Help! iisstate log analysis

External Since: Oct 07, 2003 Posts: 2

Windows server 2003 + iis 6.0
iis 6.0 stop serving asp pages (html pages working fine), the following is the iisstate log:

Opened log file 'C:\iisstate\output\IISState-3716.log'

***********************
Starting new log output
IISState version 3.2

Tue Oct 07 23:09:28 2003

OS = Windows 2003 Server
Executable: inetinfo.exe
PID = 3716

Note: Thread times are formatted as HH:MM:SS.ms

***********************

Thread ID: 0
System Thread ID: d70
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0006f9a8 77f3303b SharedUserData!SystemCallStub+0x4
01 0006f9ac 77e1905d ntdll!NtReadFile+0xc
02 0006fa14 77d851f1 kernel32!ReadFile+0x16c
03 0006fa40 77d85297 ADVAPI32!ScGetPipeInput+0x28
04 0006fab0 77dca7f1 ADVAPI32!ScDispatcherLoop+0x4c
05 0006fcec 01002655 ADVAPI32!StartServiceCtrlDispatcherA+0x91
06 0006fe1c 010027ea inetinfo!StartDispatchTable+0x214
07 0006ff44 01003160 inetinfo!main+0x104
08 0006ffc0 77e1f38c inetinfo!mainCRTStartup+0x12f
09 0006fff0 00000000 kernel32!BaseProcessStart+0x23

Thread ID: 1
System Thread ID: a8c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0089fe18 77f33741 SharedUserData!SystemCallStub+0x4
01 0089fe1c 77e11817 ntdll!ZwWaitForSingleObject+0xc
02 0089fe8c 77e1168f kernel32!WaitForSingleObjectEx+0xac
03 0089fe9c 01002cf9 kernel32!WaitForSingleObject+0xf
04 0089ffb8 77e1a990 inetinfo!W3SVCThreadEntry+0x3b
05 0089ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 2
System Thread ID: 2a0
Kernel Time: 0:0:0.62
User Time: 0:0:0.78
Thread Type: Other
# ChildEBP RetAddr
00 008dfcc4 77f33741 SharedUserData!SystemCallStub+0x4
01 008dfcc8 77e11817 ntdll!ZwWaitForSingleObject+0xc
02 008dfd38 77e1168f kernel32!WaitForSingleObjectEx+0xac
03 008dfd48 64cc24ac kernel32!WaitForSingleObject+0xf
04 008dfd70 010023b6 iisadmin!ServiceEntry+0x214
05 008dffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
06 008dffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
07 008dffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 3
System Thread ID: c4c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00adff9c 77f3262b SharedUserData!SystemCallStub+0x4
01 00adffa0 77f5b5b2 ntdll!NtDelayExecution+0xc
02 00adffb8 77e1a990 ntdll!RtlpTimerThread+0x45
03 00adffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 4
System Thread ID: 9d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00befeb0 77f3372d SharedUserData!SystemCallStub+0x4
01 00befeb4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 00beff5c 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 00beff74 6e36377a kernel32!WaitForMultipleObjects+0x17
04 00beffa0 6e366012 COADMIN!NOTIFY_CONTEXT::GetNextContext+0x68
05 00beffb8 77e1a990 COADMIN!NOTIFY_CONTEXT::NotifyThreadProc+0x62
06 00beffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 5
System Thread ID: 710
Kernel Time: 0:0:0.125
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 015bfbc0 77f3372d SharedUserData!SystemCallStub+0x4
01 015bfbc4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 015bfc6c 77ce2695 kernel32!WaitForMultipleObjectsEx+0x11a
03 015bfcc8 77ce37f0 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 015bfce4 646e5723 USER32!MsgWaitForMultipleObjects+0x1d
05 015bfd30 6b77305d INFOCOMM!IIS_SERVICE::StartServiceOperation+0x22f
06 015bfd70 010023b6 SMTPSVC!ServiceEntry+0x129
07 015bffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
08 015bffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
09 015bffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 6
System Thread ID: ba0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0168fbc0 77f3372d SharedUserData!SystemCallStub+0x4
01 0168fbc4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 0168fc6c 77ce2695 kernel32!WaitForMultipleObjectsEx+0x11a
03 0168fcc8 77ce37f0 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
04 0168fce4 646e5723 USER32!MsgWaitForMultipleObjects+0x1d
05 0168fd30 6954d973 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x22f
06 0168fd70 010023b6 ftpsvc2!ServiceEntry+0xac
07 0168ffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
08 0168ffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
09 0168ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 7
System Thread ID: ea4
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 016cfe20 77f3313f SharedUserData!SystemCallStub+0x4
01 016cfe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
02 016cff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 016cff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
04 016cffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
05 016cffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
06 016cffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 8
System Thread ID: 340
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 018dfcec 77f3372d SharedUserData!SystemCallStub+0x4
01 018dfcf0 77f65297 ntdll!NtWaitForMultipleObjects+0xc
02 018dffb8 77e1a990 ntdll!RtlpWaitThread+0x158
03 018dffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 9
System Thread ID: 900
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 019dff50 77f330c7 SharedUserData!SystemCallStub+0x4
01 019dff54 77e130bc ntdll!ZwRemoveIoCompletion+0xc
02 019dff80 64187235 kernel32!GetQueuedCompletionStatus+0x27
03 019dffb4 77f4cd6b ISATQ!AtqPoolThread+0x40

