Welcome to MobyThreads.com!
FAQFAQ      ProfileProfile    Private MessagesPrivate Messages   Log inLog in
All support for the MobyThreads Threaded phpBB MOD can now be found on welsolutions at this forum

iisState log file

  
   Web Hosting and Web Master Forums (Home) -> IIS RSS
Next:  IIS 6 - changes don't immediately show up  
Author Message
anonymous240

External


Since: Oct 27, 2003
Posts: 6



(Msg. 1) Posted: Thu Apr 15, 2004 3:12 pm
Post subject: iisState log file
Archived from groups: microsoft>public>inetserver>iis (more info?)
I am running OWA 5.5 on win2k SP4 (IIS 5). The server hits
100% utilization once or twice a day with the DLLHOST.EXE
process. Either killing the process or restarting the box
fixes the problem temporarily. The event log has asp
errors (events 5 and 9), which led me to run iisstate.
Here is the log file. If you can point me in the right
direction as to what is happening, I'd greatly appreciate
it.

~~~~~~~~~~~~~~~~~~~~~~~
Opened log file 'D:\iisState\output\IISState-1232.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Apr 15 12:41:31 2004

OS = Windows 2000
Executable: inetinfo.exe
PID = 1232

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
*** WARNING: Unable to verify checksum for C:\Program
Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-pam1.dll
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\Program
Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-pam1.dll -
DLL (!FunctionName) that failed: iss_pam1!
psomReadSignatures




Thread ID: 4
System Thread ID: 558
Kernel Time: 0:0:0.375
User Time: 0:0:0.718
*** WARNING: Unable to verify checksum for C:\Program
Files\ISS\issSensors\slcowa1_ss_1\ISAPI\rsiisfilter.dll
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\Program
Files\ISS\issSensors\slcowa1_ss_1\ISAPI\rsiisfilter.dll -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following
frames may be wrong.
00 00b7eb20 5e097ea0 iss_pam1!psomReadSignatures+0x7c16
01 00b7f47c 5e09d4c9 iss_pam1!psomDisplayMem+0x6b380
02 00b7f4d4 1000658b iss_pam1!pamEventInterpret+0x2d9
03 00b7f4f4 10001e47 rsiisfilter!HttpFilterProc+0x20db
04 00b7f534 1000471b rsiisfilter+0x1e47
05 000006cc 00000000 rsiisfilter!HttpFilterProc+0x26b
Closing open log file D:\iisState\output\IISState-1232.log
Opened log file 'D:\iisState\output\IISState-1232.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Apr 15 12:43:53 2004

OS = Windows 2000
Executable: inetinfo.exe
PID = 1232

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 4cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!
StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 52c
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 0059fd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0059fd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
04 0059ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
05 0059ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 550
Kernel Time: 0:0:2.234
User Time: 0:0:1.203
Thread Type: Other
# ChildEBP RetAddr
00 006dfe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 006dfeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 006dff08 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 006dffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 554
Kernel Time: 0:0:1.796
User Time: 0:0:1.187
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 558
Kernel Time: 0:0:0.375
User Time: 0:0:0.718
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following
frames may be wrong.
00 00b7eb20 5e097ea0 iss_pam1!psomReadSignatures+0x7c16
01 00b7f47c 5e09d4c9 iss_pam1!psomDisplayMem+0x6b380
02 00b7f4d4 1000658b iss_pam1!pamEventInterpret+0x2d9
03 00b7f4f4 10001e47 rsiisfilter!HttpFilterProc+0x20db
04 00b7f534 1000471b rsiisfilter+0x1e47
05 000006cc 00000000 rsiisfilter!HttpFilterProc+0x26b




Thread ID: 5
System Thread ID: 5d8
Kernel Time: 0:0:0.62
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00e0fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e0fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e0fcc8 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 00e0fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e0fd30 65f0cfd8 INFOCOMM!
IIS_SERVICE::StartServiceOperation+0x209
05 00e0fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e0ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e0ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 5dc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00ecff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00ecff88 6d7029ef KERNEL32!
GetQueuedCompletionStatus+0x27
02 00ecffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
03 00ecffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 5e0
Kernel Time: 0:0:0.515
User Time: 0:0:1.609
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f0ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f0ff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 00f0ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 5e4
Kernel Time: 0:0:0.531
User Time: 0:0:2.593
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f4ff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 00f4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00f4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 5f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0134fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0134fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0134fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0134ffb4 7c57438b RTUTILS!TraceServerThread+0xde
04 0134ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 5f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\RPCRT4.DLL -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
Continuing with other analysis.

*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\ole32.dll -
OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 0139feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0139fee4 77d31394 KERNEL32!
GetQueuedCompletionStatus+0x27
WARNING: Stack unwind information not available. Following
frames may be wrong.
