>> 02 0293ffa4 72611c46 aqueue!HrAdvQueueDeinitialize+0x295a
>> 03 0293ffb8 77e60638 SMTPSVC!MIME_MAP_ENTRY::Print+0xa7
>> 04 0293ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 22
>> System Thread ID: cb4
>> Kernel Time: 0:0:9.546
>> User Time: 0:0:1.781
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0301ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 0301ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 0301ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 23
>> System Thread ID: cb8
>> Kernel Time: 0:0:38.421
>> User Time: 0:0:6.468
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0305ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 0305ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 0305ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 24
>> System Thread ID: 8e8
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0309ff84 77c6cf20 ntdll!KiFastSystemCallRet
>> 01 0309ff8c 77c71bb9 RPCRT4!NdrComplexArrayFree+0x175
>> 02 0309ffac 77c71c3c RPCRT4!I_RpcParseSecurity+0x9ca
>> 03 0309ffb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 04 0309ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 25
>> System Thread ID: af0
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 030dff84 77c6cf20 ntdll!KiFastSystemCallRet
>> 01 030dff8c 77c71bb9 RPCRT4!NdrComplexArrayFree+0x175
>> 02 030dffac 77c71c3c RPCRT4!I_RpcParseSecurity+0x9ca
>> 03 030dffb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 04 030dffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 26
>> System Thread ID: 1ae0
>> Kernel Time: 0:0:9.328
>> User Time: 0:0:1.890
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00fbff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 00fbffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 00fbffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 27
>> System Thread ID: 2644
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Possible ASP page.  Possible DCOM activity
>> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> Continuing with other analysis.
>>
>> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
>> Continuing other analysis.
>>
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0112fedc 77c742a4 ntdll!KiFastSystemCallRet
>> 01 0112ff18 77c7415b RPCRT4!NdrConformantArrayMemorySize+0x483
>> 02 0112ff84 77c74546 RPCRT4!NdrConformantArrayMemorySize+0x33a
>> 03 0112ff8c 77c71bb9 RPCRT4!NdrConformantArrayMemorySize+0x725
>> 04 0112ffac 77c71c3c RPCRT4!I_RpcParseSecurity+0x9ca
>> 05 0112ffb8 77e60638 RPCRT4!I_RpcParseSecurity+0xa4d
>> 06 0112ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 28
>> System Thread ID: 3204
>> Kernel Time: 0:0:0.15
>> User Time: 0:0:0.0
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0116ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 0116ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 0116ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 29
>> System Thread ID: 3624
>> Kernel Time: 0:0:29.812
>> User Time: 0:0:15.234
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 011eff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 011effb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 011effec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 30
>> System Thread ID: 3f80
>> Kernel Time: 0:5:19.109
>> User Time: 0:2:46.828
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 012afd14 71b21cf6 ntdll!RtlAllocateHeap+0x119
>> 01 012afe4c 71b221a2 mswsock+0x1cf6
>> 02 012afeb0 71c03f67 mswsock+0x21a2
>> 03 012aff10 63ec6c76 WS2_32!WSASocketW+0x9d
>> 04 012aff40 63ec6ec1 ISATQ!I_AtqAddAcceptExSocket+0x3b
>> 05 012aff60 63ec70f2 ISATQ!I_AtqPrepareAcceptExSockets+0x8c
>> 06 012aff84 63ec73c6 ISATQ!AtqpProcessContext+0xfa
>> 07 012affb8 77e60638 ISATQ!AtqPoolThread+0x1d1
>> 08 012affec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 31
>> System Thread ID: 3a48
>> Kernel Time: 0:15:51.78
>> User Time: 0:8:12.218
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 013aff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 013affb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 013affec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 32
>> System Thread ID: 3ccc
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 013eff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 013effb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 013effec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 33
>> System Thread ID: 3f34
>> Kernel Time: 0:0:0.156
>> User Time: 0:0:0.46
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 014eff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 014effb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 014effec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 34
>> System Thread ID: 4690
>> Kernel Time: 0:7:53.968
>> User Time: 0:4:15.484
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00ffff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 00ffffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 00ffffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 35
>> System Thread ID: 46b0
>> Kernel Time: 0:0:42.171
>> User Time: 0:0:22.687
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 011aff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 011affb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 011affec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 36
>> System Thread ID: 3a4c
>> Kernel Time: 0:0:2.93
>> User Time: 0:0:1.15
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00bbff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 00bbffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 00bbffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 37
>> System Thread ID: 38cc
>> Kernel Time: 0:0:0.187
>> User Time: 0:0:0.78
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00c3ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 00c3ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 00c3ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 38
>> System Thread ID: 3f20
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0122ff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 0122ffb8 77e60638 ISATQ!AtqPoolThread+0x40
>> 02 0122ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 39
>> System Thread ID: 435c
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 00f7ffb8 77e60638 ntdll!KiFastSystemCallRet
>> 01 00f7ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 40
>> System Thread ID: 4180
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: HTTP Listener
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 012eff80 63ec7235 ntdll!KiFastSystemCallRet
>> 01 012effb0 7c8295a1 ISATQ!AtqPoolThread+0x40
>> 02 012effbc 00000000 ntdll!ZwRegisterThreadTerminatePort+0xc
>>
>>
>>
>>
>> Thread ID: 41
>> System Thread ID: 4110
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0126ffb8 77e60638 ntdll!KiFastSystemCallRet
>> 01 0126ffec 00000000 kernel32!SearchPathW+0x22d
>>
>>
>>
>>
>> Thread ID: 42
>> System Thread ID: 46fc
>> Kernel Time: 0:0:0.0
>> User Time: 0:0:0.0
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>> 00 0132ffb8 77e60638 ntdll!KiFastSystemCallRet
>> 01 0132ffec 00000000 kernel32!SearchPathW+0x22d
>>
>> Closing open log file C:\Program Files\IIS
>> Resources\IISState\output\IISState.log
>>
>>
>> Please help......
>>
>> Regards,
>> Steve
>>
>>
>> ---
>> Outgoing mail is certified Virus Free.
>> Checked by AVG anti-virus system (http://www.grisoft.com).
>> Version: 6.0.834 / Virus Database: 568 - Release Date: 1/14/2005
>>
>>
>
>


Relevant Pages