Thread ID: 10
System Thread ID: e78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 01a1ff50 77f330c7 SharedUserData!SystemCallStub+0x4
01 01a1ff54 77e130bc ntdll!ZwRemoveIoCompletion+0xc
02 01a1ff80 64187235 kernel32!GetQueuedCompletionStatus+0x27
03 01a1ffb8 77e1a990 ISATQ!AtqPoolThread+0x40
04 01a1ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 11
System Thread ID: ecc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 01d5fe20 77f3313f SharedUserData!SystemCallStub+0x4
01 01d5fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
02 01d5ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 01d5ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
04 01d5ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
05 01d5ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
06 01d5ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 12
System Thread ID: 808
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 01d9feb4 77f330c7 SharedUserData!SystemCallStub+0x4
01 01d9feb8 77e130bc ntdll!ZwRemoveIoCompletion+0xc
02 01d9fee4 77c3df31 kernel32!GetQueuedCompletionStatus+0x27
03 01d9ff20 77c3ddd8 RPCRT4!COMMON_ProcessCalls+0x9f
04 01d9ff8c 77c380f9 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x115
05 01d9ff90 77c495f1 RPCRT4!ProcessIOEventsWrapper+0x9
06 01d9ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
07 01d9ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
08 01d9ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 13
System Thread ID: 350
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e1fecc 77f3372d SharedUserData!SystemCallStub+0x4
01 01e1fed0 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 01e1ff78 6954882e kernel32!WaitForMultipleObjectsEx+0x11a
03 01e1ffb0 77f3308b ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x32
04 01e1ffb8 77e1a990 ntdll!NtRegisterThreadTerminatePort+0xc
05 01e1ffc4 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 14
System Thread ID: 224
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e5fec8 77f3372d SharedUserData!SystemCallStub+0x4
01 01e5fecc 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 01e5ff74 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 01e5ff8c 69772430 kernel32!WaitForMultipleObjects+0x17
04 01e5ffb8 77e1a990 exstrace!RegNotifyThread+0x68
05 01e5ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 15
System Thread ID: aa4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e9fecc 77f3372d SharedUserData!SystemCallStub+0x4
01 01e9fed0 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 01e9ff78 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 01e9ff90 697719c0 kernel32!WaitForMultipleObjects+0x17
04 01e9ffb8 77e1a990 exstrace!WriteTraceThread+0x2f
05 01e9ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 16
System Thread ID: 95c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0201ff18 77f33741 SharedUserData!SystemCallStub+0x4
01 0201ff1c 77e11817 ntdll!ZwWaitForSingleObject+0xc
02 0201ff8c 77e1168f kernel32!WaitForSingleObjectEx+0xac
03 0201ff9c 01648673 kernel32!WaitForSingleObject+0xf
04 0201ffb8 77e1a990 FCACHDLL!CScheduleThread::ScheduleThread+0x60
05 0201ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 17
System Thread ID: 49c
Kernel Time: 0:0:0.78
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0215fec0 77f3372d SharedUserData!SystemCallStub+0x4
01 0215fec4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 0215ff6c 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 0215ff84 6b78b2d6 kernel32!WaitForMultipleObjects+0x17
04 0215ffb8 77e1a990 SMTPSVC!TcpRegNotifyThread+0xdc
05 0215ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 18
System Thread ID: 81c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0219ff20 77f33741 SharedUserData!SystemCallStub+0x4