02 0139ff20 77d3e93f RPCRT4+0x1394
03 0139ff74 77d3e8c2 RPCRT4!RpcRevertToSelf+0x1fc6
04 0139ffa8 77d358d6 RPCRT4!RpcRevertToSelf+0x1f49
05 0139ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
06 0139ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 5f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 013dff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 013dff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 013dff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 013dffb4 7c57438b compfilt!CompressionThread+0x29
04 013dffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 600
Kernel Time: 0:0:0.15
User Time: 0:0:0.78
Thread Type: Other
# ChildEBP RetAddr
00 0146ff78 7c573a4e ntdll!NtDelayExecution+0xb
01 0146ff98 7c573a22 KERNEL32!SleepEx+0x32
02 0146ffa4 1000c610 KERNEL32!Sleep+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
03 0146ffec 00000000 rsiisfilter!HttpFilterProc+0x8160




Thread ID: 13
System Thread ID: 698
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
Continuing with other analysis.

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 0178fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 0178ff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
02 0178ffa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
03 0178ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
04 0178ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 66c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 017cfe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 017cfec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 017cff1c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 017cff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 017cff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 017cffb4 7c57438b MSVCRT!_endthread+0xc6
06 017cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 15
System Thread ID: 674
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0180fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0180fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0180ff54 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0180ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 0180ffb4 7c57438b w3svc!OleHackThread+0x88
05 0180ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 670
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0188fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 0188fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0188fe08 750312f5 msafd!WSPSelect+0x24e
03 0188fe6c 6e2b3b6e WS2_32!select+0xe7
04 0188ffb4 7c57438b inetsloc!SocketListenThread+0x51
05 0188ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 17
System Thread ID: 668
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 018cfdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 018cfe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 018cff24 750312f5 msafd!WSPSelect+0x24e
03 018cff88 6d7075bd WS2_32!select+0xe7
04 018cffb0 6d70791b ISATQ!
ATQ_BMON_SET::BmonThreadFunc+0x22
05 018cffb4 7c57438b ISATQ!BmonThreadFunc+0x9
06 018cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 18
System Thread ID: 754
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01a3ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
01 01a3ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
02 01a3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: 8a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01a7ff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01a7ff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 01a7ff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 01a7ffb4 7c57438b USERENV!NotificationThread+0x5f
04 01a7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 258
Kernel Time: 0:0:0.234
User Time: 0:0:0.562
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to
locate ASP page.
Continuing with other analysis.

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 023efe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 023eff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
02 023effa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
03 023effb4 7c57438b RPCRT4!RpcBindingFree+0x492
04 023effec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 6ac
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 024aff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 024affb4 7c57438b ntdll!RtlpTimerThread+0x42
02 024affec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 7b0
Kernel Time: 0:0:0.203
User Time: 0:0:1.312
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02d4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02d4ff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 02d4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 02d4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 5fc
Kernel Time: 0:0:0.234
User Time: 0:0:1.156
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02dbff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02dbff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 02dbffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 02dbffec 00000000 KERNEL32!BaseThreadStart+0x52

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating D:\iisState\output\1232-1082054715.dmp - mini
user dump

*****

Closing open log file D:\iisState\output\IISState-1232.log

 >> Stay informed about: iisState log file 
Back to top
Login to vote
patfilot

External


Since: Aug 24, 2003
Posts: 1478



(Msg. 2) Posted: Thu Apr 15, 2004 10:12 pm
Post subject: Re: iisState log file [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
Hmmm.

Well, this is a crash caused by:

C:\Program Files\ISS\issSensors\slcowa1_ss_1\ISAPI\rsiisfilter.dll

I think that I have seen that before and there is a fix from the vendor. It
wasn't causing 100% CPU though.

In fact, none of the threads appear to have used very much of the processor.
To capture the 100% CPU, you need to run IISState against the DLLHost while
it is having the problem:

iisstate -p <pid for dllhost> <enter>

So, the short answer is that you have at least 2 problems. This one
(rsiisfilter.dll) and another that causes 100% CPU.


Pat

"Aaron" <anonymous.TakeThisOut@discussions.microsoft.com> wrote in message
news:189db01c4231d$a8cc6dd0$a001280a@phx.gbl...
 > I am running OWA 5.5 on win2k SP4 (IIS 5). The server hits
 > 100% utilization once or twice a day with the DLLHOST.EXE
 > process. Either killing the process or restarting the box
 > fixes the problem temporarily. The event log has asp
 > errors (events 5 and 9), which led me to run iisstate.
 > Here is the log file. If you can point me in the right
 > direction as to what is happening, I'd greatly appreciate
 > it.
 >
 > ~~~~~~~~~~~~~~~~~~~~~~~
 > Opened log file 'D:\iisState\output\IISState-1232.log'
 >
 > ***********************
 > Starting new log output
 > IISState version 3.3.1
 >
 > Thu Apr 15 12:41:31 2004
 >
 > OS = Windows 2000
 > Executable: inetinfo.exe
 > PID = 1232
 >
 > Note: Thread times are formatted as HH:MM:SS.ms
 >
 > ***********************
 >
 >
 > IIS has crashed...
 > Beginning Analysis
 > *** WARNING: Unable to verify checksum for C:\Program
 > Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-pam1.dll
 > *** ERROR: Symbol file could not be found. Defaulted to
 > export symbols for C:\Program
 > Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-pam1.dll -
 > DLL (!FunctionName) that failed: iss_pam1!
