On Thu, 21 Apr 2005 01:09:02 -0700, Baddel
<Baddel RemoveThis @discussions.microsoft.com> wrote:
Sounds like you may have a web app running bad. Gone haywire. Bad
programming.
You can try iistracer at
<a style='text-decoration: underline;' href="http://www.serverautomationtools.com/webcgi/webbatch.exe?techsupt/tsleft.web+Valuable-Third-Party-Tools+IIS-Thread-Monitoring-tool.html" target="_blank">http://www.serverautomationtools.com/webcgi/webbatch.exe?techsupt/tsle...web+Val</a>
And you can try my CPU Checker to keep IIS running while you are
troubleshooting it.
John Cesta
The CPU Checker - Monitors your CPU % while you sleep
LogFileManager - IIS LogFile Management Tool
WebPageChecker - Helps Maintain Server UpTime
DomainReportIt PRO - Helps Rebuild IIS
<a style='text-decoration: underline;' href="http://www.serverautomationtools.com" target="_blank">http://www.serverautomationtools.com</a>
>Hi,
>
>for a couple of days, we have an increasing number of crashes of our IIS.
>I've no clue where to search for reason anymore. We first suspected a
>corrupted metabase, but reinstalling IIS and reconfiguring the about 30
>virtual hosts doesn't help at all. We also checked the hardware, espacially
>the memory, with no result.
>
>Could please anybody help me interpret with the attached IISState-Log?
>
>The Server is Win2k SP4 with ColdFusion MX6.1.
>
>Thanks,
>
>Sebastian
>
>
>
>Opened log file 'C:\IISDebugTools\IISState\output\IISState-1640.log'
>
>***********************
>Starting new log output
>IISState version 3.3.1
>
>Thu Apr 21 09:32:13 2005
>
>OS = Windows 2000
>Executable: inetinfo.exe
>PID = 1640
>
>Note: Thread times are formatted as HH:MM:SS.ms
>
>***********************
>
>
>IIS has crashed...
>Beginning Analysis
>DLL (!FunctionName) that failed: ntdll!DbgBreakPoint
>
>
>
>
>Thread ID: 24
>System Thread ID: 13c
>Kernel Time: 0:0:0.200
>User Time: 0:0:0.160
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 01ecfcac 778b76aa ntdll!DbgBreakPoint
>01 01ecfcb4 778cfb72 ntdll!RtlpBreakPointHeap+0x26
>02 01ecfcd4 778cd020 ntdll!RtlpFindAndCommitPages+0x1f0
>03 01ecfd0c 778ccdc1 ntdll!RtlpExtendHeap+0x9e
>04 01ecfee8 77e7919d ntdll!RtlAllocateHeap+0x3b6
>05 01ecff34 6d5e22aa KERNEL32!LocalAlloc+0x74
>06 01ecff54 6d5e1ae1 ISATQ!I_AtqPrepareAcceptExSockets+0x65
>07 01ecff80 6d5e29a6 ISATQ!AtqpProcessContext+0x17f
>08 01ecffb4 77e7b388 ISATQ!AtqPoolThread+0x1a8
>09 01ecffec 00000000 KERNEL32!BaseThreadStart+0x52
>Closing open log file C:\IISDebugTools\IISState\output\IISState-1640.log
>Opened log file 'C:\IISDebugTools\IISState\output\IISState-1640.log'
>
>***********************
>Starting new log output
>IISState version 3.3.1
>
>Thu Apr 21 09:32:13 2005
>
>OS = Windows 2000
>Executable: inetinfo.exe
>PID = 1640
>
>Note: Thread times are formatted as HH:MM:SS.ms
>
>***********************
>
>
>
>
>Thread ID: 0
>System Thread ID: 630
>Kernel Time: 0:0:0.10
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 0006f89c 77e862e9 ntdll!ZwReadFile+0xb
>01 0006f910 79364cd9 KERNEL32!ReadFile+0x181
>02 0006f93c 79364b5f ADVAPI32!ScGetPipeInput+0x28
>03 0006f9b8 79366632 ADVAPI32!ScDispatcherLoop+0x4a
>04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
>05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
