Application Pool Suffered a Fatal Communication Error with..

Hi

I run the IISState and here is the log. Anyone know what is the error about?

Thread ID: 0
System Thread ID: 1dec
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523e5 w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23

Thread ID: 1
System Thread ID: 1df0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 009afea0 7c822114 ntdll!KiFastSystemCallRet
01 009afea4 7c80e504 ntdll!NtWaitForMultipleObjects+0xc
02 009aff48 7c80e933 ntdll!EtwpWaitForMultipleObjectsEx+0xf7
03 009affb8 77e6608b ntdll!EtwpEventPump+0x27f
04 009affec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 2
System Thread ID: 1df4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e6608b ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 3
System Thread ID: 1df8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00a2ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 00a2ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 00a2ffb8 77e6608b ntdll!RtlpWorkerThread+0x3d
03 00a2ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 4
System Thread ID: 1dfc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe18 7c821c54 ntdll!KiFastSystemCallRet
01 00a8fe1c 77c7543c ntdll!ZwReplyWaitReceivePortEx+0xc
02 00a8ff84 77c5778c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 00a8ff8c 77c5f7db RPCRT4!RecvLotsaCallsWrapper+0xd
04 00a8ffac 77c5de80 RPCRT4!BaseCachedThreadRoutine+0x9d
05 00a8ffb8 77e6608b RPCRT4!ThreadStartRoutine+0x1b
06 00a8ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 5
System Thread ID: 1e04
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c8ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c8ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00c8ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c8ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c8ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c8ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c8ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 6
System Thread ID: 1e08
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00ccff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00ccff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00ccff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00ccff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00ccffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00ccffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00ccffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 7
System Thread ID: 1e0c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d0ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d0ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00d0ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d0ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d0ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d0ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d0ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 8
System Thread ID: 1e10
Kernel Time: 0:0:0.46
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d4ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d4ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00d4ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d4ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d4ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d4ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d4ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 9
System Thread ID: 1e14
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e0fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e0fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e0ffb8 77e6608b ntdll!RtlpWaitThread+0x161
03 00e0ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 10
System Thread ID: 1e18
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e6608b w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 11
System Thread ID: 1e1c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0182fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0182fe1c 77c7543c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0182ff84 77c5778c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0182ff8c 77c5f7db RPCRT4!RecvLotsaCallsWrapper+0xd
04 0182ffac 77c5de80 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0182ffb8 77e6608b RPCRT4!ThreadStartRoutine+0x1b
06 0182ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 12
System Thread ID: 1e24
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
-
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0187fec0 7c822114 ntdll!KiFastSystemCallRet
01 0187fec4 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 0187ff6c 77e6109d kernel32!WaitForMultipleObjectsEx+0x11a
03 0187ff88 01831bc2 kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0187ffb8 77e6608b stsfltr+0x1bc2
05 0187ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 13
System Thread ID: 1e2c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\60\BIN\onetutil.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 019efc68 7c822114 ntdll!KiFastSystemCallRet
01 019efc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 019efd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 019efd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 019efd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 019efe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 019efe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 019eff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 019effb8 77e6608b onetutil!VthreadContext::release+0x16e
09 019effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 14
System Thread ID: 1e30
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01a7fc68 7c822114 ntdll!KiFastSystemCallRet
01 01a7fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01a7fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01a7fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01a7fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01a7fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01a7fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01a7ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01a7ffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01a7ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 15
System Thread ID: 1e34
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b0fc68 7c822114 ntdll!KiFastSystemCallRet
01 01b0fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01b0fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b0fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01b0fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01b0fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01b0fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01b0ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01b0ffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01b0ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 16
System Thread ID: 1e38
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b9fc68 7c822114 ntdll!KiFastSystemCallRet
01 01b9fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01b9fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b9fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01b9fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01b9fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01b9fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01b9ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01b9ffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01b9ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 17
System Thread ID: 1e3c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01c2fc68 7c822114 ntdll!KiFastSystemCallRet
01 01c2fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01c2fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01c2fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01c2fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01c2fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01c2fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01c2ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01c2ffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01c2ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 18
System Thread ID: 1e40
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01cbfc68 7c822114 ntdll!KiFastSystemCallRet
01 01cbfc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01cbfd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01cbfd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01cbfd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01cbfe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01cbfe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01cbff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01cbffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01cbffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 19
System Thread ID: 1e44
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01d4fc68 7c822114 ntdll!KiFastSystemCallRet
01 01d4fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01d4fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01d4fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01d4fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01d4fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01d4fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01d4ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01d4ffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01d4ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 20
System Thread ID: 1e48
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01ddfc68 7c822114 ntdll!KiFastSystemCallRet
01 01ddfc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 01ddfd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 01ddfd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 01ddfd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 01ddfe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 01ddfe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
07 01ddff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
08 01ddffb8 77e6608b onetutil!VthreadContext::release+0x16e
09 01ddffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 21
System Thread ID: 1e54
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\60\BIN\stswel.dll -
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 020efc7c 7c822114 ntdll!KiFastSystemCallRet
01 020efc80 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 020efd28 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
03 020efd84 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 020efdac 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
05 020efe20 3319a301 ole32!CoWaitForMultipleHandles+0xcf
WARNING: Stack unwind information not available. Following frames may be
wrong.
06 020efe54 333a6c9d onetutil!VwaitForMultipleObjects+0xa0
07 020eff80 331cd4ba stswel!VeventManager::ThreadHandlerProc+0xde
08 020effb8 77e6608b onetutil!VthreadContext::release+0x16e
09 020effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 22
System Thread ID: 1e58
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0250fd00 7c822124 ntdll!KiFastSystemCallRet
01 0250fd04 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0250fd74 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0250fd88 75bb22b9 kernel32!WaitForSingleObject+0x12
04 0250ffb8 77e6608b comsvcs!PingThread+0xf6
05 0250ffec 00000000 kernel32!BaseThreadStart+0x34


