IIS is hanging

I have an intermittent problem where our IIS servers "hang". System
resources (CPU, RAM, disk space, etc.) all check out fine. Initially I
thought it was a problem with our load balancer, but when I requested
a page through the second NIC while it was hung I got the same
response (none).

Here's the IISState log output. Any help on this would be more than
welcome.

***********************
Starting new log output
IISState version 3.3.1

Mon Sep 20 13:57:23 2004

OS = Windows 2000
Executable: inetinfo.exe
PID = 1148

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 478
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 494
Kernel Time: 0:0:0.46
User Time: 0:0:0.62
Thread Type: Other
# ChildEBP RetAddr
00 005dfd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 005dfd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 005dfd54 6e6f1fe8 KERNEL32!WaitForSingleObject+0xf
03 005dfd70 01002440 iisadmin!ServiceEntry+0x156
04 005dffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
05 005dffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
06 005dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 4a8
Kernel Time: 0:2:23.656
User Time: 0:0:55.437
Thread Type: Other
# ChildEBP RetAddr
00 0071fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feb0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff0c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57438b MSVCRT!_beginthreadex+0xca
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 4ac
Kernel Time: 0:2:9.281
User Time: 0:1:1.734
Thread Type: Other
# ChildEBP RetAddr
00 0075fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0075feb0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0075ff0c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0075ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
04 0075ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
05 0075ffb4 7c57438b MSVCRT!_beginthreadex+0xca
06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 4c8
Kernel Time: 0:0:0.125
User Time: 0:0:0.62
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 00e4fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e4fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e4fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e4fce4 769c4f9f USER32!MsgWaitForMultipleObjects+0x1d
04 00e4fd30 6b561462 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e4fd70 01002440 SMTPSVC!ServiceEntry+0x136
06 00e4ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e4ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 4cc
Kernel Time: 0:0:0.46
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 00e8fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e8fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e8fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e8fce4 769c4f9f USER32!MsgWaitForMultipleObjects+0x1d
04 00e8fd30 65f2d8b6 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e8fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e8ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e8ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 504
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0104ff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0104ff88 6d70b2fa KERNEL32!GetQueuedCompletionStatus+0x27
02 0104ffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 508
Kernel Time: 0:0:4.156
User Time: 0:0:3.78
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0108ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0108ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27
02 0108ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 50c
Kernel Time: 0:0:4.546
User Time: 0:0:3.218
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 010cff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 010cff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27
02 010cffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 010cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 518
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0148fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0148fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0148fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0148ffb4 7c57438b RTUTILS!TraceServerThread+0xde
04 0148ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 51c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 014dfeb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 014dfee4 77d80976 KERNEL32!GetQueuedCompletionStatus+0x27
02 014dff20 77d50e9e RPCRT4!COMMON_ProcessCalls+0x9e
03 014dff74 77d50cd7 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 014dff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
05 014dffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x4f
06 014dffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 014dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 520
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0151ff20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0151ff70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0151ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17
03 0151ffb4 7c57438b exstrace!RegNotifyThread+0x6f
04 0151ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 524
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0155ff24 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0155ff74 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0155ff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17
03 0155ffb4 7c57438b exstrace!WriteTraceThread+0x2f
04 0155ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 528
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 016dff64 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 016dff8c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 016dff9c 6ff283ee KERNEL32!WaitForSingleObject+0xf
03 016dffb4 7c57438b FCACHDLL!CScheduleThread::ScheduleThread+0x22
04 016dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 52c
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0181ff18 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0181ff68 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0181ff80 6b579fbd KERNEL32!WaitForMultipleObjects+0x17
03 0181ffb4 7c57438b SMTPSVC!TcpRegNotifyThread+0x136
04 0181ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 15
System Thread ID: 530
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0185ff68 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0185ff90 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0185ffa0 6b579df1 KERNEL32!WaitForSingleObject+0xf
03 0185ffb4 7c57438b SMTPSVC!FreeLibThread+0x1d
04 0185ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 534
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0196ff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0196ff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0196ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0196ffb4 7c57438b compfilt!CompressionThread+0x29
04 0196ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 17
System Thread ID: 538
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 019dfe74 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 019dfec4 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 019dff20 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 019dff3c 65f38a88 USER32!MsgWaitForMultipleObjects+0x1d
04 019dff80 7800c9eb w3svc!CMTACallbackThread::Thread+0x42
05 019dffb4 7c57438b MSVCRT!_beginthread+0xce
06 019dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 18
System Thread ID: 53c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01a1fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01a1fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01a1ff54 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 01a1ff70 65f2e673 USER32!MsgWaitForMultipleObjects+0x1d
04 01a1ffb4 7c57438b w3svc!OleHackThread+0x88
05 01a1ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: 58c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 01a9fe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
01 01a9ff74 77d56d5e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 01a9ff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
03 01a9ffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
04 01a9ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 01a9ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 5a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01adfce0 74fdbcd2 ntdll!ZwWaitForSingleObject+0xb
01 01adfd1c 74fd7ee6 msafd!SockWaitForSingleObject+0x1a8
02 01adfe08 75031da9 msafd!WSPSelect+0x24e
03 01adfe6c 6e2b3b6e WS2_32!select+0xe7
04 01adffb4 7c57438b inetsloc!SocketListenThread+0x51
05 01adffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 5a8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 01b1fdfc 74fdbcd2 ntdll!ZwWaitForSingleObject+0xb
01 01b1fe38 74fd7ee6 msafd!SockWaitForSingleObject+0x1a8
02 01b1ff24 75031da9 msafd!WSPSelect+0x24e
03 01b1ff88 6d7062b4 WS2_32!select+0xe7
04 01b1ffb0 6d706605 ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 01b1ffb4 7c57438b ISATQ!BmonThreadFunc+0x9
06 01b1ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 5ac
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01b6ff54 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 01b6ff7c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 01b6ff8c 741a962d KERNEL32!WaitForSingleObject+0xf
03 01b6ffb4 7c57438b
aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce
04 01b6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 5b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 01bafed0 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01baff20 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 01baff38 74190002 KERNEL32!WaitForMultipleObjects+0x17
03 01baff9c 6b56ce35 aqueue!CConnMgr::GetNextConnection+0x1da
04 01baffb4 7c57438b SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x23
05 01baffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 24
System Thread ID: 620
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01efebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 01efffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 01efffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 25
System Thread ID: 150
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01f3ff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01f3ff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 01f3ff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 01f3ffb4 7c57438b USERENV!NotificationThread+0x5f
04 01f3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 26
System Thread ID: 60c
Kernel Time: 0:0:2.812
User Time: 0:0:2.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 022dff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 022dff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27
02 022dffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 022dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 27
System Thread ID: 238
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0238ff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 0238ffb4 7c57438b ntdll!RtlpTimerThread+0x42
02 0238ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 28
System Thread ID: 6e4
Kernel Time: 0:0:1.578
User Time: 0:0:1.187
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02b6ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02b6ff7c 6d7088db KERNEL32!GetQueuedCompletionStatus+0x27
02 02b6ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 02b6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 29
System Thread ID: 164
Kernel Time: 0:0:0.281
User Time: 0:0:0.796
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 02bbfe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
01 02bbff74 77d56d5e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 02bbff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
03 02bbffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
04 02bbffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 02bbffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 30
System Thread ID: 788
Kernel Time: 0:0:0.46
User Time: 0:0:0.109
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 02cffdec 77d39b92 ntdll!NtAlertThread+0xb
01 02cffe08 77d57116 RPCRT4!RPC_SERVER::CreateThread+0x49
02 02cffe28 77d57649 RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0xe8
03 02cfff74 77d56d5e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x229
04 02cfff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
05 02cfffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
06 02cfffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 02cfffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 31
System Thread ID: 198
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 02eaff74 77d39a74 ntdll!NtDelayExecution+0xb
01 02eaffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0xc3
02 02eaffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
03 02eaffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 32
System Thread ID: 7c8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 02eefe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
01 02eeff74 77d56d5e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 02eeff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
03 02eeffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
04 02eeffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 02eeffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file C:\iisstate\output\IISState-1148.log

