I guess I'm misunderstanding how IISState using the -sc switch works.
When ever I run it it catches an exception and quits
Anyway, we just had another incident and I was able to run IISState during
it.
Here is the log...hopefully its more useful than the last one
Your thoughts are muchly appreciated
****
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
***********************
Starting new log output
IISState version 3.3.1
Fri Sep 02 18:27:05 2005
OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420
Note: Thread times are formatted as HH:MM:SS.ms
***********************
IIS has crashed...
Beginning Analysis
*** WARNING: Unable to verify checksum for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c56193
4e089_1e3d3e9e\mscorlib.dll
*** ERROR: Module load completed but symbols could not be loaded for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c56193
4e089_1e3d3e9e\mscorlib.dll
DLL (!FunctionName) that failed: mscorlib_79990000
Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:9.875
User Time: 0:3:35.859
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
PDB symbol for mscorsvr.dll not loaded
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 10
ESP EIP
019edc38 79ad8e18 [DEFAULT] Class
System.Runtime.Remoting.Messaging.LogicalCallContext
System.Runtime.Remoting.Messaging.Message.PropagateCallContextFromMessageToT
hread(Class System.Runtime.Remoting.Messaging.IMessage)
019edc44 79ad08da [DEFAULT] Void
System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4,I4,I4)
019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT] I4
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I,String,I,I4)
019ef92c 020f79f2 [DEFAULT] [hasThis] String
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicodeServerVariable(
String,Class System.Web.Hosting.ServerVarCharBuffer)
019ef944 020f76c4 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadRequestBasics()
019ef990 020f7615 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequest.Initialize()
019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I,I4)
019ef9d8 020f6457 [DEFAULT] [hasThis] I4
System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
019efaa0 79217188 [FRAME: ContextTransitionFrame]
019efb80 79217188 [FRAME: ComMethodFrame]
Begin System Thread Information
# ChildEBP RetAddr
00 00000001 00000000 mscorlib_79990000+0x148e18
Closing open log file D:\program files\iisstate\output\IISState-3420.log
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
***********************
Starting new log output
IISState version 3.3.1
Fri Sep 02 18:27:10 2005
OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: cd4
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
Thread ID: 1
System Thread ID: dc4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 2
System Thread ID: c80
Kernel Time: 0:0:2.421
User Time: 0:0:1.640
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 3
System Thread ID: c14
Kernel Time: 0:0:2.265
User Time: 0:0:1.578
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00cdffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 4
System Thread ID: 91c
Kernel Time: 0:0:1.859
User Time: 0:0:1.421
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 5
System Thread ID: ca0
Kernel Time: 0:0:1.984
User Time: 0:0:1.546
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 6
System Thread ID: 5b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 7
System Thread ID: 658
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 8
System Thread ID: 80c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
03 0186ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 9
System Thread ID: da8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
02 0196febc 77e424b7 kernel32!SleepEx+0x68
03 0196fecc 791bf4f9 kernel32!Sleep+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
05 0196ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:9.875
User Time: 0:3:35.859
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
Thread 10
ESP EIP
019edc38 79ad8e18 [DEFAULT] Class
System.Runtime.Remoting.Messaging.LogicalCallContext
System.Runtime.Remoting.Messaging.Message.PropagateCallContextFromMessageToT
hread(Class System.Runtime.Remoting.Messaging.IMessage)
019edc44 79ad08da [DEFAULT] Void
System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4,I4,I4)
019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT] I4
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I,String,I,I4)
019ef92c 020f79f2 [DEFAULT] [hasThis] String
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicodeServerVariable(
String,Class System.Web.Hosting.ServerVarCharBuffer)
019ef944 020f76c4 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadRequestBasics()
019ef990 020f7615 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequest.Initialize()
019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I,I4)
019ef9d8 020f6457 [DEFAULT] [hasThis] I4
System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
019efaa0 79217188 [FRAME: ContextTransitionFrame]
019efb80 79217188 [FRAME: ComMethodFrame]
Begin System Thread Information
# ChildEBP RetAddr
00 00000001 00000000 mscorlib_79990000+0x148e18
Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:10.343
User Time: 0:3:37.125
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01a4fcf8 7c822124 ntdll!KiFastSystemCallRet
01 01a4fcfc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01a4fd6c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01a4fd80 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01a4fda4 791fdacc mscorsvr!GetCompileInfo+0x1512
05 01a4ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 01a4ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 12
System Thread ID: d54
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 13
System Thread ID: 818
Kernel Time: 0:0:0.828
User Time: 0:1:11.218
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01dfffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 14
System Thread ID: 2a8
Kernel Time: 0:0:0.953
User Time: 0:1:16.687
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 15
System Thread ID: 8e0
Kernel Time: 0:0:1.187
User Time: 0:1:16.531
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 16
System Thread ID: 740
Kernel Time: 0:0:0.968
User Time: 0:1:3.390
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01ebffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 17
System Thread ID: eec
Kernel Time: 0:0:0.15
User Time: 0:0:4.500
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
07 01efffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 18
System Thread ID: 8f0
Kernel Time: 0:0:10.859
User Time: 0:3:39.640
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0201ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 19
System Thread ID: ed0
Kernel Time: 0:0:10.796
User Time: 0:3:37.46
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0209ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 20
System Thread ID: 430
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 022dff38 7c821364 ntdll!KiFastSystemCallRet
01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
02 022dffa4 791cc578 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578
Thread ID: 21
System Thread ID: 238
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
06 030bffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 22
System Thread ID: fd8
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
02 0313fac0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0313fb68 791b3208 0x1b2bce6
06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0313fdb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 23
System Thread ID: a94
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0375ffb8 77e66063 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
04 0375ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 24
System Thread ID: 418
Kernel Time: 0:0:0.203
User Time: 0:0:0.250
Thread Type: Other
# ChildEBP RetAddr
00 039cff14 7739c78d ntdll!KiFastSystemCallRet
01 039cff34 77694fed USER32!NtUserGetMessage+0xc
02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
07 039cffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 25
