This is a crash caused by memry corruption. The most likely suspect is
zip_isapi.dll, but it is by no means a sure thing. That's the tricky bit
about memory corruption - sometimes the culprit is long gone before a crash
occurs.
Pat
<bbbach RemoveThis @squeeek.com> wrote in message
news:1143433086.288010.284480@i40g2000cwc.googlegroups.com...
> Hello all:
>
> Am I correct in reading that this crash was caused by the zip_isapi.dll
> file?? Has anyone else seen this type of error?? This is on a Windows
> 2000 machine with IIS5 running. IIS will crash with a popup about
> memory not being able to be read.
>
> If you have any hints or tips I would be extremely gratefull!!
> Many thanks,
> Brent Bain
>
> IISState Log:
> Opened log file 'C:\iisstate\output\IISState-1968.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Sun Mar 26 19:15:36 2006
>
> OS = Windows 2000
> Executable: inetinfo.exe
> PID = 1968
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> DLL (!FunctionName) that failed: ntdll!DbgBreakPoint
>
>
>
>
> Thread ID: 44
> System Thread ID: e44
> Kernel Time: 0:0:3.593
> User Time: 0:0:9.468
> *** WARNING: Unable to verify checksum for
> C:\WINNT\system32\inetsrv\zip_isapi.dll
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINNT\system32\inetsrv\zip_isapi.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> 00 05d8f3c8 77fb2a30 ntdll!DbgBreakPoint
> 01 05d8f3d0 77fcd526 ntdll!RtlpBreakPointHeap+0x26
> 02 05d8f3f0 77fca7d8 ntdll!RtlpFindAndCommitPages+0x1f0
> 03 05d8f428 77fcb0a0 ntdll!RtlpExtendHeap+0x9e
> 04 05d8f604 7c57919d ntdll!RtlAllocateHeap+0x3b6
> 05 05d8f650 65f290dd KERNEL32!LocalAlloc+0x74
> 06 05d8f660 65f28eef w3svc!FILTER_POOL_ITEM::CreateMemPoolItem+0x37
> 07 05d8f66c 10018f77 w3svc!AllocFilterMem+0x19
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 08 05d8f688 100207c7 zip_isapi!TerminateFilter+0x2517
> 09 001186dc 00000000 zip_isapi!TerminateFilter+0x9d67
> Closing open log file C:\iisstate\output\IISState-1968.log
> Opened log file 'C:\iisstate\output\IISState-1968.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Sun Mar 26 19:15:38 2006
>
> OS = Windows 2000
> Executable: inetinfo.exe
> PID = 1968
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: 7ac
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0006f89c 7c586335 ntdll!ZwReadFile+0xb
> 01 0006f910 7c2dd578 KERNEL32!ReadFile+0x181
> 02 0006f93c 7c2dd61e ADVAPI32!ObjectCloseAuditAlarmA+0x2f
> 03 0006f9b8 7c2d1e18 ADVAPI32!ObjectDeleteAuditAlarmW+0x4
> 04 0006fbf4 01002884 ADVAPI32!`string'
> 05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
> 06 0006ff70 01002fbf inetinfo!main+0x654
> 07 0006ffc0 7c598989 inetinfo!mainCRTStartup+0xff
> 08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
>
>
>
>
> Thread ID: 1
> System Thread ID: 7b4
> Kernel Time: 0:0:0.296
> User Time: 0:0:0.15
> Thread Type: Other
> # ChildEBP RetAddr
> 00 005dfd1c 7c59a030 ntdll!ZwWaitForSingleObject+0xb
> 01 005dfd44 7c57b3db KERNEL32!WaitForSingleObjectEx+0x71
> 02 005dfd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
> 03 005dfd70 01002440 iisadmin!ServiceEntry+0x156
> 04 005dffa4 7c2dcf43 inetinfo!InetinfoStartService+0x2bd
> 05 005dffec 00000000
> ADVAPI32!AccessCheckByTypeResultListAndAuditAlarmByHandleW+0x2f
>
>
>
>
> Thread ID: 2
> System Thread ID: 7e4
> Kernel Time: 0:2:55.656
> User Time: 0:1:5.125
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0071fe5c 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 0071feac 77e4169f KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 0071ff08 77e41706 USER32!__ClientExtTextOutW+0x3f
> 03 0071ff24 6e5a5a7c USER32!__ClientGetTextExtentPointW+0x48
> 04 0071ff78 78008593 IisRTL!SchedulerWorkerThread+0xa7
> 05 0071ffb4 7c57b388 MSVCRT!_endthreadex+0x98
> 06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 3
> System Thread ID: 7e8
> Kernel Time: 0:2:46.171
> User Time: 0:1:9.15
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0075fe5c 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 0075feac 77e4169f KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 0075ff08 77e41706 USER32!__ClientExtTextOutW+0x3f
> 03 0075ff24 6e5a5a7c USER32!__ClientGetTextExtentPointW+0x48
> 04 0075ff78 78008593 IisRTL!SchedulerWorkerThread+0xa7
> 05 0075ffb4 7c57b388 MSVCRT!_endthreadex+0x98