 > psomReadSignatures
 >
 >
 >
 >
 > Thread ID: 4
 > System Thread ID: 558
 > Kernel Time: 0:0:0.375
 > User Time: 0:0:0.718
 > *** WARNING: Unable to verify checksum for C:\Program
 > Files\ISS\issSensors\slcowa1_ss_1\ISAPI\rsiisfilter.dll
 > *** ERROR: Symbol file could not be found. Defaulted to
 > export symbols for C:\Program
 > Files\ISS\issSensors\slcowa1_ss_1\ISAPI\rsiisfilter.dll -
 > Thread Type: Other
 > # ChildEBP RetAddr
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 00 00b7eb20 5e097ea0 iss_pam1!psomReadSignatures+0x7c16
 > 01 00b7f47c 5e09d4c9 iss_pam1!psomDisplayMem+0x6b380
 > 02 00b7f4d4 1000658b iss_pam1!pamEventInterpret+0x2d9
 > 03 00b7f4f4 10001e47 rsiisfilter!HttpFilterProc+0x20db
 > 04 00b7f534 1000471b rsiisfilter+0x1e47
 > 05 000006cc 00000000 rsiisfilter!HttpFilterProc+0x26b
 > Closing open log file D:\iisState\output\IISState-1232.log
 > Opened log file 'D:\iisState\output\IISState-1232.log'
 >
 > ***********************
 > Starting new log output
 > IISState version 3.3.1
 >
 > Thu Apr 15 12:43:53 2004
 >
 > OS = Windows 2000
 > Executable: inetinfo.exe
 > PID = 1232
 >
 > Note: Thread times are formatted as HH:MM:SS.ms
 >
 > ***********************
 >
 >
 >
 >
 > Thread ID: 0
 > System Thread ID: 4cc
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
 > 01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
 > 02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
 > 03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
 > 04 0006fbf4 01002884 ADVAPI32!
 > StartServiceCtrlDispatcherA+0x7d
 > 05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
 > 06 0006ff70 01002fbf inetinfo!main+0x654
 > 07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
 > 08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
 >
 >
 >
 >
 > Thread ID: 1
 > System Thread ID: 52c
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.31
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0059fd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 > 01 0059fd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 > 02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
 > 03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
 > 04 0059ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
 > 05 0059ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
 > 06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 2
 > System Thread ID: 550
 > Kernel Time: 0:0:2.234
 > User Time: 0:0:1.203
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 006dfe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 006dfeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 006dff08 77e11ace USER32!
 > MsgWaitForMultipleObjectsEx+0x153
 > 03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
 > 04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
 > 05 006dffb4 7c57438b MSVCRT!_endthreadex+0xc1
 > 06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 3
 > System Thread ID: 554
 > Kernel Time: 0:0:1.796
 > User Time: 0:0:1.187
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0071fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 0071feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 0071ff08 77e11ace USER32!
 > MsgWaitForMultipleObjectsEx+0x153
 > 03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
 > 04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
 > 05 0071ffb4 7c57438b MSVCRT!_endthreadex+0xc1
 > 06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 4
 > System Thread ID: 558
 > Kernel Time: 0:0:0.375
 > User Time: 0:0:0.718
 > Thread Type: Other
 > # ChildEBP RetAddr
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 00 00b7eb20 5e097ea0 iss_pam1!psomReadSignatures+0x7c16
 > 01 00b7f47c 5e09d4c9 iss_pam1!psomDisplayMem+0x6b380
 > 02 00b7f4d4 1000658b iss_pam1!pamEventInterpret+0x2d9
 > 03 00b7f4f4 10001e47 rsiisfilter!HttpFilterProc+0x20db
 > 04 00b7f534 1000471b rsiisfilter+0x1e47
 > 05 000006cc 00000000 rsiisfilter!HttpFilterProc+0x26b
 >
 >
 >
 >
 > Thread ID: 5
 > System Thread ID: 5d8
 > Kernel Time: 0:0:0.62
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 00e0fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 00e0fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 00e0fcc8 77e11ace USER32!
 > MsgWaitForMultipleObjectsEx+0x153
 > 03 00e0fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
 > 04 00e0fd30 65f0cfd8 INFOCOMM!
 > IIS_SERVICE::StartServiceOperation+0x209
 > 05 00e0fd70 01002440 w3svc!ServiceEntry+0x1b5
 > 06 00e0ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
 > 07 00e0ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
 > 08 00e0ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 6
 > System Thread ID: 5dc
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 00ecff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 00ecff88 6d7029ef KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > 02 00ecffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
 > 03 00ecffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 7
 > System Thread ID: 5e0
 > Kernel Time: 0:0:0.515
 > User Time: 0:0:1.609
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 00f0ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 00f0ff7c 6d702957 KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > 02 00f0ffb4 7c57438b ISATQ!AtqPoolThread+0x40
 > 03 00f0ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 8
 > System Thread ID: 5e4
 > Kernel Time: 0:0:0.531
 > User Time: 0:0:2.593
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 00f4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 00f4ff7c 6d702957 KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > 02 00f4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
 > 03 00f4ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 9
 > System Thread ID: 5f0
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0134fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 0134fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 0134fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
 > 03 0134ffb4 7c57438b RTUTILS!TraceServerThread+0xde
 > 04 0134ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 10
 > System Thread ID: 5f4
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > *** ERROR: Symbol file could not be found. Defaulted to
 > export symbols for C:\WINNT\system32\RPCRT4.DLL -
 > Thread Type: Possible ASP page. Possible DCOM activity
 > Executing Page: ASP.dll symbols not found. Unable to
 > locate ASP page.