I just realized the the problem is occurring in one of the
dllhost.exe files.

Here's the IISState log:

Opened log file 'C:\iisstate\output\IISState-1560.log'

***********************
Starting new log output
IISState version 3.3.1

Mon Sep 20 14:13:04 2004

OS = Windows 2000
Executable: dllhost.exe
PID = 1560

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 614
Kernel Time: 0:0:0.31
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0006fd50 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa473 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c81 ole32!
CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c581af6 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 624
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf9f USER32!NtUserGetMessage+0xb
01 008fff70 77abaeed ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abae28 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab4710 ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4668 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57438b ole32!
CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 64c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 00a0fc6c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00a0fc98 6de8b953 KERNEL32!
GetQueuedCompletionStatus+0x27
02 00a0fd94 6de8b8a8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 00a0ffb4 7c57438b TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 628
Kernel Time: 0:0:0.640
User Time: 0:0:0.656
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

No remote call being made

# ChildEBP RetAddr
00 00beff74 77d39a74 ntdll!NtDelayExecution+0xb
01 00beffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0xc3
02 00beffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
03 00beffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 6bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00c2ff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00c2ff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 00c2ff70 787f21d4 KERNEL32!WaitForMultipleObjects+0x17
03 00c2ffb4 7c57438b COMSVCS!
CEventDispatcher::PushEvents+0x44
04 00c2ffc0 00000008 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 6c0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

Remote call is either to a MTA object or object not
initialized. Also, possible utility thread.
DCOM call being made to Process ID: 1648
Waiting on thread id: ffffffff

# ChildEBP RetAddr
00 00c6fb68 77d4ec37 ntdll!ZwRequestWaitReplyPort+0xb
01 00c6fb94 77d3a2c7 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 00c6fba0 77b23b2a RPCRT4!I_RpcSendReceive+0x2c
03 00c6fbc0 77b239f5 ole32!ThreadSendReceive+0xef
04 00c6fbd8 77b20aa5 ole32!
CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14a
05 00c6fc18 77b2386e ole32!
CRpcChannelBuffer::SendReceive2+0x96
06 00c6fc28 77a6c78a ole32!
CRpcChannelBuffer::SendReceive+0x11
07 00c6fc88 77ab6af6 ole32!CAptRpcChnl::SendReceive+0xa9
08 00c6fce0 77d90328 ole32!CCtxComChnl::SendReceive+0x124
09 00c6fcfc 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
0a 00c6ff44 77d95f85 RPCRT4!NdrClientCall2+0x4f5
0b 00c6ff60 77d77f6b RPCRT4!ObjectStublessClient+0x76
0c 00c6ff70 787f212e RPCRT4!ObjectStubless+0xf
0d 00c6ffb4 7c57438b COMSVCS!
CEventDispatcher::GetEventServerInfoThread+0x10e
0e 00c6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 6c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00cafee4 7c573a4e ntdll!NtDelayExecution+0xb
01 00caff04 7c573a22 KERNEL32!SleepEx+0x32
02 00caff10 787cf77a KERNEL32!Sleep+0xb
03 00caff80 780060ce COMSVCS!PostData+0xf2
04 00caffb4 7c57438b MSVCRT!_beginthreadex+0xca
05 00caffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 6d0
Kernel Time: 0:3:20.453
User Time: 0:1:13.203
Thread Type: Other
# ChildEBP RetAddr
00 00f2fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00f2feb0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00f2ff0c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 00f2ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
04 00f2ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
05 00f2ffb4 7c57438b MSVCRT!_beginthreadex+0xca
06 00f2ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 6d4
Kernel Time: 0:2:42.875
User Time: 0:1:36.156
Thread Type: Other
# ChildEBP RetAddr
00 00f6fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00f6feb0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00f6ff0c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 00f6ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
04 00f6ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
05 00f6ffb4 7c57438b MSVCRT!_beginthreadex+0xca
06 00f6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 6d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0108ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0108ff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
02 0108ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 6dc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 010cff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 010cff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
02 010cffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 010cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 6ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

No remote call being made
# ChildEBP RetAddr
00 0124feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0124fee4 77d80976 KERNEL32!
GetQueuedCompletionStatus+0x27
02 0124ff20 77d50e9e RPCRT4!COMMON_ProcessCalls+0x9e
03 0124ff74 77d50cd7 RPCRT4!
LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0124ff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
05 0124ffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x4f
06 0124ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 0124ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6fc
Kernel Time: 0:0:0.796
User Time: 0:0:1.31
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