Thread ID: 23
System Thread ID: 1e5c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0271fdf4 7c822114 ntdll!KiFastSystemCallRet
01 0271fdf8 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 0271fea0 77e6109d kernel32!WaitForMultipleObjectsEx+0x11a
03 0271febc 333e70cd kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0271ff00 00000004 stswel!VvirusCheckReport::getDownloadReportUrl+0x1ae


Thread ID: 24
System Thread ID: 1e64
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
SaveModuleToMemory failed
Failed to load SOS data.
No valid SOS data table found.

Begin System Thread Information

# ChildEBP RetAddr
00 0284fea4 00000000 ntdll!KiFastSystemCallRet
GetContextState failed, 0x8007001F
GetContextState failed, 0x8007001F
GetContextState failed, 0x8007001F

Thread ID: 25
System Thread ID: 0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
GetContextState failed, 0x8007001F

Thanks.

What error are you talking about? I don't see anything bad happening in the
log

Cheers
Ken


"CK" <CK RemoveThis @discussions.microsoft.com> wrote in message
news:9F27719F-F4AF-46E0-8A91-0C267DE15C92@microsoft.com...
> Hi
>
> I run the IISState and here is the log. Anyone know what is the error
> about?
>
> Thread ID: 0
> System Thread ID: 1dec
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.31
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
> 01 0006fc0c 77e6bad8 ntdll!NtWaitForSingleObject+0xc
> 02 0006fc7c 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
> 03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
> 04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
> 05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
> 06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
> 07 0006ff0c 0100187c w3core!UlW3Start+0x26e
> 08 0006ff44 01001a23 w3wp!wmain+0x22a
> 09 0006ffc0 77e523e5 w3wp!wmainCRTStartup+0x12b
> 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>
> Thread ID: 1
> System Thread ID: 1df0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009afea0 7c822114 ntdll!KiFastSystemCallRet
> 01 009afea4 7c80e504 ntdll!NtWaitForMultipleObjects+0xc
> 02 009aff48 7c80e933 ntdll!EtwpWaitForMultipleObjectsEx+0xf7
> 03 009affb8 77e6608b ntdll!EtwpEventPump+0x27f
> 04 009affec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 2
> System Thread ID: 1df4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
> 01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
> 02 009effb8 77e6608b ntdll!RtlpTimerThread+0x47
> 03 009effec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 3
> System Thread ID: 1df8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00a2ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00a2ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 00a2ffb8 77e6608b ntdll!RtlpWorkerThread+0x3d
> 03 00a2ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 4
> System Thread ID: 1dfc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 00a8fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 00a8fe1c 77c7543c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 00a8ff84 77c5778c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 00a8ff8c 77c5f7db RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 00a8ffac 77c5de80 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 00a8ffb8 77e6608b RPCRT4!ThreadStartRoutine+0x1b
> 06 00a8ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 5
> System Thread ID: 1e04
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00c8ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00c8ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
> 02 00c8ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00c8ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00c8ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00c8ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00c8ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 6
> System Thread ID: 1e08
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00ccff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00ccff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
> 02 00ccff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00ccff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00ccffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00ccffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00ccffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 7
> System Thread ID: 1e0c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d0ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d0ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
> 02 00d0ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d0ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d0ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d0ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 8
> System Thread ID: 1e10
> Kernel Time: 0:0:0.46
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d4ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d4ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
> 02 00d4ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d4ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d4ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d4ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d4ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 9
> System Thread ID: 1e14
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00e0fcec 7c822114 ntdll!KiFastSystemCallRet
> 01 00e0fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
> 02 00e0ffb8 77e6608b ntdll!RtlpWaitThread+0x161
> 03 00e0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 10
> System Thread ID: 1e18
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 017efa84 7c822124 ntdll!KiFastSystemCallRet
> 01 017efa88 77e6bad8 ntdll!NtWaitForSingleObject+0xc
> 02 017efaf8 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
> 03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
> 04 017effb8 77e6608b w3core!HTTP_COMPRESSION::CompressionThread+0x126
> 05 017effec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 11
> System Thread ID: 1e1c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0182fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 0182fe1c 77c7543c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 0182ff84 77c5778c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 0182ff8c 77c5f7db RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 0182ffac 77c5de80 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 0182ffb8 77e6608b RPCRT4!ThreadStartRoutine+0x1b
> 06 0182ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 12
> System Thread ID: 1e24
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> -
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0187fec0 7c822114 ntdll!KiFastSystemCallRet
> 01 0187fec4 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 0187ff6c 77e6109d kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0187ff88 01831bc2 kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0187ffb8 77e6608b stsfltr+0x1bc2
> 05 0187ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 13
> System Thread ID: 1e2c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\60\BIN\onetutil.dll -
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 019efc68 7c822114 ntdll!KiFastSystemCallRet