 > Continuing with other analysis.
 >
 > *** ERROR: Symbol file could not be found. Defaulted to
 > export symbols for C:\WINNT\system32\ole32.dll -
 > OLE32.dll Symbols not found. Unable to proceed with DCOM
 > check.
 > Continuing other analysis.
 >
 > # ChildEBP RetAddr
 > 00 0139feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 0139fee4 77d31394 KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 02 0139ff20 77d3e93f RPCRT4+0x1394
 > 03 0139ff74 77d3e8c2 RPCRT4!RpcRevertToSelf+0x1fc6
 > 04 0139ffa8 77d358d6 RPCRT4!RpcRevertToSelf+0x1f49
 > 05 0139ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
 > 06 0139ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 11
 > System Thread ID: 5f8
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: HTTP Compression Thread
 > # ChildEBP RetAddr
 > 00 013dff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
 > 01 013dff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
 > 02 013dff94 732c3366 KERNEL32!WaitForSingleObject+0xf
 > 03 013dffb4 7c57438b compfilt!CompressionThread+0x29
 > 04 013dffc0 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 12
 > System Thread ID: 600
 > Kernel Time: 0:0:0.15
 > User Time: 0:0:0.78
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0146ff78 7c573a4e ntdll!NtDelayExecution+0xb
 > 01 0146ff98 7c573a22 KERNEL32!SleepEx+0x32
 > 02 0146ffa4 1000c610 KERNEL32!Sleep+0xb
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 03 0146ffec 00000000 rsiisfilter!HttpFilterProc+0x8160
 >
 >
 >
 >
 > Thread ID: 13
 > System Thread ID: 698
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Possible ASP page. Possible DCOM activity
 > Executing Page: ASP.dll symbols not found. Unable to
 > locate ASP page.
 > Continuing with other analysis.
 >
 > OLE32.dll Symbols not found. Unable to proceed with DCOM
 > check.
 > Continuing other analysis.
 >
 > # ChildEBP RetAddr
 > 00 0178fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 01 0178ff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
 > 02 0178ffa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
 > 03 0178ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
 > 04 0178ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 14
 > System Thread ID: 66c
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 017cfe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 017cfec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 017cff1c 77e11ace USER32!
 > MsgWaitForMultipleObjectsEx+0x153
 > 03 017cff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
 > 04 017cff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
 > 05 017cffb4 7c57438b MSVCRT!_endthread+0xc6
 > 06 017cffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 15
 > System Thread ID: 674
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0180fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 0180fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 0180ff54 77e11ace USER32!
 > MsgWaitForMultipleObjectsEx+0x153
 > 03 0180ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
 > 04 0180ffb4 7c57438b w3svc!OleHackThread+0x88
 > 05 0180ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 16
 > System Thread ID: 670
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 0188fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb
 > 01 0188fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
 > 02 0188fe08 750312f5 msafd!WSPSelect+0x24e
 > 03 0188fe6c 6e2b3b6e WS2_32!select+0xe7
 > 04 0188ffb4 7c57438b inetsloc!SocketListenThread+0x51
 > 05 0188ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 17
 > System Thread ID: 668
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 018cfdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb
 > 01 018cfe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
 > 02 018cff24 750312f5 msafd!WSPSelect+0x24e
 > 03 018cff88 6d7075bd WS2_32!select+0xe7
 > 04 018cffb0 6d70791b ISATQ!
 > ATQ_BMON_SET::BmonThreadFunc+0x22
 > 05 018cffb4 7c57438b ISATQ!BmonThreadFunc+0x9
 > 06 018cffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 18
 > System Thread ID: 754
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 01a3ebe0 77f89ebd ntdll!ZwWaitForMultipleObjects+0xb
 > 01 01a3ffb4 7c57438b ntdll!RtlpWaitThread+0x1b9
 > 02 01a3ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 19
 > System Thread ID: 8a0
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 01a7ff1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
 > 01 01a7ff6c 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
 > 02 01a7ff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
 > 03 01a7ffb4 7c57438b USERENV!NotificationThread+0x5f
 > 04 01a7ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 20
 > System Thread ID: 258
 > Kernel Time: 0:0:0.234
 > User Time: 0:0:0.562
 > Thread Type: Possible ASP page. Possible DCOM activity
 > Executing Page: ASP.dll symbols not found. Unable to
 > locate ASP page.
 > Continuing with other analysis.
 >
 > OLE32.dll Symbols not found. Unable to proceed with DCOM
 > check.
 > Continuing other analysis.