> 06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 4
> System Thread ID: 7ec
> Kernel Time: 0:0:9.468
> User Time: 0:0:19.968
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 00baff74 77d4e078 ntdll!ZwDelayExecution+0xb
> 01 00baffa8 77d4af16 RPCRT4!BaseCachedThreadRoutine+0xc3
> 02 00baffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18
> 03 00baffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 5
> System Thread ID: d3c
> Kernel Time: 0:0:4.328
> User Time: 0:0:13.62
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0571fe24 77d5e6c4 ntdll!ZwReplyWaitReceivePortEx+0xb
> 01 0571ff74 77d4e0c0 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
> 02 0571ff78 77d4e09c RPCRT4!RecvLotsaCallsWrapper+0x9
> 03 0571ffa8 77d4af16 RPCRT4!BaseCachedThreadRoutine+0x11f
> 04 0571ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18
> 05 0571ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 6
> System Thread ID: 87c
> Kernel Time: 0:0:0.375
> User Time: 0:0:0.203
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00e3fc1c 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 00e3fc6c 77e4169f KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 00e3fcc8 77e41706 USER32!__ClientExtTextOutW+0x3f
> 03 00e3fce4 769c71e0 USER32!__ClientGetTextExtentPointW+0x48
> 04 00e3fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
> 05 00e3fd70 01002440 w3svc!ServiceEntry+0x1b5
> 06 00e3ffa4 7c2dcf43 inetinfo!InetinfoStartService+0x2bd
> 07 00e3ffec 00000000
> ADVAPI32!AccessCheckByTypeResultListAndAuditAlarmByHandleW+0x2f
>
>
>
>
> Thread ID: 7
> System Thread ID: 8a0
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00f7ff5c 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 00f7ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
> 02 00f7ffb4 7c57b388 ISATQ!I_AtqOplockThreadFunc+0x32
> 03 00f7ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 8
> System Thread ID: 8a4
> Kernel Time: 0:0:51.187
> User Time: 0:0:51.468
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00fbff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 00fbff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 00fbffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 00fbffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 9
> System Thread ID: 8a8
> Kernel Time: 0:0:50.62
> User Time: 0:0:48.796
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00ffff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 00ffff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 00ffffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 00ffffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 10
> System Thread ID: 8b0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0118feb8 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 0118fee4 77d4fa03 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 0118ff20 77d4f964 RPCRT4!COMMON_ProcessCalls+0x9e
> 03 0118ff74 77d43dd7 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
> 04 0118ff78 77d4e003 RPCRT4!ProcessIOEventsWrapper+0x9
> 05 0118ffa8 77d4af16 RPCRT4!BaseCachedThreadRoutine+0x4f
> 06 0118ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18
> 07 0118ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 11
> System Thread ID: 8c4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0138fe24 77d5e6c4 ntdll!ZwReplyWaitReceivePortEx+0xb
> 01 0138ff74 77d4e0c0 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
> 02 0138ff78 77d4e09c RPCRT4!RecvLotsaCallsWrapper+0x9
> 03 0138ffa8 77d4af16 RPCRT4!BaseCachedThreadRoutine+0x11f
> 04 0138ffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18
> 05 0138ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 12
> System Thread ID: 8c8
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0141fd20 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 0141fd70 7c59a10e KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 0141fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
> 03 0141ffb4 7c57b388 RTUTILS!TraceServerThread+0xde
> 04 0141ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 13
> System Thread ID: 8cc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 016dfcec 7c59a030 ntdll!ZwWaitForSingleObject+0xb
> 01 016dfd14 7c57b3db KERNEL32!WaitForSingleObjectEx+0x71