01 0219ff24 77e11817 ntdll!ZwWaitForSingleObject+0xc
02 0219ff94 77e1168f kernel32!WaitForSingleObjectEx+0xac
03 0219ffa4 6b78b17a kernel32!WaitForSingleObject+0xf
04 0219ffb8 77e1a990 SMTPSVC!FreeLibThread+0x2c
05 0219ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 19
System Thread ID: c6c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0221fe38 77f33741 SharedUserData!SystemCallStub+0x4
01 0221fe3c 71a93ac3 ntdll!ZwWaitForSingleObject+0xc
02 0221fe78 71a939d1 mswsock!SockWaitForSingleObject+0x19b
03 0221ff3c 71b716c9 mswsock!WSPSelect+0x229
04 0221ff8c 64184696 WS2_32!select+0xb9
05 0221ffb4 64184700 ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
06 0221ffb8 77e1a990 ISATQ!BmonThreadFunc+0x9
07 0221ffc4 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 20
System Thread ID: a64
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0275fe20 77f3313f SharedUserData!SystemCallStub+0x4
01 0275fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
02 0275ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 0275ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
04 0275ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
05 0275ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
06 0275ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 21
System Thread ID: 3a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0279ff10 77f33741 SharedUserData!SystemCallStub+0x4
01 0279ff14 77e11817 ntdll!ZwWaitForSingleObject+0xc
02 0279ff84 77e1168f kernel32!WaitForSingleObjectEx+0xac
03 0279ff94 022dd064 kernel32!WaitForSingleObject+0xf
04 0279ffb8 77e1a990 aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xc1
05 0279ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 22
System Thread ID: 818
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0281fe84 77f3372d SharedUserData!SystemCallStub+0x4
01 0281fe88 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
02 0281ff30 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
03 0281ff48 022bc648 kernel32!WaitForMultipleObjects+0x17
04 0281ffa4 6b77e8ae aqueue!CConnMgr::GetNextConnection+0x1e1
05 0281ffb8 77e1a990 SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x21
06 0281ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 23
System Thread ID: 864
Kernel Time: 0:0:0.62
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 00eeff70 77f330c7 SharedUserData!SystemCallStub+0x4
01 00eeff74 77f6e6ae ntdll!ZwRemoveIoCompletion+0xc
02 00eeffb8 77e1a990 ntdll!RtlpWorkerThread+0x3b
03 00eeffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 24
System Thread ID: ce0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b1ff70 77f330c7 SharedUserData!SystemCallStub+0x4
01 00b1ff74 77f6e6ae ntdll!ZwRemoveIoCompletion+0xc
02 00b1ffb8 77e1a990 ntdll!RtlpWorkerThread+0x3b
03 00b1ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 25
System Thread ID: 14c
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00f2fe20 77f3313f SharedUserData!SystemCallStub+0x4
01 00f2fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
02 00f2ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 00f2ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
04 00f2ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
05 00f2ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
06 00f2ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 26
System Thread ID: a04
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00f6fe20 77f3313f SharedUserData!SystemCallStub+0x4
01 00f6fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
02 00f6ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
03 00f6ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
04 00f6ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
05 00f6ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
06 00f6ffec 00000000 kernel32!BaseThreadStart+0x34