No remote call being made
# ChildEBP RetAddr
00 0130fe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0130ff74 77d56d5e RPCRT4!
LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0130ff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0130ffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
04 0130ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0130ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 704
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 01e2fe74 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01e2fec4 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01e2ff20 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 01e2ff3c 74a11086 USER32!MsgWaitForMultipleObjects+0x1d
04 01e2ff80 7800c9eb asp!CMTACallbackThread::Thread+0x42
05 01e2ffb4 7c57438b MSVCRT!_beginthread+0xce
06 01e2ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 710
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for -
Thread Type: PDM (Debugger) Thread.
# ChildEBP RetAddr
00 01eafddc 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01eafe2c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01eafe88 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 01eafea4 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
04 01eaff88 4a008a85 pdm+0x886c
05 01eaffb0 4a008a09 pdm+0x8a85
06 01eaffb4 7c57438b pdm+0x8a09
07 01eaffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 15
System Thread ID: 708
Kernel Time: 0:0:1.640
User Time: 0:1:1.500
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01eefd08 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 01eefd30 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 01eefd40 7632046c KERNEL32!WaitForSingleObject+0xf
03 01eefd4c 76320455 MSVBVM50!
CReadWriteMutex::_WaitForEvent+0x11
04 01eefd70 762f514b MSVBVM50!
CReadWriteMutex::RequestWrite+0x2d
05 01eefd8c 7633ad37 MSVBVM50!
CVBThreadAction::CleanupProjData+0x71
06 01eefdd4 762e39e5 MSVBVM50!
CThreadPool::CheckForProjectUnload+0x33
07 01eefe3c 762e37ef MSVBVM50!FnwpMainFilter+0x1d6
08 01eefe5c 77e11ef0 MSVBVM50!FnwpMain+0x1b
09 01eefe7c 77e1204c USER32!UserCallWinProc+0x18
0a 01eeff08 77e121af USER32!DispatchMessageWorker+0x2e4
0b 01eeff14 787c14c5 USER32!DispatchMessageW+0xb
0c 01eeff24 787c11ad COMSVCS!STAMessageWork::DoWork+0x15
0d 01eeffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
0e 01eeffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 718
Kernel Time: 0:0:1.484
User Time: 0:1:7.171
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for
C:\Inetpub\wwwroot\Pelican\DLL\viditel.dll -
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: ASP
Executing Page: C:\INETPUB\WWWROOT\PELICAN\LEARNMORE.ASP

# ChildEBP RetAddr
00 01f2ef14 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 01f2ef88 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 01f2ef90 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 01f2eff0 77abca06 MSVBVM50!CMutexSem::Request+0x10
04 01f2f01c 77abcfdc ole32!
CClassCache::CDllPathEntry::DllGetClassObject+0x35
05 01f2f040 77abd4b9 ole32!
CClassCache::CDllFnPtrMoniker::BindToObject+0x166
06 01f2f06c 77ac0505 ole32!
CClassCache::SearchForLoadedClass+0x71
07 01f2f11c 77a6be6c ole32!ICoCreateInstanceEx+0xc9
08 01f2f144 6aa169c8 ole32!CoCreateInstanceEx+0x2b
09 01f2f1b4 6a9f3f78 MSVBVM60!
RcmConstructObjectInstance_54+0x112
0a 01f2f1ec 1101d8b5 MSVBVM60!__vbaNew+0x21
WARNING: Stack unwind information not available. Following
frames may be wrong.
0b 01f2f268 1101bed6 viditel!DllCanUnloadNow+0x153eb
0c 01f2f2dc 6a9ed1a7 viditel!DllCanUnloadNow+0x13a0c
0d 01f2f338 6a9ec821 MSVBVM60!
RUN_INSTMGR::ExecuteInitTerm+0xe7
0e 01f2f36c 6a9ec248 MSVBVM60!
RUN_INSTMGR::CreateObjInstanceWithParts+0x19b
0f 01f2f3ec 6a9f90bb MSVBVM60!
RUN_INSTMGR::CreateObjInstance+0x11c
10 01f2f6a0 6a9f8fe3 MSVBVM60!TipCreateInstanceEx+0x9f
11 01f2f6dc 6a9f8f1d MSVBVM60!
CThreadPool::CreateInstanceFactory+0x8c
12 01f2f7d8 6a9f8ebd MSVBVM60!
CPrivClassFactory::CreateInstanceLic+0x5d
13 01f2f7f4 75a4cfbb MSVBVM60!
CPrivClassFactory::CreateInstance+0x1a
14 01f2f86c 75a5a821 vbscript!GetObjectFromProgID+0x2bd
15 01f2f898 75a34645 vbscript!VbsCreateObject+0x80
16 01f2f8a8 75a327fb vbscript!StaticEntryPoint::Call+0x12
17 01f2f9c0 75a3167d vbscript!CScriptRuntime::Run+0x29cf
18 01f2fab8 75a314ad vbscript!CScriptEntryPoint::Call+0x76
19 01f2fb08 75a3a748 vbscript!CSession::Execute+0xd0
1a 01f2fb4c 75a3f588 vbscript!
COleScript::ExecutePendingScripts+0x167
1b 01f2fb5c 74a1c61f vbscript!
COleScript::SetScriptState+0xf5
1c 01f2fb8c 74a1c53a asp!CActiveScriptEngine::TryCall+0x15
1d 01f2fbd0 74a0938c asp!CActiveScriptEngine::Call+0x4d
1e 01f2fbdc 74a08623 asp!CallScriptFunctionOfEngine+0x48
1f 01f2fc18 74a08431 asp!ExecuteRequest+0x19e
20 01f2fc60 74a0d96a asp!Execute+0x17e
21 01f2fcb0 74a2cf23 asp!CHitObj::ViperAsyncCallback+0x452
22 01f2fcc8 787c214a asp!CViperAsyncRequest::OnCall+0x3f
23 01f2fcd0 77aa1df2 COMSVCS!STAActivityWorkHelper+0xa
24 01f2fd14 77aa1c16 ole32!EnterForCallback+0x6a
25 01f2fe40 77aa1ad9 ole32!SwitchForCallback+0x12b
26 01f2fe68 77aa6533 ole32!PerformCallback+0x50
27 01f2fed4 77aa638c ole32!
CObjectContext::InternalContextCallback+0x10d
28 01f2fef4 787beff3 ole32!CObjectContext::DoCallback+0x1a
29 01f2ff24 787c11ad COMSVCS!STAActivityWork::DoWork+0x73
2a 01f2ffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
2b 01f2ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 17
System Thread ID: 71c
Kernel Time: 0:0:1.734
User Time: 0:1:8.640
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: ASP
Executing Page: C:\INETPUB\WWWROOT\PELICAN\LEARNMORE.ASP