> 02 016dfd24 1001408b KERNEL32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 03 016dfdd8 77fb2c8a zip_isapi+0x1408b
> 04 000e2a40 00c4cc98 ntdll!RtlpFreeToHeapLookaside+0x4a
> 05 000e2a40 00c4cc98 0xc4cc98
> 06 7ce23718 7ced372e 0xc4cc98
>
>
>
>
> Thread ID: 14
> System Thread ID: 8d4
> Kernel Time: 0:0:0.46
> User Time: 0:0:0.31
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0181fe70 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 0181fec0 77e4169f KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 0181ff1c 77e41706 USER32!__ClientExtTextOutW+0x3f
> 03 0181ff38 65f09ccb USER32!__ClientGetTextExtentPointW+0x48
> 04 0181ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
> 05 0181ffb4 7c57b388 MSVCRT!_endthread+0xc6
> 06 0181ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 15
> System Thread ID: 8d8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0185fea8 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 0185fef8 77e4169f KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 0185ff54 77e41706 USER32!__ClientExtTextOutW+0x3f
> 03 0185ff70 65f09d47 USER32!__ClientGetTextExtentPointW+0x48
> 04 0185ffb4 7c57b388 w3svc!OleHackThread+0x88
> 05 0185ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 16
> System Thread ID: 944
> Kernel Time: 0:0:11.875
> User Time: 0:0:31.796
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 018dfe24 77d5e6c4 ntdll!ZwReplyWaitReceivePortEx+0xb
> 01 018dff74 77d4e0c0 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
> 02 018dff78 77d4e09c RPCRT4!RecvLotsaCallsWrapper+0x9
> 03 018dffa8 77d4af16 RPCRT4!BaseCachedThreadRoutine+0x11f
> 04 018dffb4 7c57b388 RPCRT4!ThreadStartRoutine+0x18
> 05 018dffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 17
> System Thread ID: 968
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0191fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb
> 01 0191fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
> 02 0191fe08 750312f5 msafd!WSPSelect+0x24e
> 03 0191fe6c 6e2b3b6e WS2_32!select+0xe7
> 04 0191ffb4 7c57b388 inetsloc!SocketListenThread+0x51
> 05 0191ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 18
> System Thread ID: 96c
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 0195fdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb
> 01 0195fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
> 02 0195ff24 750312f5 msafd!WSPSelect+0x24e
> 03 0195ff88 6d7075bd WS2_32!select+0xe7
> 04 0195ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
> 05 0195ffb4 7c57b388 ISATQ!BmonThreadFunc+0x9
> 06 0195ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 19
> System Thread ID: 190
> Kernel Time: 0:0:45.468
> User Time: 0:0:41.734
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 019bff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 019bff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 019bffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 019bffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 20
> System Thread ID: 190
> Kernel Time: 0:0:45.468
> User Time: 0:0:41.734
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 019bff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 019bff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 019bffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 019bffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 21
> System Thread ID: af8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 02b9ff40 7c59a28f ntdll!ZwDelayExecution+0xb
> 01 02b9ff60 7c59a25a KERNEL32!SleepEx+0x32
> 02 02b9ff6c 6a2a3c56 KERNEL32!Sleep+0xb
> 03 02b9ffb4 7c57b388 webengine+0x3c56
> 04 02b9ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 22
> System Thread ID: af4
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.46
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 01cfff08 7c59a1fb ntdll!ZwWaitForMultipleObjects+0xb
> 01 01cfff58 7c59a10e KERNEL32!WaitForMultipleObjectsEx+0xea
> 02 01cfff70 787f67ee KERNEL32!WaitForMultipleObjects+0x17
> 03 01cfffb4 7c57b388 comsvcs!CEventDispatcher::PushEvents+0x4e
> 04 01cfffc0 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 23
> System Thread ID: 8f0
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> Remote call is either to a MTA object or object not initialized. Also,
> possible utility thread.