 >
 > # ChildEBP RetAddr
 > 00 023efe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
 > WARNING: Stack unwind information not available. Following
 > frames may be wrong.
 > 01 023eff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
 > 02 023effa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
 > 03 023effb4 7c57438b RPCRT4!RpcBindingFree+0x492
 > 04 023effec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 21
 > System Thread ID: 6ac
 > Kernel Time: 0:0:0.0
 > User Time: 0:0:0.0
 > Thread Type: Other
 > # ChildEBP RetAddr
 > 00 024aff9c 77f842c4 ntdll!NtDelayExecution+0xb
 > 01 024affb4 7c57438b ntdll!RtlpTimerThread+0x42
 > 02 024affec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 22
 > System Thread ID: 7b0
 > Kernel Time: 0:0:0.203
 > User Time: 0:0:1.312
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 02d4ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 02d4ff7c 6d702957 KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > 02 02d4ffb4 7c57438b ISATQ!AtqPoolThread+0x40
 > 03 02d4ffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 >
 >
 >
 > Thread ID: 23
 > System Thread ID: 5fc
 > Kernel Time: 0:0:0.234
 > User Time: 0:0:1.156
 > Thread Type: HTTP Listener
 > # ChildEBP RetAddr
 > 00 02dbff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
 > 01 02dbff7c 6d702957 KERNEL32!
 > GetQueuedCompletionStatus+0x27
 > 02 02dbffb4 7c57438b ISATQ!AtqPoolThread+0x40
 > 03 02dbffec 00000000 KERNEL32!BaseThreadStart+0x52
 >
 > *****
 >
 > Dump name is formatted as: PID-Timestamp.dmp
 >
 > Creating D:\iisState\output\1232-1082054715.dmp - mini
 > user dump
 >
 > *****
 >
 > Closing open log file D:\iisState\output\IISState-1232.log
 ><!-- ~MESSAGE_AFTER~ -->

 >> Stay informed about: iisState log file 
Back to top
Login to vote
anonymous240

External


Since: Oct 27, 2003
Posts: 6



(Msg. 3) Posted: Wed Apr 21, 2004 10:34 am
Post subject: Re: iisState log file [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
Thanks Pat. I ran iisstate again against the dllhost.exe
process, and here is the log. Does this give you any clue
about why the dllhost process is pegging the cpu?

Opened log file 'D:\iisState\output\IISState-1920.log'

***********************
Starting new log output
IISState version 3.3.1

Wed Apr 21 08:14:42 2004

OS = Windows 2000
Executable: dllhost.exe
PID = 1920

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 7f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\ole32.dll -
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0006fd50 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa701 KERNEL32!WaitForSingleObject+0xf
WARNING: Stack unwind information not available. Following
frames may be wrong.
03 0006fd80 77aa9f0f ole32!CoRegisterSurrogateEx+0x95b
04 00000001 00000000 ole32!CoRegisterSurrogateEx+0x169




Thread ID: 1
System Thread ID: 7ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abbad5 USER32!NtUserGetMessage+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 008fff70 77abba23 ole32!CoInstall+0x8a8
02 008fff8c 77abb95e ole32!CoInstall+0x7f6
03 00007530 00000000 ole32!CoInstall+0x731




Thread ID: 2
System Thread ID: 7b0
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\TxfAux.Dll -
Thread Type: Other
# ChildEBP RetAddr
00 009cfc54 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 009cfc80 6de8b9d0 KERNEL32!
GetQueuedCompletionStatus+0x27
WARNING: Stack unwind information not available. Following
frames may be wrong.
02 009cfd94 6de8b908 TxfAux!Log+0x600
03 009cffb4 7c57438b TxfAux!Log+0x538
04 009cffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 4a0
Kernel Time: 0:0:0.46
User Time: 0:0:0.125
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\RPCRT4.DLL -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 00b6feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00b6fee4 77d31394 KERNEL32!
GetQueuedCompletionStatus+0x27
WARNING: Stack unwind information not available. Following
frames may be wrong.
02 00b6ff20 77d3e93f RPCRT4+0x1394
03 00b6ff74 77d3e8c2 RPCRT4!RpcRevertToSelf+0x1fc6
04 00b6ffa8 77d358d6 RPCRT4!RpcRevertToSelf+0x1f49
05 00b6ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
06 00b6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 854
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for C:\WINNT\system32\COMSVCS.DLL -
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00baff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00baff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 00baff70 787f58ce KERNEL32!WaitForMultipleObjects+0x17
WARNING: Stack unwind information not available. Following
frames may be wrong.
03 00baffec 00000000 COMSVCS!RegisterComEvents+0x6a18




Thread ID: 5
System Thread ID: 858
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 00befb68 77d4256d ntdll!ZwRequestWaitReplyPort+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 00befb94 77d3ac56 RPCRT4!TowerConstruct+0x3dc
02 00befba0 77b25b87 RPCRT4!I_RpcSendReceive+0x22
03 00befbc0 77b25a52 ole32!DllDebugObjectRPCHook+0x12a
04 00befbd8 77b22ab6 ole32!