# ChildEBP RetAddr
00 01f6ef14 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 01f6ef88 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 01f6ef90 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 01f6eff0 77abca06 MSVBVM50!CMutexSem::Request+0x10
04 01f6f01c 77abcfdc ole32!
CClassCache::CDllPathEntry::DllGetClassObject+0x35
05 01f6f040 77abd4b9 ole32!
CClassCache::CDllFnPtrMoniker::BindToObject+0x166
06 01f6f06c 77ac0505 ole32!
CClassCache::SearchForLoadedClass+0x71
07 01f6f11c 77a6be6c ole32!ICoCreateInstanceEx+0xc9
08 01f6f144 6aa169c8 ole32!CoCreateInstanceEx+0x2b
09 01f6f1b4 6a9f3f78 MSVBVM60!
RcmConstructObjectInstance_54+0x112
0a 01f6f1ec 1101d8b5 MSVBVM60!__vbaNew+0x21
WARNING: Stack unwind information not available. Following
frames may be wrong.
0b 01f6f268 1101bed6 viditel!DllCanUnloadNow+0x153eb
0c 01f6f2dc 6a9ed1a7 viditel!DllCanUnloadNow+0x13a0c
0d 01f6f338 6a9ec821 MSVBVM60!
RUN_INSTMGR::ExecuteInitTerm+0xe7
0e 01f6f36c 6a9ec248 MSVBVM60!
RUN_INSTMGR::CreateObjInstanceWithParts+0x19b
0f 01f6f3ec 6a9f90bb MSVBVM60!
RUN_INSTMGR::CreateObjInstance+0x11c
10 01f6f6a0 6a9f8fe3 MSVBVM60!TipCreateInstanceEx+0x9f
11 01f6f6dc 6a9f8f1d MSVBVM60!
CThreadPool::CreateInstanceFactory+0x8c
12 01f6f7d8 6a9f8ebd MSVBVM60!
CPrivClassFactory::CreateInstanceLic+0x5d
13 01f6f7f4 75a4cfbb MSVBVM60!
CPrivClassFactory::CreateInstance+0x1a
14 01f6f86c 75a5a821 vbscript!GetObjectFromProgID+0x2bd
15 01f6f898 75a34645 vbscript!VbsCreateObject+0x80
16 01f6f8a8 75a327fb vbscript!StaticEntryPoint::Call+0x12
17 01f6f9c0 75a3167d vbscript!CScriptRuntime::Run+0x29cf
18 01f6fab8 75a314ad vbscript!CScriptEntryPoint::Call+0x76
19 01f6fb08 75a3a748 vbscript!CSession::Execute+0xd0
1a 01f6fb4c 75a3f588 vbscript!
COleScript::ExecutePendingScripts+0x167
1b 01f6fb5c 74a1c61f vbscript!
COleScript::SetScriptState+0xf5
1c 01f6fb8c 74a1c53a asp!CActiveScriptEngine::TryCall+0x15
1d 01f6fbd0 74a0938c asp!CActiveScriptEngine::Call+0x4d
1e 01f6fbdc 74a08623 asp!CallScriptFunctionOfEngine+0x48
1f 01f6fc18 74a08431 asp!ExecuteRequest+0x19e
20 01f6fc60 74a0d96a asp!Execute+0x17e
21 01f6fcb0 74a2cf23 asp!CHitObj::ViperAsyncCallback+0x452
22 01f6fcc8 787c214a asp!CViperAsyncRequest::OnCall+0x3f
23 01f6fcd0 77aa1df2 COMSVCS!STAActivityWorkHelper+0xa
24 01f6fd14 77aa1c16 ole32!EnterForCallback+0x6a
25 01f6fe40 77aa1ad9 ole32!SwitchForCallback+0x12b
26 01f6fe68 77aa6533 ole32!PerformCallback+0x50
27 01f6fed4 77aa638c ole32!
CObjectContext::InternalContextCallback+0x10d
28 01f6fef4 787beff3 ole32!CObjectContext::DoCallback+0x1a
29 01f6ff24 787c11ad COMSVCS!STAActivityWork::DoWork+0x73
2a 01f6ffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
2b 01f6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 18
System Thread ID: 720
Kernel Time: 0:0:1.906
User Time: 0:1:7.687
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01fafbf8 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 01fafc6c 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 01fafc74 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 01fafd00 76321b84 MSVBVM50!CMutexSem::Request+0x10
04 01fafd38 763af536 MSVBVM50!CCreErrCreateCtl+0x2d
05 01fafd6c 763af54c MSVBVM50!ErrCreatePrinterObjects+0x56
06 01fafd78 763433af MSVBVM50!CVBApplication::hctlPrint+0xf
07 01fafde0 762e37ef MSVBVM50!FnwpMainFilter_213+0x271
08 01fafe00 77e11ef0 MSVBVM50!FnwpMain+0x1b
09 01fafe20 77e13869 USER32!UserCallWinProc+0x18
0a 01fafe3c 77e177f4 USER32!DispatchClientMessage+0x4b
0b 01fafe6c 77f9ff57 USER32!__fnINSTRINGNULL+0x35
0c 01fafebc 77e1177e ntdll!KiUserCallbackDispatcher+0x13
0d 01fafee4 77e118ec USER32!_PeekMessage+0x72
0e 01faff10 787c0eab USER32!PeekMessageW+0xba
0f 01faffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x163
10 01faffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: 724
Kernel Time: 0:0:1.953
User Time: 0:1:12.750
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01fefcd0 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 01fefd44 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 01fefd4c 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 01fefde0 762e37ef MSVBVM50!CMutexSem::Request+0x10
04 01fefe00 77e11ef0 MSVBVM50!FnwpMain+0x1b
05 01fefe20 77e13869 USER32!UserCallWinProc+0x18
06 01fefe3c 77e177f4 USER32!DispatchClientMessage+0x4b
07 01fefe6c 77f9ff57 USER32!__fnINSTRINGNULL+0x35
08 01fefebc 77e1177e ntdll!KiUserCallbackDispatcher+0x13
09 01fefee4 77e118ec USER32!_PeekMessage+0x72
0a 01feff10 787c0eab USER32!PeekMessageW+0xba
0b 01feffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x163
0c 01feffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 728
Kernel Time: 0:0:2.78
User Time: 0:1:8.343
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: ASP
Executing Page: C:\INETPUB\WWWROOT\PELICAN\LEARNMORE.ASP