> DCOM call being made to Process ID: 2392
> Waiting on thread id: ffffffff
>
> # ChildEBP RetAddr
> 00 01d3fb68 77d5f2a1 ntdll!NtRequestWaitReplyPort+0xb
> 01 01d3fb94 77d5d675 RPCRT4!LRPC_CCALL::SendReceive+0x11e
> 02 01d3fba0 7cef6bee RPCRT4!I_RpcSendReceive+0x2c
> 03 01d3fbc0 7cef6ab9 ole32!ThreadSendReceive+0xef
> 04 01d3fbd8 7cef3ab6
> ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14f
> 05 01d3fc18 7cef692d ole32!CRpcChannelBuffer::SendReceive2+0x96
> 06 01d3fc28 7ce3cc2d ole32!CRpcChannelBuffer::SendReceive+0x11
> 07 01d3fc88 7ce87f7f ole32!CAptRpcChnl::SendReceive+0xa9
> 08 01d3fce0 77d9a063 ole32!CCtxComChnl::SendReceive+0x124
> 09 01d3fcfc 77d9a011 RPCRT4!NdrProxySendReceive+0x4c
> 0a 01d3ff44 77d99db8 RPCRT4!NdrClientCall2+0x4f5
> 0b 01d3ff60 77d4183f RPCRT4!ObjectStublessClient+0x76
> 0c 01d3ff70 787f6732 RPCRT4!ObjectStubless+0xf
> 0d 01d3ffb4 7c57b388
> comsvcs!CEventDispatcher::GetEventServerInfoThread+0x152
> 0e 01d3ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 24
> System Thread ID: 9f4
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.15
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 01f7ff38 7c59a28f ntdll!ZwDelayExecution+0xb
> 01 01f7ff58 7c59a25a KERNEL32!SleepEx+0x32
> 02 01f7ff64 79e8de84 KERNEL32!Sleep+0xb
> 03 01f7ffb4 7c57b388 aspnet_isapi!ThreadGateThreadProc+0x6a
> 04 01f7ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 25
> System Thread ID: a00
> Kernel Time: 0:0:0.734
> User Time: 0:0:0.812
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 01fbff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 01fbff7c 79e8dda8 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 01fbffb4 7c57b388 aspnet_isapi!ThreadPoolThreadProc+0x6e
> 03 01fbffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 26
> System Thread ID: b58
> Kernel Time: 0:0:2.500
> User Time: 0:0:0.281
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 01ffff44 7c59a28f ntdll!ZwDelayExecution+0xb
> 01 01ffff64 7c59a25a KERNEL32!SleepEx+0x32
> 02 01ffff70 79e7ec63 KERNEL32!Sleep+0xb
> 03 01ffff80 01d8940f aspnet_isapi!MonitorHealth+0x40
> 04 01ffffb4 7c57b388 MSVCR71!_endthread+0xaa
> 05 01ffffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 27
> System Thread ID: b64
> Kernel Time: 0:0:0.640
> User Time: 0:0:1.109
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0203ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 0203ff7c 79e8dda8 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 0203ffb4 7c57b388 aspnet_isapi!ThreadPoolThreadProc+0x6e
> 03 0203ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 28
> System Thread ID: 9f8
> Kernel Time: 0:0:0.500
> User Time: 0:0:0.453
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0269ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 0269ff7c 79e8dda8 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 0269ffb4 7c57b388 aspnet_isapi!ThreadPoolThreadProc+0x6e
> 03 0269ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 29
> System Thread ID: 2dc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 02bdff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 02bdff7c 6a2a3fbb KERNEL32!GetQueuedCompletionStatus+0x27
> 02 02bdffb4 7c57b388 webengine+0x3fbb
> 03 02bdffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 30
> System Thread ID: 748
> Kernel Time: 0:0:2.500
> User Time: 0:0:0.265
> Thread Type: Other
> # ChildEBP RetAddr
> 00 02c1ff40 7c59a28f ntdll!ZwDelayExecution+0xb
> 01 02c1ff60 7c59a25a KERNEL32!SleepEx+0x32
> 02 02c1ff6c 6a2a134b KERNEL32!Sleep+0xb
> 03 02c1ff78 016f2837 webengine+0x134b
> 04 02c1ffb0 016f28b7 MSVCR80!_callthreadstart+0x1b