>06 0006ff70 01002fbf inetinfo!main+0x654
>07 0006ffc0 77e9893d inetinfo!mainCRTStartup+0xff
>08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
>
>
>
>
>Thread ID: 1
>System Thread ID: 624
>Kernel Time: 0:0:0.10
>User Time: 0:0:0.50
>Thread Type: Other
> # ChildEBP RetAddr
>00 0059fd1c 77e99fe4 ntdll!ZwWaitForSingleObject+0xb
>01 0059fd44 77e7b3db KERNEL32!WaitForSingleObjectEx+0x71
>02 0059fd54 6e601685 KERNEL32!WaitForSingleObject+0xf
>03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
>04 0059ffa4 79364e9b inetinfo!InetinfoStartService+0x2bd
>05 0059ffb4 77e7b388 ADVAPI32!ScSvcctrlThreadW+0xe
>06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 2
>System Thread ID: 2d0
>Kernel Time: 0:0:0.10
>User Time: 0:0:0.30
>Thread Type: Other
> # ChildEBP RetAddr
>00 006dfe5c 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 006dfeac 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 006dff08 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 006dff24 6e4b5a7c USER32!MsgWaitForMultipleObjects+0x1d
>04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
>05 006dffb4 77e7b388 MSVCRT!_endthreadex+0xc1
>06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 3
>System Thread ID: 454
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.30
>Thread Type: Other
> # ChildEBP RetAddr
>00 0071fe5c 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 0071feac 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 0071ff08 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 0071ff24 6e4b5a7c USER32!MsgWaitForMultipleObjects+0x1d
>04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
>05 0071ffb4 77e7b388 MSVCRT!_endthreadex+0xc1
>06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 4
>System Thread ID: 440
>Kernel Time: 0:0:0.10
>User Time: 0:0:0.20
>Thread Type: Possible ASP page. Possible DCOM activity
>Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>Continuing with other analysis.
>
>No remote call being made
>
> # ChildEBP RetAddr
>00 00b7fe24 77d27ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
>01 00b7ff74 77d27b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
>02 00b7ff78 77d25924 RPCRT4!RecvLotsaCallsWrapper+0x9
>03 00b7ffa8 77d258d6 RPCRT4!BaseCachedThreadRoutine+0x4f
>04 00b7ffb4 77e7b388 RPCRT4!ThreadStartRoutine+0x18
>05 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 5
>System Thread ID: 4b8
>Kernel Time: 0:0:0.60
>User Time: 0:0:0.60
>*** WARNING: Unable to verify checksum for
>C:\CFusionMX\runtime\lib\wsconfig\1\jrun.dll
>*** ERROR: Symbol file could not be found. Defaulted to export symbols for
>C:\CFusionMX\runtime\lib\wsconfig\1\jrun.dll -
>Other information: Thread is waiting for a lock to be released. Looking for
>lock owner.
>Owning thread System ID: 13c
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 0206d7bc 7788822a ntdll!ZwWaitForSingleObject+0xb
>01 0206d830 7788819b ntdll!RtlpWaitForCriticalSection+0x9e
>02 0206d838 778cc21a ntdll!RtlEnterCriticalSection+0x46
>03 0206da10 77e7919d ntdll!RtlAllocateHeap+0x177
>04 0206da5c 65d790dd KERNEL32!LocalAlloc+0x74
>05 0206da6c 65d78eef w3svc!FILTER_POOL_ITEM::CreateMemPoolItem+0x37
>06 0206da78 10001ee3 w3svc!AllocFilterMem+0x19
>WARNING: Stack unwind information not available. Following frames may be
>wrong.