Closing open log file C:\iisstate\output\IISState-3716.log

External Since: Sep 05, 2003 Posts: 407

what mode you running ?
IIS 6 worker process or IIS 5 isolation mode ?

you are capturing inetinfo.exe and all threads are idle.
try catch the related w3wp.exe.

--
Regards,
Bernard Cheah
<a style='text-decoration: underline;' href="http://support.microsoft.com/" target="_blank">http://support.microsoft.com/</a>
Please respond to newsgroups only ...

"Mat" <anonymous.RemoveThis@discussions.microsoft.com> wrote in message
news:1095A3C0-7B19-4D40-B508-A94FACE7C3EC@microsoft.com...
> Windows server 2003 + iis 6.0
> iis 6.0 stop serving asp pages (html pages working fine), the following is
the iisstate log:
>
> Opened log file 'C:\iisstate\output\IISState-3716.log'
>
> ***********************
> Starting new log output
> IISState version 3.2
>
> Tue Oct 07 23:09:28 2003
>
> OS = Windows 2003 Server
> Executable: inetinfo.exe
> PID = 3716
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: d70
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0006f9a8 77f3303b SharedUserData!SystemCallStub+0x4
> 01 0006f9ac 77e1905d ntdll!NtReadFile+0xc
> 02 0006fa14 77d851f1 kernel32!ReadFile+0x16c
> 03 0006fa40 77d85297 ADVAPI32!ScGetPipeInput+0x28
> 04 0006fab0 77dca7f1 ADVAPI32!ScDispatcherLoop+0x4c
> 05 0006fcec 01002655 ADVAPI32!StartServiceCtrlDispatcherA+0x91
> 06 0006fe1c 010027ea inetinfo!StartDispatchTable+0x214
> 07 0006ff44 01003160 inetinfo!main+0x104
> 08 0006ffc0 77e1f38c inetinfo!mainCRTStartup+0x12f
> 09 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>
>
>
>
> Thread ID: 1
> System Thread ID: a8c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0089fe18 77f33741 SharedUserData!SystemCallStub+0x4
> 01 0089fe1c 77e11817 ntdll!ZwWaitForSingleObject+0xc
> 02 0089fe8c 77e1168f kernel32!WaitForSingleObjectEx+0xac
> 03 0089fe9c 01002cf9 kernel32!WaitForSingleObject+0xf
> 04 0089ffb8 77e1a990 inetinfo!W3SVCThreadEntry+0x3b
> 05 0089ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 2
> System Thread ID: 2a0
> Kernel Time: 0:0:0.62
> User Time: 0:0:0.78
> Thread Type: Other
> # ChildEBP RetAddr
> 00 008dfcc4 77f33741 SharedUserData!SystemCallStub+0x4
> 01 008dfcc8 77e11817 ntdll!ZwWaitForSingleObject+0xc
> 02 008dfd38 77e1168f kernel32!WaitForSingleObjectEx+0xac
> 03 008dfd48 64cc24ac kernel32!WaitForSingleObject+0xf
> 04 008dfd70 010023b6 iisadmin!ServiceEntry+0x214
> 05 008dffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
> 06 008dffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
> 07 008dffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 3
> System Thread ID: c4c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00adff9c 77f3262b SharedUserData!SystemCallStub+0x4
> 01 00adffa0 77f5b5b2 ntdll!NtDelayExecution+0xc
> 02 00adffb8 77e1a990 ntdll!RtlpTimerThread+0x45
> 03 00adffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 4
> System Thread ID: 9d0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00befeb0 77f3372d SharedUserData!SystemCallStub+0x4
> 01 00befeb4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 00beff5c 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 00beff74 6e36377a kernel32!WaitForMultipleObjects+0x17
> 04 00beffa0 6e366012 COADMIN!NOTIFY_CONTEXT::GetNextContext+0x68
> 05 00beffb8 77e1a990 COADMIN!NOTIFY_CONTEXT::NotifyThreadProc+0x62
> 06 00beffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 5
> System Thread ID: 710
> Kernel Time: 0:0:0.125
> User Time: 0:0:0.31
> Thread Status: Thread is in a WAIT state.
> Thread Type: SMTP Service Worker Thread
> # ChildEBP RetAddr
> 00 015bfbc0 77f3372d SharedUserData!SystemCallStub+0x4
> 01 015bfbc4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 015bfc6c 77ce2695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 015bfcc8 77ce37f0 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 015bfce4 646e5723 USER32!MsgWaitForMultipleObjects+0x1d
> 05 015bfd30 6b77305d INFOCOMM!IIS_SERVICE::StartServiceOperation+0x22f
> 06 015bfd70 010023b6 SMTPSVC!ServiceEntry+0x129
> 07 015bffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
> 08 015bffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
> 09 015bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 6
> System Thread ID: ba0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0168fbc0 77f3372d SharedUserData!SystemCallStub+0x4
> 01 0168fbc4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0168fc6c 77ce2695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0168fcc8 77ce37f0 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 0168fce4 646e5723 USER32!MsgWaitForMultipleObjects+0x1d
> 05 0168fd30 6954d973 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x22f