WdtpInterfacePointer_UserSize+0x1b99
05 00befc18 77b258c6 ole32!
StgGetIFillLockBytesOnFile+0x1aea9
06 00befc88 77ab74c3 ole32!
WdtpInterfacePointer_UserSize+0x1a0d
07 00befce0 77d94c1a ole32!CoFreeAllLibraries+0x7d06
08 00befcfc 77d9487d RPCRT4!NdrProxySendReceive+0x46
09 00beff44 77d95136 RPCRT4!NdrClientCall2+0x493
0a 00beff60 77d46e75 RPCRT4!CStdStubBuffer_AddRef+0x279
0b 00beff70 787f5818 RPCRT4!NdrFullPointerFree+0x1fc
0c 7886cf0c ffffffff COMSVCS!RegisterComEvents+0x6962
0d 0008b780 7886cf0c 0xffffffff
0e 00000000 00000000 COMSVCS!RegisterComEvents+0x7e056




Thread ID: 6
System Thread ID: 85c
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00c2fee0 7c573a4e ntdll!NtDelayExecution+0xb
01 00c2ff00 7c573a22 KERNEL32!SleepEx+0x32
02 00c2ff0c 787d12aa KERNEL32!Sleep+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
03 00c2ff7c 780085bc COMSVCS!Ordinal7+0x109ea
04 ffffffff 00000000 MSVCRT!_endthreadex+0xc1




Thread ID: 7
System Thread ID: 860
Kernel Time: 0:0:0.531
User Time: 0:0:0.375
Thread Type: Other
# ChildEBP RetAddr
00 00eafe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00eafeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00eaff08 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 00eaff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 00eaff7c 780085bc IISRTL!SchedulerWorkerThread+0xa7
05 00eaffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 00eaffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 864
Kernel Time: 0:0:0.640
User Time: 0:0:0.484
Thread Type: Other
# ChildEBP RetAddr
00 00eefe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00eefeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00eeff08 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 00eeff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 00eeff7c 780085bc IISRTL!SchedulerWorkerThread+0xa7
05 00eeffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 00eeffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 868
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00faff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00faff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 00faffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00faffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 86c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00feff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00feff7c 6d702957 KERNEL32!
GetQueuedCompletionStatus+0x27
02 00feffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00feffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 874
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 0114feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0114fee4 77d31394 KERNEL32!
GetQueuedCompletionStatus+0x27
WARNING: Stack unwind information not available. Following
frames may be wrong.
02 0114ff20 77d3e93f RPCRT4+0x1394
03 0114ff74 77d3e8c2 RPCRT4!RpcRevertToSelf+0x1fc6
04 0114ffa8 77d358d6 RPCRT4!RpcRevertToSelf+0x1f49
05 0114ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
06 0114ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 88c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 01d2fe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01d2fec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01d2ff1c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 01d2ff38 74a01e69 USER32!MsgWaitForMultipleObjects+0x1d
04 01d2ff7c 78008454 asp!CMTACallbackThread::Thread+0x42
05 01d2ffb4 7c57438b MSVCRT!_endthread+0xc6
06 01d2ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 890
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 01d6fe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01d6fec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01d6ff1c 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 01d6ff38 74a01eca USER32!MsgWaitForMultipleObjects+0x1d
04 01d6ff7c 78008454 asp!Debugger+0x74
05 01d6ffb4 7c57438b MSVCRT!_endthread+0xc6
06 01d6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 894
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for -
Thread Type: PDM (Debugger) Thread.
# ChildEBP RetAddr
00 01dafddc 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 01dafe2c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 01dafe88 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 01dafea4 4a00886c USER32!MsgWaitForMultipleObjects+0x1d
04 01daff88 4a008a85 pdm+0x886c
05 01daffb0 4a008a09 pdm+0x8a85
06 01daffb4 7c57438b pdm+0x8a09
07 01daffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 15
System Thread ID: 8b0
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01deff9c 77f842c4 ntdll!NtDelayExecution+0xb
01 01deffb4 7c57438b ntdll!RtlpTimerThread+0x42
02 01deffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 8b4
Kernel Time: 0:0:0.484
User Time: 0:0:1.265
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 01e2fd58 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 01e2fdcc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 01e2fdd4 6f088be7 ntdll!RtlEnterCriticalSection+0x46
03 01e2fde0 6f088c51 cdo!CSchedCache::Lock+0x17
04 01e2fe08 6fad6fbf cdo!CSchedCache::FIdleFlushFB+0x41
05 01e2fe38 6fa976cb MAPI32!FDoNextIdleTaskIntNT+0x15f
06 01e2fe44 6fa976a5 MAPI32!FDoNextIdleTask+0x1b
07 01e2fe48 6fa97693 MAPI32!IdleTimerProc+0x5
08 01e2fe5c 77e11ef0 MAPI32!IdleWndProc+0x33
09 01e2fe7c 77e1204c USER32!UserCallWinProc+0x18
0a 01e2ff08 77e121af USER32!DispatchMessageWorker+0x2e4
0b 01e2ff14 787c3075 USER32!DispatchMessageW+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
0c 01e2ff24 787c2c01 COMSVCS!Ordinal7+0x27b5
0d 00000000 00000000 COMSVCS!Ordinal7+0x2341




Thread ID: 17
System Thread ID: 8d0
Kernel Time: 0:0:0.281
User Time: 20:23:19.656
*** ERROR: Symbol file could not be found. Defaulted to
export symbols for -
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 01fee394 6f06c9fb cdo!