> 05 02c1ffb4 7c57b388 MSVCR80!_threadstart+0x5a
> 06 02c1ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 31
> System Thread ID: bd8
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.78
> Thread Type: Other
> # ChildEBP RetAddr
> 00 02c5ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 02c5ff7c 6a2a3fbb KERNEL32!GetQueuedCompletionStatus+0x27
> 02 02c5ffb4 7c57b388 webengine+0x3fbb
> 03 02c5ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 32
> System Thread ID: 518
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.93
> Thread Type: Other
> # ChildEBP RetAddr
> 00 04daff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 04daff7c 6a2a3fbb KERNEL32!GetQueuedCompletionStatus+0x27
> 02 04daffb4 7c57b388 webengine+0x3fbb
> 03 04daffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 33
> System Thread ID: cb0
> Kernel Time: 0:0:11.671
> User Time: 0:0:12.296
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 0589ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 0589ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 0589ffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 0589ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 34
> System Thread ID: d24
> Kernel Time: 0:0:3.343
> User Time: 0:0:4.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 059aff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 059aff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 059affb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 059affec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 35
> System Thread ID: d24
> Kernel Time: 0:0:3.343
> User Time: 0:0:4.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 059aff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 059aff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 059affb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 059affec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 36
> System Thread ID: 9a0
> Kernel Time: 0:0:3.484
> User Time: 0:0:4.468
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 05a2ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 05a2ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 05a2ffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 05a2ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 37
> System Thread ID: d68
> Kernel Time: 0:0:9.203
> User Time: 0:0:10.515
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 05a6ff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 05a6ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 05a6ffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 05a6ffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 38
> System Thread ID: cf4
> Kernel Time: 0:0:7.843
> User Time: 0:0:8.296
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 05aaff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 05aaff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 05aaffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 05aaffec 00000000 KERNEL32!BaseThreadStart+0x52
>
>
>
>
> Thread ID: 39
> System Thread ID: cf4
> Kernel Time: 0:0:7.843
> User Time: 0:0:8.296
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 05aaff50 7c585423 ntdll!NtRemoveIoCompletion+0xb
> 01 05aaff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
> 02 05aaffb4 7c57b388 ISATQ!AtqPoolThread+0x40
> 03 05aaffec 00000000 KERNEL32!BaseThreadStart+0x52
>
> *****
>
> Dump name is formatted as: PID-Timestamp.dmp
>
> Creating C:\iisstate\output\1968-1143429453.dmp - mini user dump
>
> *****
>
> Closing open log file C:\iisstate\output\IISState-1968.log
>
FAQ
Profile
Private Messages
Log in