> 06 0168fd70 010023b6 ftpsvc2!ServiceEntry+0xac
> 07 0168ffa8 77d8571b inetinfo!InetinfoStartService+0x2a6
> 08 0168ffb8 77e1a990 ADVAPI32!ScSvcctrlThreadA+0xe
> 09 0168ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 7
> System Thread ID: ea4
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 016cfe20 77f3313f SharedUserData!SystemCallStub+0x4
> 01 016cfe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 016cff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 016cff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 016cffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 016cffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 06 016cffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 8
> System Thread ID: 340
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 018dfcec 77f3372d SharedUserData!SystemCallStub+0x4
> 01 018dfcf0 77f65297 ntdll!NtWaitForMultipleObjects+0xc
> 02 018dffb8 77e1a990 ntdll!RtlpWaitThread+0x158
> 03 018dffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 9
> System Thread ID: 900
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 019dff50 77f330c7 SharedUserData!SystemCallStub+0x4
> 01 019dff54 77e130bc ntdll!ZwRemoveIoCompletion+0xc
> 02 019dff80 64187235 kernel32!GetQueuedCompletionStatus+0x27
> 03 019dffb4 77f4cd6b ISATQ!AtqPoolThread+0x40
>
>
>
>
> Thread ID: 10
> System Thread ID: e78
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 01a1ff50 77f330c7 SharedUserData!SystemCallStub+0x4
> 01 01a1ff54 77e130bc ntdll!ZwRemoveIoCompletion+0xc
> 02 01a1ff80 64187235 kernel32!GetQueuedCompletionStatus+0x27
> 03 01a1ffb8 77e1a990 ISATQ!AtqPoolThread+0x40
> 04 01a1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 11
> System Thread ID: ecc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 01d5fe20 77f3313f SharedUserData!SystemCallStub+0x4
> 01 01d5fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 01d5ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 01d5ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 01d5ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 01d5ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 06 01d5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 12
> System Thread ID: 808
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 01d9feb4 77f330c7 SharedUserData!SystemCallStub+0x4
> 01 01d9feb8 77e130bc ntdll!ZwRemoveIoCompletion+0xc
> 02 01d9fee4 77c3df31 kernel32!GetQueuedCompletionStatus+0x27
> 03 01d9ff20 77c3ddd8 RPCRT4!COMMON_ProcessCalls+0x9f
> 04 01d9ff8c 77c380f9 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x115
> 05 01d9ff90 77c495f1 RPCRT4!ProcessIOEventsWrapper+0x9
> 06 01d9ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 07 01d9ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 08 01d9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 13
> System Thread ID: 350
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e1fecc 77f3372d SharedUserData!SystemCallStub+0x4
> 01 01e1fed0 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 01e1ff78 6954882e kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01e1ffb0 77f3308b ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x32
> 04 01e1ffb8 77e1a990 ntdll!NtRegisterThreadTerminatePort+0xc
> 05 01e1ffc4 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 14
> System Thread ID: 224
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e5fec8 77f3372d SharedUserData!SystemCallStub+0x4
> 01 01e5fecc 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 01e5ff74 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01e5ff8c 69772430 kernel32!WaitForMultipleObjects+0x17
> 04 01e5ffb8 77e1a990 exstrace!RegNotifyThread+0x68
> 05 01e5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 15
> System Thread ID: aa4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e9fecc 77f3372d SharedUserData!SystemCallStub+0x4
> 01 01e9fed0 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 01e9ff78 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01e9ff90 697719c0 kernel32!WaitForMultipleObjects+0x17
> 04 01e9ffb8 77e1a990 exstrace!WriteTraceThread+0x2f
> 05 01e9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 16
> System Thread ID: 95c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0201ff18 77f33741 SharedUserData!SystemCallStub+0x4
> 01 0201ff1c 77e11817 ntdll!ZwWaitForSingleObject+0xc
> 02 0201ff8c 77e1168f kernel32!WaitForSingleObjectEx+0xac
> 03 0201ff9c 01648673 kernel32!WaitForSingleObject+0xf
> 04 0201ffb8 77e1a990 FCACHDLL!CScheduleThread::ScheduleThread+0x60
> 05 0201ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 17
> System Thread ID: 49c
> Kernel Time: 0:0:0.78
> User Time: 0:0:0.15
> Thread Status: Thread is in a WAIT state.