# ChildEBP RetAddr
00 0202ef14 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 0202ef88 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 0202ef90 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 0202eff0 77abca06 MSVBVM50!CMutexSem::Request+0x10
04 0202f01c 77abcfdc ole32!
CClassCache::CDllPathEntry::DllGetClassObject+0x35
05 0202f040 77abd4b9 ole32!
CClassCache::CDllFnPtrMoniker::BindToObject+0x166
06 0202f06c 77ac0505 ole32!
CClassCache::SearchForLoadedClass+0x71
07 0202f11c 77a6be6c ole32!ICoCreateInstanceEx+0xc9
08 0202f144 6aa169c8 ole32!CoCreateInstanceEx+0x2b
09 0202f1b4 6a9f3f78 MSVBVM60!
RcmConstructObjectInstance_54+0x112
0a 0202f1ec 1101d8b5 MSVBVM60!__vbaNew+0x21
WARNING: Stack unwind information not available. Following
frames may be wrong.
0b 0202f268 1101bed6 viditel!DllCanUnloadNow+0x153eb
0c 0202f2dc 6a9ed1a7 viditel!DllCanUnloadNow+0x13a0c
0d 0202f338 6a9ec821 MSVBVM60!
RUN_INSTMGR::ExecuteInitTerm+0xe7
0e 0202f36c 6a9ec248 MSVBVM60!
RUN_INSTMGR::CreateObjInstanceWithParts+0x19b
0f 0202f3ec 6a9f90bb MSVBVM60!
RUN_INSTMGR::CreateObjInstance+0x11c
10 0202f6a0 6a9f8fe3 MSVBVM60!TipCreateInstanceEx+0x9f
11 0202f6dc 6a9f8f1d MSVBVM60!
CThreadPool::CreateInstanceFactory+0x8c
12 0202f7d8 6a9f8ebd MSVBVM60!
CPrivClassFactory::CreateInstanceLic+0x5d
13 0202f7f4 75a4cfbb MSVBVM60!
CPrivClassFactory::CreateInstance+0x1a
14 0202f86c 75a5a821 vbscript!GetObjectFromProgID+0x2bd
15 0202f898 75a34645 vbscript!VbsCreateObject+0x80
16 0202f8a8 75a327fb vbscript!StaticEntryPoint::Call+0x12
17 0202f9c0 75a3167d vbscript!CScriptRuntime::Run+0x29cf
18 0202fab8 75a314ad vbscript!CScriptEntryPoint::Call+0x76
19 0202fb08 75a3a748 vbscript!CSession::Execute+0xd0
1a 0202fb4c 75a3f588 vbscript!
COleScript::ExecutePendingScripts+0x167
1b 0202fb5c 74a1c61f vbscript!
COleScript::SetScriptState+0xf5
1c 0202fb8c 74a1c53a asp!CActiveScriptEngine::TryCall+0x15
1d 0202fbd0 74a0938c asp!CActiveScriptEngine::Call+0x4d
1e 0202fbdc 74a08623 asp!CallScriptFunctionOfEngine+0x48
1f 0202fc18 74a08431 asp!ExecuteRequest+0x19e
20 0202fc60 74a0d96a asp!Execute+0x17e
21 0202fcb0 74a2cf23 asp!CHitObj::ViperAsyncCallback+0x452
22 0202fcc8 787c214a asp!CViperAsyncRequest::OnCall+0x3f
23 0202fcd0 77aa1df2 COMSVCS!STAActivityWorkHelper+0xa
24 0202fd14 77aa1c16 ole32!EnterForCallback+0x6a
25 0202fe40 77aa1ad9 ole32!SwitchForCallback+0x12b
26 0202fe68 77aa6533 ole32!PerformCallback+0x50
27 0202fed4 77aa638c ole32!
CObjectContext::InternalContextCallback+0x10d
28 0202fef4 787beff3 ole32!CObjectContext::DoCallback+0x1a
29 0202ff24 787c11ad COMSVCS!STAActivityWork::DoWork+0x73
2a 0202ffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
2b 0202ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 72c
Kernel Time: 0:0:1.843
User Time: 0:1:4.593
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0206fcd0 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 0206fd44 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 0206fd4c 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 0206fde0 762e37ef MSVBVM50!CMutexSem::Request+0x10
04 0206fe00 77e11ef0 MSVBVM50!FnwpMain+0x1b
05 0206fe20 77e13869 USER32!UserCallWinProc+0x18
06 0206fe3c 77e177f4 USER32!DispatchClientMessage+0x4b
07 0206fe6c 77f9ff57 USER32!__fnINSTRINGNULL+0x35
08 0206febc 77e1177e ntdll!KiUserCallbackDispatcher+0x13
09 0206fee4 77e118ec USER32!_PeekMessage+0x72
0a 0206ff10 787c0eab USER32!PeekMessageW+0xba
0b 0206ffb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x163
0c 0206ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 730
Kernel Time: 0:0:1.625
User Time: 0:1:3.265
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 020afd0c 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 020afd80 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 020afd88 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 020afdd4 762e39e5 MSVBVM50!CMutexSem::Request+0x10
04 020afe3c 762e37ef MSVBVM50!FnwpMainFilter+0x1d6
05 020afe5c 77e11ef0 MSVBVM50!FnwpMain+0x1b
06 020afe7c 77e1204c USER32!UserCallWinProc+0x18
07 020aff08 77e121af USER32!DispatchMessageWorker+0x2e4
08 020aff14 787c14c5 USER32!DispatchMessageW+0xb
09 020aff24 787c11ad COMSVCS!STAMessageWork::DoWork+0x15
0a 020affb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
0b 020affec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 734
Kernel Time: 0:0:1.843
User Time: 0:1:7.718
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 708
Thread Type: ASP
Executing Page: C:\INETPUB\WWWROOT\PELICAN\LEARNMORE.ASP