CDispatchObj::M_InvalidateObj1+0x3c
01 01fee39c 6f06c9c3 cdo!
CDispatchObj::M_InvalidateChildren1+0x1b
02 01fee3a8 6f06c9fb cdo!
CDispatchObj::M_InvalidateObj1+0x23
03 01fee3b0 6f06c969 cdo!
CDispatchObj::M_InvalidateChildren1+0x1b
04 01fee3bc 6f08663c cdo!
CDispatchObj::M_InvalidateChildren+0x29
05 01fee3f4 6f083726 cdo!CSession::M_ScLogoff+0x11c
06 01fee3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 01fee408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 01fee484 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 18
System Thread ID: 8e0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 025aff20 77f838a5 ntdll!ZwRemoveIoCompletion+0xb
01 025affb4 7c57438b ntdll!RtlpWorkerThread+0x6b
02 025affec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: 8e4
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 02c6fea4 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 02c6fef4 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 02c6ff50 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 02c6ff6c 6fad7316 USER32!MsgWaitForMultipleObjects+0x1d
04 02c6ffb4 7c57438b MAPI32!FDoNextIdleTaskIntNT+0x4b6
05 02c6ffc0 00000530 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 3f8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0787fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0787fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0787fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0787ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0787ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0787ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 7e0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0ae9fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0ae9fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0ae9fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0ae9ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0ae9ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0ae9ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 6d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0c39fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0c39fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0c39fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0c39ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0c39ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0c39ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 8a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0cc5fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0cc5fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0cc5fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0cc5ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0cc5ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0cc5ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 24
System Thread ID: 8c8
Kernel Time: 0:0:0.484
User Time: 15:23:23.375
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 0d0df0ec 6f06c969 cdo!CDispatchObj::M_InvalidateObj1+0x1
01 0d0df0f8 6f08663c cdo!
CDispatchObj::M_InvalidateChildren+0x29
02 0d0df130 6f083726 cdo!CSession::M_ScLogoff+0x11c
03 0d0df134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
04 0d0df144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
05 0d0df1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
06 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 25
System Thread ID: 484
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0d2dfe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0d2dfea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0d2dfefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0d2dff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0d2dffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0d2dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 26
System Thread ID: 480
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0eeafe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0eeafea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0eeafefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 0eeaff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 0eeaffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 0eeaffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 27
System Thread ID: 404
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008bfe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 008bfea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 008bfefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 008bff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 008bffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 008bffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 28
System Thread ID: 814
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 053ffe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 053ffea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 053ffefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 053fff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 053fffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 053fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 29
System Thread ID: 8cc
Kernel Time: 0:0:0.468
User Time: 0:0:0.859
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1751dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1751dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1751dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1751dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1751dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1751e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1751e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1751e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1751e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1751e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 30
System Thread ID: 464
Kernel Time: 0:0:0.296
User Time: 0:0:0.437
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 17cbf058 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 17cbf0cc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 17cbf0d4 6faae516 ntdll!RtlEnterCriticalSection+0x46
03 17cbf0f0 6f088907 MAPI32!DeinitMapiX+0x16
04 17cbf0f8 6f08674a cdo!CSession::M_ScFreeUserProfile+0x17
05 17cbf130 6f083726 cdo!CSession::M_ScLogoff+0x22a
06 17cbf134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 17cbf144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 17cbf1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 31
System Thread ID: 228
Kernel Time: 0:0:0.546
User Time: 0:0:0.953
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 1931f058 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1931f0cc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1931f0d4 6faae516 ntdll!RtlEnterCriticalSection+0x46
03 1931f0f0 6f088907 MAPI32!DeinitMapiX+0x16
04 1931f0f8 6f08674a cdo!CSession::M_ScFreeUserProfile+0x17
05 1931f130 6f083726 cdo!CSession::M_ScLogoff+0x22a
06 1931f134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 1931f144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 1931f1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 32
System Thread ID: 9a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1ad8fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1ad8fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1ad8fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1ad8ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1ad8ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1ad8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 33
System Thread ID: 8a8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1bb4fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1bb4fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1bb4fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1bb4ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1bb4ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1bb4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 34
System Thread ID: 530
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1bf6fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1bf6fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1bf6fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1bf6ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1bf6ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1bf6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 35
System Thread ID: 5b0
Kernel Time: 0:0:0.109
User Time: 0:0:0.93
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 1c4ef058 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1c4ef0cc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1c4ef0d4 6faae516 ntdll!RtlEnterCriticalSection+0x46
03 1c4ef0f0 6f088907 MAPI32!DeinitMapiX+0x16
04 1c4ef0f8 6f08674a cdo!CSession::M_ScFreeUserProfile+0x17
05 1c4ef130 6f083726 cdo!CSession::M_ScLogoff+0x22a
06 1c4ef134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 1c4ef144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 1c4ef1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 36
System Thread ID: 1d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1c72fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1c72fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1c72fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1c72ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1c72ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1c72ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 37
System Thread ID: 8b8
Kernel Time: 0:0:0.250
User Time: 0:0:0.359
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 1c84f058 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1c84f0cc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1c84f0d4 6faae516 ntdll!RtlEnterCriticalSection+0x46
03 1c84f0f0 6f088907 MAPI32!DeinitMapiX+0x16
04 1c84f0f8 6f08674a cdo!CSession::M_ScFreeUserProfile+0x17
05 1c84f130 6f083726 cdo!CSession::M_ScLogoff+0x22a
06 1c84f134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 1c84f144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 1c84f1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 38
System Thread ID: 5ac
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1ca4fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1ca4fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1ca4fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1ca4ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1ca4ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1ca4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 39
System Thread ID: 1b4
Kernel Time: 0:0:0.109
User Time: 0:0:0.140
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 1cb6f058 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1cb6f0cc 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1cb6f0d4 6faae516 ntdll!RtlEnterCriticalSection+0x46
03 1cb6f0f0 6f088907 MAPI32!DeinitMapiX+0x16
04 1cb6f0f8 6f08674a cdo!CSession::M_ScFreeUserProfile+0x17
05 1cb6f130 6f083726 cdo!CSession::M_ScLogoff+0x22a
06 1cb6f134 6f06cd80 cdo!CSession::V_HrInvoke+0xf6
07 1cb6f144 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
08 1cb6f1c0 6b61866f vbscript!DllCanUnloadNow+0x8e24
09 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 40
System Thread ID: 188
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1cd6fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1cd6fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1cd6fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1cd6ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1cd6ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1cd6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 41