>07 0206fbf4 65d77103 jrun!HttpFilterProc+0xf3
>08 0206fc1c 65d80abe w3svc!FILTER_LIST::NotifyFilters+0x9d
>09 0206fc50 65d7d92a w3svc!HTTP_FILTER::NotifyPreProcHeaderFilters+0x4c
>0a 0206fca8 65d526b0 w3svc!HTTP_REQUEST::Parse+0x380
>0b 0206fcec 65d525a4 w3svc!HTTP_REQ_BASE::OnCompleteRequest+0x36
>0c 0206fd2c 65d52501 w3svc!HTTP_REQ_BASE::UnWrapRequest+0x1f4
>0d 0206fd4c 65d523b8 w3svc!HTTP_REQ_BASE::OnFillClientReq+0x7a
>0e 0206fec4 65d51d97 w3svc!HTTP_REQUEST::DoWork+0x99
>0f 0206fee4 65d56be5 w3svc!CLIENT_CONN::DoWork+0x1aa
>10 0206ff08 65d56b58 w3svc!CreateClient+0x7b
>11 0206ff4c 6d5e1ad2 w3svc!W3OnConnectEx+0x118
>12 0206ff80 6d5e29a6 ISATQ!AtqpProcessContext+0x23e
>13 0206ffb4 77e7b388 ISATQ!AtqPoolThread+0x1a8
>14 0206ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 6
>System Thread ID: 3f8
>Kernel Time: 0:0:0.160
>User Time: 0:0:0.120
>Thread Type: Other
> # ChildEBP RetAddr
>00 00e0fc1c 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 00e0fc6c 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 00e0fcc8 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 00e0fce4 76b771e0 USER32!MsgWaitForMultipleObjects+0x1d
>04 00e0fd30 65d5cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
>05 00e0fd70 01002440 w3svc!ServiceEntry+0x1b5
>06 00e0ffa4 79364e9b inetinfo!InetinfoStartService+0x2bd
>07 00e0ffb4 77e7b388 ADVAPI32!ScSvcctrlThreadW+0xe
>08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 7
>System Thread ID: 3ec
>Kernel Time: 0:0:0.20
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 00e4fc1c 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 00e4fc6c 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 00e4fcc8 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 00e4fce4 76b771e0 USER32!MsgWaitForMultipleObjects+0x1d
>04 00e4fd30 6fbab2f0 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
>05 00e4fd70 01002440 ftpsvc2!ServiceEntry+0xc7
>06 00e4ffa4 79364e9b inetinfo!InetinfoStartService+0x2bd
>07 00e4ffb4 77e7b388 ADVAPI32!ScSvcctrlThreadW+0xe
>08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 8
>System Thread ID: 3c8
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 00f0ff5c 77e853d7 ntdll!ZwRemoveIoCompletion+0xb
>01 00f0ff88 6d5e29ef KERNEL32!GetQueuedCompletionStatus+0x27
>02 00f0ffb4 77e7b388 ISATQ!I_AtqOplockThreadFunc+0x32
>03 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 9
>System Thread ID: 3e8
>Kernel Time: 0:0:0.370
>User Time: 0:0:0.390
>*** WARNING: Unable to verify checksum for
>C:\CFusionMX\runtime\lib\wsconfig\3\jrun.dll
>*** ERROR: Symbol file could not be found. Defaulted to export symbols for
>C:\CFusionMX\runtime\lib\wsconfig\3\jrun.dll -
>Thread Type: Other
> # ChildEBP RetAddr
>00 00f4f09c 74f41275 ntdll!ZwWaitForSingleObject+0xb
>01 00f4f0d8 74f4160d msafd!SockWaitForSingleObject+0x38
>02 00f4f154 74fa13fa msafd!WSPRecv+0x1e9
>03 00f4f190 74fc10a4 WS2_32!WSARecv+0x8a
>04 00f4f1bc 015b95eb WSOCK32!recv+0x31
>WARNING: Stack unwind information not available. Following frames may be
>wrong.
>05 00f4f258 00000000 jrun_15b0000!HttpFilterProc+0x77fb
>
>
>
>
>Thread ID: 10
>System Thread ID: 3dc
>Kernel Time: 0:0:0.460
>User Time: 0:0:0.270
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 00f8ff50 77e853d7 ntdll!ZwRemoveIoCompletion+0xb
>01 00f8ff7c 6d5e2957 KERNEL32!GetQueuedCompletionStatus+0x27
>02 00f8ffb4 77e7b388 ISATQ!AtqPoolThread+0x40
>03 00f8ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 11
>System Thread ID: 388
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Possible ASP page. Possible DCOM activity
>Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>Continuing with other analysis.
>
>No remote call being made
>
> # ChildEBP RetAddr
>00 0120fe24 77d27ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
>01 0120ff74 77d27b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
>02 0120ff78 77d25924 RPCRT4!RecvLotsaCallsWrapper+0x9
>03 0120ffa8 77d258d6 RPCRT4!BaseCachedThreadRoutine+0x4f
>04 0120ffb4 77e7b388 RPCRT4!ThreadStartRoutine+0x18
>05 0120ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 12
>System Thread ID: 3f0
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 0124fd20 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 0124fd70 77e9a0c2 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 0124fd88 778222b2 KERNEL32!WaitForMultipleObjects+0x17
>03 0124ffb4 77e7b388 RTUTILS!TraceServerThread+0xde
>04 0124ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 13
>System Thread ID: 2d4
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Possible ASP page. Possible DCOM activity
>Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>Continuing with other analysis.