# ChildEBP RetAddr
00 020eef14 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 020eef88 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 020eef90 762e1b79 ntdll!RtlEnterCriticalSection+0x46
03 020eeff0 77abca06 MSVBVM50!CMutexSem::Request+0x10
04 020ef01c 77abcfdc ole32!
CClassCache::CDllPathEntry::DllGetClassObject+0x35
05 020ef040 77abd4b9 ole32!
CClassCache::CDllFnPtrMoniker::BindToObject+0x166
06 020ef06c 77ac0505 ole32!
CClassCache::SearchForLoadedClass+0x71
07 020ef11c 77a6be6c ole32!ICoCreateInstanceEx+0xc9
08 020ef144 6aa169c8 ole32!CoCreateInstanceEx+0x2b
09 020ef1b4 6a9f3f78 MSVBVM60!
RcmConstructObjectInstance_54+0x112
0a 020ef1ec 1101d8b5 MSVBVM60!__vbaNew+0x21
WARNING: Stack unwind information not available. Following
frames may be wrong.
0b 020ef268 1101bed6 viditel!DllCanUnloadNow+0x153eb
0c 020ef2dc 6a9ed1a7 viditel!DllCanUnloadNow+0x13a0c
0d 020ef338 6a9ec821 MSVBVM60!
RUN_INSTMGR::ExecuteInitTerm+0xe7
0e 020ef36c 6a9ec248 MSVBVM60!
RUN_INSTMGR::CreateObjInstanceWithParts+0x19b
0f 020ef3ec 6a9f90bb MSVBVM60!
RUN_INSTMGR::CreateObjInstance+0x11c
10 020ef6a0 6a9f8fe3 MSVBVM60!TipCreateInstanceEx+0x9f
11 020ef6dc 6a9f8f1d MSVBVM60!
CThreadPool::CreateInstanceFactory+0x8c
12 020ef7d8 6a9f8ebd MSVBVM60!
CPrivClassFactory::CreateInstanceLic+0x5d
13 020ef7f4 75a4cfbb MSVBVM60!
CPrivClassFactory::CreateInstance+0x1a
14 020ef86c 75a5a821 vbscript!GetObjectFromProgID+0x2bd
15 020ef898 75a34645 vbscript!VbsCreateObject+0x80
16 020ef8a8 75a327fb vbscript!StaticEntryPoint::Call+0x12
17 020ef9c0 75a3167d vbscript!CScriptRuntime::Run+0x29cf
18 020efab8 75a314ad vbscript!CScriptEntryPoint::Call+0x76
19 020efb08 75a3a748 vbscript!CSession::Execute+0xd0
1a 020efb4c 75a3f588 vbscript!
COleScript::ExecutePendingScripts+0x167
1b 020efb5c 74a1c61f vbscript!
COleScript::SetScriptState+0xf5
1c 020efb8c 74a1c53a asp!CActiveScriptEngine::TryCall+0x15
1d 020efbd0 74a0938c asp!CActiveScriptEngine::Call+0x4d
1e 020efbdc 74a08623 asp!CallScriptFunctionOfEngine+0x48
1f 020efc18 74a08431 asp!ExecuteRequest+0x19e
20 020efc60 74a0d96a asp!Execute+0x17e
21 020efcb0 74a2cf23 asp!CHitObj::ViperAsyncCallback+0x452
22 020efcc8 787c214a asp!CViperAsyncRequest::OnCall+0x3f
23 020efcd0 77aa1df2 COMSVCS!STAActivityWorkHelper+0xa
24 020efd14 77aa1c16 ole32!EnterForCallback+0x6a
25 020efe40 77aa1ad9 ole32!SwitchForCallback+0x12b
26 020efe68 77aa6533 ole32!PerformCallback+0x50
27 020efed4 77aa638c ole32!
CObjectContext::InternalContextCallback+0x10d
28 020efef4 787beff3 ole32!CObjectContext::DoCallback+0x1a
29 020eff24 787c11ad COMSVCS!STAActivityWork::DoWork+0x73
2a 020effb4 7c57438b COMSVCS!
STAThread::STAThreadWorker+0x465
2b 020effec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 24
System Thread ID: 738
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0214ff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 0214ffb4 7c57438b ntdll!RtlpTimerThread+0x42
02 0214ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 25
System Thread ID: 550
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 021cff20 77f838a5 ntdll!ZwRemoveIoCompletion+0xb
01 021cffb4 7c57438b ntdll!RtlpWorkerThread+0x6b
02 021cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 26
System Thread ID: 4a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 02a9ff88 75179cd7 ntdll!ZwWaitForMultipleObjects+0xb
01 02a9ffb4 7c57438b NETAPI32!NetbiosWaiter+0x71
02 02a9ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 27
System Thread ID: 67c
Kernel Time: 0:0:0.31
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 02eeff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02eeff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02eeff94 1f9cbbce KERNEL32!WaitForSingleObject+0xf
03 02eeffb4 7c57438b oledb32!ReleaseResourceThread+0x57
04 02eeffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 28
System Thread ID: 404
Kernel Time: 0:0:0.46
User Time: 0:0:0.234
Thread Type: Other
# ChildEBP RetAddr
00 02f2ff58 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02f2ff80 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02f2ff90 1f9cbecb KERNEL32!WaitForSingleObject+0xf
03 02f2ffb4 7c57438b oledb32!ResetResourceThread+0x85
04 02f2ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 29
System Thread ID: 4b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 02f6fd54 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 02f6fd7c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 02f6fd8c 7878d255 KERNEL32!WaitForSingleObject+0xf
03 02f6ffb4 7c57438b COMSVCS!PingThread+0xf5
04 02f6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 30
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 064afac8 74fdbcd2 ntdll!ZwWaitForSingleObject+0xb
01 064afb04 74fd7ee6 msafd!SockWaitForSingleObject+0x1a8
02 064afbf0 75031da9 msafd!WSPSelect+0x24e
03 064afc54 76c16f2e WS2_32!select+0xe7
04 064affb0 76c16e24 WININET!
ICAsyncThread::SelectThread+0x1fc
05 064affb4 7c57438b WININET!
ICAsyncThread::SelectThreadWrapper+0x9
06 064affec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 31
System Thread ID: 794
Kernel Time: 0:0:0.125
User Time: 0:0:0.171
Thread Type: Other
# ChildEBP RetAddr
00 064efe58 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 064efea8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 064eff04 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 064eff20 77c764ff USER32!MsgWaitForMultipleObjects+0x1d
04 064eff74 77c78ffd SHLWAPI!
CThreadPool::RemoveWorkItem+0x7b
05 064effac 77c78f85 SHLWAPI!CThreadPool::Worker+0x38
06 064effb4 7c57438b SHLWAPI!CThreadPool::WorkerThread+0x29
07 064effec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 32
System Thread ID: 674
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0653ff68 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0653ff90 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0653ffa0 76c4220a KERNEL32!WaitForSingleObject+0xf
03 0653ffb0 76c4163a WININET!
AUTO_PROXY_DLLS::DoThreadProcessing+0x5b
04 0653ffb4 7c57438b WININET!AutoProxyThreadFunc+0xb
05 0653ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 33
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0674ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 0674ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 0674ffec 00000000 KERNEL32!BaseThreadStart+0x52


*****SUMMARY*****

IISState has detected that the process is most likely in a
hung state. This is most likely the result of an
incorrectly compiled or configured VB5 COM Object.

To address this problem, please follow the steps outline
in KB Article: 186273
(http://support.microsoft.com/default.aspx?scid=kb;en-
us;186273).