> Thread Type: SMTP Service Worker Thread
> # ChildEBP RetAddr
> 00 0215fec0 77f3372d SharedUserData!SystemCallStub+0x4
> 01 0215fec4 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0215ff6c 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0215ff84 6b78b2d6 kernel32!WaitForMultipleObjects+0x17
> 04 0215ffb8 77e1a990 SMTPSVC!TcpRegNotifyThread+0xdc
> 05 0215ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 18
> System Thread ID: 81c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: SMTP Service Worker Thread
> # ChildEBP RetAddr
> 00 0219ff20 77f33741 SharedUserData!SystemCallStub+0x4
> 01 0219ff24 77e11817 ntdll!ZwWaitForSingleObject+0xc
> 02 0219ff94 77e1168f kernel32!WaitForSingleObjectEx+0xac
> 03 0219ffa4 6b78b17a kernel32!WaitForSingleObject+0xf
> 04 0219ffb8 77e1a990 SMTPSVC!FreeLibThread+0x2c
> 05 0219ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 19
> System Thread ID: c6c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 0221fe38 77f33741 SharedUserData!SystemCallStub+0x4
> 01 0221fe3c 71a93ac3 ntdll!ZwWaitForSingleObject+0xc
> 02 0221fe78 71a939d1 mswsock!SockWaitForSingleObject+0x19b
> 03 0221ff3c 71b716c9 mswsock!WSPSelect+0x229
> 04 0221ff8c 64184696 WS2_32!select+0xb9
> 05 0221ffb4 64184700 ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
> 06 0221ffb8 77e1a990 ISATQ!BmonThreadFunc+0x9
> 07 0221ffc4 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 20
> System Thread ID: a64
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0275fe20 77f3313f SharedUserData!SystemCallStub+0x4
> 01 0275fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 0275ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 0275ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 0275ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 0275ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 06 0275ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 21
> System Thread ID: 3a0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0279ff10 77f33741 SharedUserData!SystemCallStub+0x4
> 01 0279ff14 77e11817 ntdll!ZwWaitForSingleObject+0xc
> 02 0279ff84 77e1168f kernel32!WaitForSingleObjectEx+0xac
> 03 0279ff94 022dd064 kernel32!WaitForSingleObject+0xf
> 04 0279ffb8 77e1a990 aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xc1
> 05 0279ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 22
> System Thread ID: 818
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: SMTP Service Worker Thread
> # ChildEBP RetAddr
> 00 0281fe84 77f3372d SharedUserData!SystemCallStub+0x4
> 01 0281fe88 77e11bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0281ff30 77e1b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0281ff48 022bc648 kernel32!WaitForMultipleObjects+0x17
> 04 0281ffa4 6b77e8ae aqueue!CConnMgr::GetNextConnection+0x1e1
> 05 0281ffb8 77e1a990 SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x21
> 06 0281ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 23
> System Thread ID: 864
> Kernel Time: 0:0:0.62
> User Time: 0:0:0.31
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00eeff70 77f330c7 SharedUserData!SystemCallStub+0x4
> 01 00eeff74 77f6e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 00eeffb8 77e1a990 ntdll!RtlpWorkerThread+0x3b
> 03 00eeffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 24
> System Thread ID: ce0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00b1ff70 77f330c7 SharedUserData!SystemCallStub+0x4
> 01 00b1ff74 77f6e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 00b1ffb8 77e1a990 ntdll!RtlpWorkerThread+0x3b
> 03 00b1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 25
> System Thread ID: 14c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.46
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 00f2fe20 77f3313f SharedUserData!SystemCallStub+0x4
> 01 00f2fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 00f2ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 00f2ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 00f2ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 00f2ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 06 00f2ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 26
> System Thread ID: a04
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 00f6fe20 77f3313f SharedUserData!SystemCallStub+0x4
> 01 00f6fe24 77c37b25 ntdll!NtReplyWaitReceivePortEx+0xc
> 02 00f6ff8c 77c496a9 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x193
> 03 00f6ff90 77c495f1 RPCRT4!RecvLotsaCallsWrapper+0x9
> 04 00f6ffb0 77c496d7 RPCRT4!BaseCachedThreadRoutine+0x9c
> 05 00f6ffb8 77e1a990 RPCRT4!ThreadStartRoutine+0x17
> 06 00f6ffec 00000000 kernel32!BaseThreadStart+0x34
>
> Closing open log file C:\iisstate\output\IISState-3716.log
>