> 01 019efc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 019efd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 019efd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 019efd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 019efe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 019efe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 019eff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 019effb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 019effec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 14
> System Thread ID: 1e30
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01a7fc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01a7fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01a7fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01a7fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01a7fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01a7fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01a7fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01a7ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01a7ffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01a7ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 15
> System Thread ID: 1e34
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01b0fc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01b0fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01b0fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01b0fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01b0fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01b0fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01b0fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01b0ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01b0ffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01b0ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 16
> System Thread ID: 1e38
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01b9fc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01b9fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01b9fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01b9fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01b9fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01b9fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01b9fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01b9ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01b9ffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01b9ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 17
> System Thread ID: 1e3c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01c2fc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01c2fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01c2fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01c2fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01c2fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01c2fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01c2fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01c2ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01c2ffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01c2ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 18
> System Thread ID: 1e40
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01cbfc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01cbfc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01cbfd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01cbfd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01cbfd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01cbfe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01cbfe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01cbff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01cbffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01cbffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 19
> System Thread ID: 1e44
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01d4fc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01d4fc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01d4fd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01d4fd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01d4fd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01d4fe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01d4fe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01d4ff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01d4ffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01d4ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 20
> System Thread ID: 1e48
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01ddfc68 7c822114 ntdll!KiFastSystemCallRet
> 01 01ddfc6c 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 01ddfd14 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01ddfd70 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 01ddfd98 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 01ddfe0c 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 01ddfe40 331cdc7c onetutil!VwaitForMultipleObjects+0xa0
> 07 01ddff80 331cd4ba onetutil!COWSThreadWithHeap::Uninitialize+0x327
> 08 01ddffb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 01ddffec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 21
> System Thread ID: 1e54
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\60\BIN\stswel.dll -
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 020efc7c 7c822114 ntdll!KiFastSystemCallRet
> 01 020efc80 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 020efd28 7739cd38 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 020efd84 77697483 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 020efdac 776c5fe1 ole32!CCliModalLoop::BlockFn+0x80
> 05 020efe20 3319a301 ole32!CoWaitForMultipleHandles+0xcf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 06 020efe54 333a6c9d onetutil!VwaitForMultipleObjects+0xa0
> 07 020eff80 331cd4ba stswel!VeventManager::ThreadHandlerProc+0xde
> 08 020effb8 77e6608b onetutil!VthreadContext::release+0x16e
> 09 020effec 00000000 kernel32!BaseThreadStart+0x34
>
> Thread ID: 22
> System Thread ID: 1e58
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 0250fd00 7c822124 ntdll!KiFastSystemCallRet
> 01 0250fd04 77e6bad8 ntdll!NtWaitForSingleObject+0xc
> 02 0250fd74 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
> 03 0250fd88 75bb22b9 kernel32!WaitForSingleObject+0x12
> 04 0250ffb8 77e6608b comsvcs!PingThread+0xf6
> 05 0250ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 23
> System Thread ID: 1e5c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0271fdf4 7c822114 ntdll!KiFastSystemCallRet
> 01 0271fdf8 77e67143 ntdll!NtWaitForMultipleObjects+0xc
> 02 0271fea0 77e6109d kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0271febc 333e70cd kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0271ff00 00000004 stswel!VvirusCheckReport::getDownloadReportUrl+0x1ae
>
>
> Thread ID: 24
> System Thread ID: 1e64
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> SaveModuleToMemory failed
> Failed to load SOS data.
> No valid SOS data table found.
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> 00 0284fea4 00000000 ntdll!KiFastSystemCallRet
> GetContextState failed, 0x8007001F
> GetContextState failed, 0x8007001F
> GetContextState failed, 0x8007001F
>
> Thread ID: 25
> System Thread ID: 0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> GetContextState failed, 0x8007001F
>
> Thanks.