Closing open log file C:\iisstate\output\IISState-1560.log


 >-----Original Message-----
 >I have an intermittent problem where our IIS
servers "hang". System
 >resources (CPU, RAM, disk space, etc.) all check out
fine. Initially I
 >thought it was a problem with our load balancer, but when
I requested
 >a page through the second NIC while it was hung I got the
same
 >response (none).
 >
 >Here's the IISState log output. Any help on this would be
more than
 >welcome.
 >
 >***********************
 >Starting new log output
 >IISState version 3.3.1
 >
 >Mon Sep 20 13:57:23 2004
 >
 >OS = Windows 2000
 >Executable: inetinfo.exe
 >PID = 1148
 >
 >Note: Thread times are formatted as HH:MM:SS.ms
 >
 >***********************
 >
 >
 >
 >
 >Thread ID: 0
 >System Thread ID: 478
 >Kernel Time: 0:0:0.15
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
 >01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
 >02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
 >03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
 >04 0006fbf4 01002884 ADVAPI32!
StartServiceCtrlDispatcherA+0x7d
 >05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
 >06 0006ff70 01002fbf inetinfo!main+0x654
 >07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
 >08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
 >
 >
 >
 >
 >Thread ID: 1
 >System Thread ID: 494
 >Kernel Time: 0:0:0.46
 >User Time: 0:0:0.62
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 005dfd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 >01 005dfd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 >02 005dfd54 6e6f1fe8 KERNEL32!WaitForSingleObject+0xf
 >03 005dfd70 01002440 iisadmin!ServiceEntry+0x156
 >04 005dffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
 >05 005dffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
 >06 005dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 2
 >System Thread ID: 4a8
 >Kernel Time: 0:2:23.656
 >User Time: 0:0:55.437
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0071fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0071feb0 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0071ff0c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 0071ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
 >04 0071ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
 >05 0071ffb4 7c57438b MSVCRT!_beginthreadex+0xca
 >06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 3
 >System Thread ID: 4ac
 >Kernel Time: 0:2:9.281
 >User Time: 0:1:1.734
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0075fe60 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0075feb0 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0075ff0c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 0075ff28 6e5abc1d USER32!MsgWaitForMultipleObjects+0x1d
 >04 0075ff80 780060ce IisRTL!SchedulerWorkerThread+0xa7
 >05 0075ffb4 7c57438b MSVCRT!_beginthreadex+0xca
 >06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 4
 >System Thread ID: 4c8
 >Kernel Time: 0:0:0.125
 >User Time: 0:0:0.62
 >Thread Type: SMTP Service Worker Thread
 > # ChildEBP RetAddr
 >00 00e4fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 00e4fc6c 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 00e4fcc8 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 00e4fce4 769c4f9f USER32!MsgWaitForMultipleObjects+0x1d
 >04 00e4fd30 6b561462 INFOCOMM!
IIS_SERVICE::StartServiceOperation+0x209
 >05 00e4fd70 01002440 SMTPSVC!ServiceEntry+0x136
 >06 00e4ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
 >07 00e4ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
 >08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 5
 >System Thread ID: 4cc
 >Kernel Time: 0:0:0.46
 >User Time: 0:0:0.15
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 00e8fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 00e8fc6c 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 00e8fcc8 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 00e8fce4 769c4f9f USER32!MsgWaitForMultipleObjects+0x1d
 >04 00e8fd30 65f2d8b6 INFOCOMM!
IIS_SERVICE::StartServiceOperation+0x209
 >05 00e8fd70 01002440 w3svc!ServiceEntry+0x1b5
 >06 00e8ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
 >07 00e8ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
 >08 00e8ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 6
 >System Thread ID: 504
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 0104ff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 0104ff88 6d70b2fa KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 0104ffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
 >03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 7
 >System Thread ID: 508
 >Kernel Time: 0:0:4.156
 >User Time: 0:0:3.78
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 0108ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 0108ff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 0108ffb4 7c57438b ISATQ!AtqPoolThread+0x40
 >03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 8
 >System Thread ID: 50c
 >Kernel Time: 0:0:4.546
 >User Time: 0:0:3.218
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 010cff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 010cff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 010cffb4 7c57438b ISATQ!AtqPoolThread+0x40
 >03 010cffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 9
 >System Thread ID: 518
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0148fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0148fd70 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0148fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
 >03 0148ffb4 7c57438b RTUTILS!TraceServerThread+0xde
 >04 0148ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 10
 >System Thread ID: 51c
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Possible ASP page. Possible DCOM activity
 >Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
 >Continuing with other analysis.
 >
 >No remote call being made
 >
 > # ChildEBP RetAddr
 >00 014dfeb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 014dfee4 77d80976 KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 014dff20 77d50e9e RPCRT4!COMMON_ProcessCalls+0x9e
 >03 014dff74 77d50cd7 RPCRT4!
LOADABLE_TRANSPORT::ProcessIOEvents+0x99
 >04 014dff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
 >05 014dffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x4f
 >06 014dffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
 >07 014dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 11
 >System Thread ID: 520
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0151ff20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0151ff70 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0151ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17
 >03 0151ffb4 7c57438b exstrace!RegNotifyThread+0x6f
 >04 0151ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 12
 >System Thread ID: 524
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0155ff24 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0155ff74 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0155ff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17
 >03 0155ffb4 7c57438b exstrace!WriteTraceThread+0x2f
 >04 0155ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 13
 >System Thread ID: 528
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 016dff64 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 >01 016dff8c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 >02 016dff9c 6ff283ee KERNEL32!WaitForSingleObject+0xf
 >03 016dffb4 7c57438b FCACHDLL!
CScheduleThread::ScheduleThread+0x22
 >04 016dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 14
 >System Thread ID: 52c
 >Kernel Time: 0:0:0.15
 >User Time: 0:0:0.15
 >Thread Type: SMTP Service Worker Thread
 > # ChildEBP RetAddr
 >00 0181ff18 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 0181ff68 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 0181ff80 6b579fbd KERNEL32!WaitForMultipleObjects+0x17
 >03 0181ffb4 7c57438b SMTPSVC!TcpRegNotifyThread+0x136
 >04 0181ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 15