System Thread ID: fcc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
06 03ffffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 26
System Thread ID: 32c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
05 040fffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 27
System Thread ID: 6cc
Kernel Time: 0:0:0.31
User Time: 0:0:0.218
Thread Type: Other
# ChildEBP RetAddr
00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 28
System Thread ID: 9bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
05 0467ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 29
System Thread ID: 8b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
# ChildEBP RetAddr
00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
04 0965ffb0 79e78dca
aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
06 0965ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 30
System Thread ID: f10
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
# ChildEBP RetAddr
00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
06 0d9effec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 31
System Thread ID: f2c
Kernel Time: 0:0:0.15
User Time: 0:0:0.125
Thread Type: Other
# ChildEBP RetAddr
00 00a9f2c0 7c821bf4 ntdll!KiFastSystemCallRet
01 00a9f2c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00a9f2f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 00a9f324 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 00a9ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 00a9ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 32
System Thread ID: 29c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0880fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0880fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0880ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0880ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0880ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0880ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0880ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 33
System Thread ID: cbc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0955ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0955ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0955ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0955ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 34
System Thread ID: 248
Kernel Time: 0:0:0.390
User Time: 0:0:0.250
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0884ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 0884ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 0884ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 0884ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 0884ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 0884ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 0884ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 35
System Thread ID: 728
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 092bfeac 7c821bf4 ntdll!KiFastSystemCallRet
01 092bfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 092bfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
03 092bff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
04 092bff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
05 092bff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
06 092bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
07 092bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
08 092bffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 36
System Thread ID: 924
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0935ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0935ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0935ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0935ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 37
System Thread ID: eb0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0927f4f8 7c822124 ntdll!KiFastSystemCallRet
01 0927f4fc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0927f56c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0927f580 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0927f5a4 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0927ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0927ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 38
System Thread ID: ee8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0325ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 0325ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 0325ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 0325ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 0325ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 0325ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 0325ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 39
System Thread ID: ba4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 093bfe18 7c821c54 ntdll!KiFastSystemCallRet
01 093bfe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 093bff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 093bff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 093bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 093bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 093bffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 40
System Thread ID: bc0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0943ff10 7c821364 ntdll!KiFastSystemCallRet
01 0943ff14 77e42439 ntdll!NtDelayExecution+0xc
02 0943ff7c 77e424b7 kernel32!SleepEx+0x68
03 0943ff8c 776b22f4 kernel32!Sleep+0xf
04 0943ff98 776b235b ole32!CROIDTable::WorkerThreadLoop+0x14
05 0943ffa8 77670000 ole32!CRpcThread::WorkerLoop+0x1e
06 0943ffb8 77e66063 ole32!_imp__InstallApplication <PERF> (ole32+0x0)
07 0943ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 41
System Thread ID: 3d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 040aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 040aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 040affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 040affec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 42
System Thread ID: 460
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 094cfeac 7c821bf4 ntdll!KiFastSystemCallRet
01 094cfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 094cfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
03 094cff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
04 094cff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
05 094cff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
06 094cffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
07 094cffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
08 094cffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 43
System Thread ID: f00
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 095aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 095aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 095affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 095affec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 44
System Thread ID: fe4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0961ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0961ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0961ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0961ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 45
System Thread ID: 580
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0969ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0969ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0969ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0969ffec 00000000 kernel32!BaseThreadStart+0x34
Thread ID: 46
System Thread ID: 478
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0d71ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0d71ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0d71ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0d71ffec 00000000 kernel32!BaseThreadStart+0x34
*****
Dump name is formatted as: PID-Timestamp.dmp
Creating D:\program files\iisstate\output\3420-1125678433.dmp - mini user
dump
*****
Closing open log file D:\program files\iisstate\output\IISState-3420.log