>
>No remote call being made
>
> # ChildEBP RetAddr
>00 0139feb8 77e853d7 ntdll!ZwRemoveIoCompletion+0xb
>01 0139fee4 77d21394 KERNEL32!GetQueuedCompletionStatus+0x27
>02 0139ff20 77d2e93f RPCRT4!COMMON_ProcessCalls+0x9e
>03 0139ff74 77d2e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
>04 0139ff78 77d25924 RPCRT4!ProcessIOEventsWrapper+0x9
>05 0139ffa8 77d258d6 RPCRT4!BaseCachedThreadRoutine+0x4f
>06 0139ffb4 77e7b388 RPCRT4!ThreadStartRoutine+0x18
>07 0139ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 14
>System Thread ID: 740
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 013dff00 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 013dff50 74fa7871 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 013dff6c 6fba6e80 WS2_32!WSAWaitForMultipleEvents+0x18
>03 013dffb4 77e7b388 ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x39
>04 013dffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 15
>System Thread ID: 678
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
>00 0142ff5c 77e99fe4 ntdll!ZwWaitForSingleObject+0xb
>01 0142ff84 77e7b3db KERNEL32!WaitForSingleObjectEx+0x71
>02 0142ff94 73233366 KERNEL32!WaitForSingleObject+0xf
>03 0142ffb4 77e7b388 compfilt!CompressionThread+0x29
>04 0142ffc0 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 16
>System Thread ID: 424
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 0149fce0 74f41394 ntdll!ZwWaitForSingleObject+0xb
>01 0149fd1c 74f43c59 msafd!SockWaitForSingleObject+0x1a8
>02 0149fe08 74fa12f5 msafd!WSPSelect+0x24e
>03 0149fe6c 6e1c3b6e WS2_32!select+0xe7
>04 0149ffb4 77e7b388 inetsloc!SocketListenThread+0x51
>05 0149ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 17
>System Thread ID: 420
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 014dfdfc 74f41394 ntdll!ZwWaitForSingleObject+0xb
>01 014dfe38 74f43c59 msafd!SockWaitForSingleObject+0x1a8
>02 014dff24 74fa12f5 msafd!WSPSelect+0x24e
>03 014dff88 6d5e75bd WS2_32!select+0xe7
>04 014dffb0 6d5e791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
>05 014dffb4 77e7b388 ISATQ!BmonThreadFunc+0x9
>06 014dffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 18
>System Thread ID: 4c8
>Kernel Time: 0:0:0.20
>User Time: 0:0:0.10
>Thread Type: Other
> # ChildEBP RetAddr
>00 0151fe70 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 0151fec0 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 0151ff1c 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 0151ff38 65d59ccb USER32!MsgWaitForMultipleObjects+0x1d
>04 0151ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
>05 0151ffb4 77e7b388 MSVCRT!_endthread+0xc6
>06 0151ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 19
>System Thread ID: 1ec
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Other
> # ChildEBP RetAddr
>00 0155fea8 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 0155fef8 77e0e9a5 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 0155ff54 77e0e9f2 USER32!MsgWaitForMultipleObjectsEx+0x153
>03 0155ff70 65d59d47 USER32!MsgWaitForMultipleObjects+0x1d
>04 0155ffb4 77e7b388 w3svc!OleHackThread+0x88
>05 0155ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 20
>System Thread ID: 450
>Kernel Time: 0:0:0.440
>User Time: 0:0:0.240
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 01acff50 77e853d7 ntdll!ZwRemoveIoCompletion+0xb
>01 01acff7c 6d5e2957 KERNEL32!GetQueuedCompletionStatus+0x27
>02 01acffb4 77e7b388 ISATQ!AtqPoolThread+0x40
>03 01acffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 21
>System Thread ID: 3a4
>Kernel Time: 0:0:0.300
>User Time: 0:0:0.230
>Thread Type: Other
> # ChildEBP RetAddr
>00 01b0f0f0 74f41275 ntdll!ZwWaitForSingleObject+0xb
>01 01b0f12c 74f4160d msafd!SockWaitForSingleObject+0x38
>02 01b0f1a8 74fa13fa msafd!WSPRecv+0x1e9
>03 01b0f1e4 74fc10a4 WS2_32!WSARecv+0x8a
>04 01b0f210 015b95eb WSOCK32!recv+0x31
>WARNING: Stack unwind information not available. Following frames may be
>wrong.