 >System Thread ID: 530
 >Kernel Time: 0:0:0.15
 >User Time: 0:0:0.0
 >Thread Type: SMTP Service Worker Thread
 > # ChildEBP RetAddr
 >00 0185ff68 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 >01 0185ff90 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 >02 0185ffa0 6b579df1 KERNEL32!WaitForSingleObject+0xf
 >03 0185ffb4 7c57438b SMTPSVC!FreeLibThread+0x1d
 >04 0185ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 16
 >System Thread ID: 534
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: HTTP Compression Thread
 > # ChildEBP RetAddr
 >00 0196ff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 >01 0196ff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 >02 0196ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
 >03 0196ffb4 7c57438b compfilt!CompressionThread+0x29
 >04 0196ffc0 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 17
 >System Thread ID: 538
 >Kernel Time: 0:0:0.15
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 019dfe74 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 019dfec4 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 019dff20 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 019dff3c 65f38a88 USER32!MsgWaitForMultipleObjects+0x1d
 >04 019dff80 7800c9eb w3svc!CMTACallbackThread::Thread+0x42
 >05 019dffb4 7c57438b MSVCRT!_beginthread+0xce
 >06 019dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 18
 >System Thread ID: 53c
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 01a1fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 01a1fef8 77e119e6 KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 01a1ff54 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
 >03 01a1ff70 65f2e673 USER32!MsgWaitForMultipleObjects+0x1d
 >04 01a1ffb4 7c57438b w3svc!OleHackThread+0x88
 >05 01a1ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 19
 >System Thread ID: 58c
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Possible ASP page. Possible DCOM activity
 >Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
 >Continuing with other analysis.
 >
 >No remote call being made
 >
 > # ChildEBP RetAddr
 >00 01a9fe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
 >01 01a9ff74 77d56d5e RPCRT4!
LRPC_ADDRESS::ReceiveLotsaCalls+0x74
 >02 01a9ff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
 >03 01a9ffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
 >04 01a9ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
 >05 01a9ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 20
 >System Thread ID: 5a4
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 01adfce0 74fdbcd2 ntdll!ZwWaitForSingleObject+0xb
 >01 01adfd1c 74fd7ee6 msafd!SockWaitForSingleObject+0x1a8
 >02 01adfe08 75031da9 msafd!WSPSelect+0x24e
 >03 01adfe6c 6e2b3b6e WS2_32!select+0xe7
 >04 01adffb4 7c57438b inetsloc!SocketListenThread+0x51
 >05 01adffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 21
 >System Thread ID: 5a8
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 01b1fdfc 74fdbcd2 ntdll!ZwWaitForSingleObject+0xb
 >01 01b1fe38 74fd7ee6 msafd!SockWaitForSingleObject+0x1a8
 >02 01b1ff24 75031da9 msafd!WSPSelect+0x24e
 >03 01b1ff88 6d7062b4 WS2_32!select+0xe7
 >04 01b1ffb0 6d706605 ISATQ!
ATQ_BMON_SET::BmonThreadFunc+0x22
 >05 01b1ffb4 7c57438b ISATQ!BmonThreadFunc+0x9
 >06 01b1ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 22
 >System Thread ID: 5ac
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 01b6ff54 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 >01 01b6ff7c 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 >02 01b6ff8c 741a962d KERNEL32!WaitForSingleObject+0xf
 >03 01b6ffb4 7c57438b
 >aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce
 >04 01b6ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 23
 >System Thread ID: 5b4
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: SMTP Service Worker Thread
 > # ChildEBP RetAddr
 >00 01bafed0 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 01baff20 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 01baff38 74190002 KERNEL32!WaitForMultipleObjects+0x17
 >03 01baff9c 6b56ce35 aqueue!
CConnMgr::GetNextConnection+0x1da
 >04 01baffb4 7c57438b SMTPSVC!
PERSIST_QUEUE::QueueThreadRoutine+0x23
 >05 01baffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 24
 >System Thread ID: 620
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 01efebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
 >01 01efffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
 >02 01efffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 25
 >System Thread ID: 150
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 01f3ff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 >01 01f3ff6c 7c578f0d KERNEL32!
WaitForMultipleObjectsEx+0xea
 >02 01f3ff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
 >03 01f3ffb4 7c57438b USERENV!NotificationThread+0x5f
 >04 01f3ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 26
 >System Thread ID: 60c
 >Kernel Time: 0:0:2.812
 >User Time: 0:0:2.15
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 022dff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 022dff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 022dffb4 7c57438b ISATQ!AtqPoolThread+0x40
 >03 022dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 27
 >System Thread ID: 238
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Other
 > # ChildEBP RetAddr
 >00 0238ff9c 77f842c4 ntdll!NtDelayExecution+0xb
 >01 0238ffb4 7c57438b ntdll!RtlpTimerThread+0x42
 >02 0238ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 28
 >System Thread ID: 6e4
 >Kernel Time: 0:0:1.578
 >User Time: 0:0:1.187
 >Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 >00 02b6ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 >01 02b6ff7c 6d7088db KERNEL32!
GetQueuedCompletionStatus+0x27
 >02 02b6ffb4 7c57438b ISATQ!AtqPoolThread+0x40
 >03 02b6ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 29
 >System Thread ID: 164
 >Kernel Time: 0:0:0.281
 >User Time: 0:0:0.796
 >Thread Type: Possible ASP page. Possible DCOM activity
 >Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
 >Continuing with other analysis.
 >
 >No remote call being made
 >
 > # ChildEBP RetAddr
 >00 02bbfe24 77d57494 ntdll!ZwReplyWaitReceivePortEx+0xb
 >01 02bbff74 77d56d5e RPCRT4!
LRPC_ADDRESS::ReceiveLotsaCalls+0x74
 >02 02bbff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
 >03 02bbffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
 >04 02bbffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
 >05 02bbffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 30
 >System Thread ID: 788
 >Kernel Time: 0:0:0.46
 >User Time: 0:0:0.109
 >Thread Type: Possible ASP page. Possible DCOM activity
 >Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
 >Continuing with other analysis.
 >
 >No remote call being made
 >
 > # ChildEBP RetAddr
 >00 02cffdec 77d39b92 ntdll!NtAlertThread+0xb
 >01 02cffe08 77d57116 RPCRT4!RPC_SERVER::CreateThread+0x49
 >02 02cffe28 77d57649 RPCRT4!
LRPC_ADDRESS::DealWithLRPCRequest+0xe8
 >03 02cfff74 77d56d5e RPCRT4!
LRPC_ADDRESS::ReceiveLotsaCalls+0x229
 >04 02cfff78 77d39ad0 RPCRT4!RecvLotsaCallsWrapper+0x9
 >05 02cfffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0x11f
 >06 02cfffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
 >07 02cfffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 31
 >System Thread ID: 198
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Possible ASP page. Possible DCOM activity
 >Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
 >Continuing with other analysis.
 >
 >No remote call being made
 >
 > # ChildEBP RetAddr
 >00 02eaff74 77d39a74 ntdll!NtDelayExecution+0xb
 >01 02eaffa8 77d41c6d RPCRT4!BaseCachedThreadRoutine+0xc3
 >02 02eaffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
 >03 02eaffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 >Thread ID: 32
 >System Thread ID: 7c8
 >Kernel Time: 0:0:0.0
 >User Time: 0:0:0.0
 >Thread Type: Possible ASP page. Possible DCOM activity
<font color=purple> >Executing Page: ASP.dll symbols not found. Unabl<!-- ~MESSAGE_AFTER~ -->