>05 01b0f2ac 00000000 jrun_15b0000!HttpFilterProc+0x77fb
>
>
>
>
>Thread ID: 22
>System Thread ID: 2ac
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Idle ASP thread
> # ChildEBP RetAddr
>00 01b4ff08 77e9a1af ntdll!ZwWaitForMultipleObjects+0xb
>01 01b4ff58 77e9a0c2 KERNEL32!WaitForMultipleObjectsEx+0xea
>02 01b4ff70 730258ce KERNEL32!WaitForMultipleObjects+0x17
>03 01b4ffb4 77e7b388 COMSVCS!CEventDispatcher::PushEvents+0x4e
>04 01b4ffc0 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 23
>System Thread ID: 17c
>Kernel Time: 0:0:0.0
>User Time: 0:0:0.0
>Thread Type: Possible ASP page. Possible DCOM activity
>Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>Continuing with other analysis.
>
>Remote call is either to a MTA object or object not initialized. Also,
>possible utility thread.
>DCOM call being made to Process ID: 1188
>Waiting on thread id: ffffffff
>
> # ChildEBP RetAddr
>00 01b8fb68 77d3256d ntdll!ZwRequestWaitReplyPort+0xb
>01 01b8fb94 77d2ac56 RPCRT4!LRPC_CCALL::SendReceive+0x11e
>02 01b8fba0 77b16c07 RPCRT4!I_RpcSendReceive+0x2c
>03 01b8fbc0 77b16ad2 ole32!ThreadSendReceive+0xef
>04 01b8fbd8 77b13ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14f
>05 01b8fc18 77b16946 ole32!CRpcChannelBuffer::SendReceive2+0x96
>06 01b8fc28 77a5cc2a ole32!CRpcChannelBuffer::SendReceive+0x11
>07 01b8fc88 77aa7e2f ole32!CAptRpcChnl::SendReceive+0xa9
>08 01b8fce0 77d84c1a ole32!CCtxComChnl::SendReceive+0x124
>09 01b8fcfc 77d8487d RPCRT4!NdrProxySendReceive+0x4c
>0a 01b8ff44 77d85136 RPCRT4!NdrClientCall2+0x4f5
>0b 01b8ff60 77d36e75 RPCRT4!ObjectStublessClient+0x76
>0c 01b8ff70 73025818 RPCRT4!ObjectStubless+0xf
>0d 01b8ffb4 77e7b388 COMSVCS!CEventDispatcher::GetEventServerInfoThread+0x118
>0e 01b8ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 24
>System Thread ID: 13c
>Kernel Time: 0:0:0.200
>User Time: 0:0:0.160
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 01ecfcac 778b76aa ntdll!DbgBreakPoint
>01 01ecfcb4 778cfb72 ntdll!RtlpBreakPointHeap+0x26
>02 01ecfcd4 778cd020 ntdll!RtlpFindAndCommitPages+0x1f0
>03 01ecfd0c 778ccdc1 ntdll!RtlpExtendHeap+0x9e
>04 01ecfee8 77e7919d ntdll!RtlAllocateHeap+0x3b6
>05 01ecff34 6d5e22aa KERNEL32!LocalAlloc+0x74
>06 01ecff54 6d5e1ae1 ISATQ!I_AtqPrepareAcceptExSockets+0x65
>07 01ecff80 6d5e29a6 ISATQ!AtqpProcessContext+0x17f
>08 01ecffb4 77e7b388 ISATQ!AtqPoolThread+0x1a8
>09 01ecffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
>Thread ID: 25
>System Thread ID: 428
>Kernel Time: 0:0:0.130
>User Time: 0:0:0.130
>Thread Type: HTTP Listener
> # ChildEBP RetAddr
>00 01f0ff50 77e853d7 ntdll!ZwRemoveIoCompletion+0xb
>01 01f0ff7c 6d5e2957 KERNEL32!GetQueuedCompletionStatus+0x27
>02 01f0ffb4 77e7b388 ISATQ!AtqPoolThread+0x40
FAQ
Profile
Private Messages
Log in