System Thread ID: 300
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1d20fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1d20fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1d20fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1d20ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1d20ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1d20ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 42
System Thread ID: 420
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1d4efe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1d4efea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1d4efefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1d4eff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1d4effb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1d4effec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 43
System Thread ID: 49c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 1d84fe50 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 1d84fea0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 1d84fefc 77e11ace USER32!
MsgWaitForMultipleObjectsEx+0x153
03 1d84ff18 6fae5c18 USER32!MsgWaitForMultipleObjects+0x1d
04 1d84ffb4 7c57438b MAPI32!NotifThreadMain+0x48
05 1d84ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 44
System Thread ID: 8ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1d9adbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1d9adc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1d9adc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1d9add14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1d9add30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1d9ae394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1d9ae3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1d9ae3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1d9ae408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1d9ae484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 45
System Thread ID: 9bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1da6dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1da6dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1da6dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1da6dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1da6dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1da6e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1da6e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1da6e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1da6e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1da6e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 46
System Thread ID: 7d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1df0dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1df0dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1df0dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1df0dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1df0dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1df0e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1df0e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1df0e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1df0e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1df0e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 47
System Thread ID: 8bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e3edbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e3edc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e3edc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e3edd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e3edd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e3ee394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e3ee3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e3ee3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e3ee408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e3ee484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 48
System Thread ID: 264
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e46dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e46dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e46dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e46dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e46dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e46e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e46e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e46e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e46e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e46e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 49
System Thread ID: 650
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e56dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e56dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e56dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e56dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e56dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e56e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e56e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e56e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e56e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e56e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 50
System Thread ID: c0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e62dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e62dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e62dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e62dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e62dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e62e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e62e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e62e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e62e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e62e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 51
System Thread ID: 884
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e6edbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e6edc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e6edc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e6edd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e6edd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e6ee394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e6ee3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e6ee3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e6ee408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e6ee484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 52
System Thread ID: 59c
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e76dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e76dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e76dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e76dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e76dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e76e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e76e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e76e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e76e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e76e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 53
System Thread ID: 8f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e7edbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e7edc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e7edc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e7edd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e7edd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e7ee394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e7ee3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e7ee3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e7ee408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e7ee484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 54
System Thread ID: 91c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e86dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e86dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e86dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e86dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e86dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e86e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e86e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e86e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e86e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e86e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 55
System Thread ID: 99c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e92dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e92dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e92dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e92dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e92dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e92e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e92e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e92e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e92e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e92e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 56
System Thread ID: 1fc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e9adbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e9adc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e9adc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e9add14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e9add30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e9ae394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e9ae3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e9ae3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e9ae408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e9ae484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 57
System Thread ID: 92c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1e9edbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1e9edc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1e9edc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1e9edd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1e9edd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1e9ee394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1e9ee3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1e9ee3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1e9ee408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1e9ee484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 58
System Thread ID: 598
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1ea6dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1ea6dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1ea6dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1ea6dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1ea6dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1ea6e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1ea6e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1ea6e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1ea6e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1ea6e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 59
System Thread ID: 804
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Other information: Thread is waiting for a lock to be
released. Looking for lock owner.
Owning thread System ID: 9c4
Thread Type: ASP
Executing Page: C:\EXCHSRVR\WEBDATA\USA\LOGONFRM.ASP

# ChildEBP RetAddr
00 1eb2dbdc 77f8822a ntdll!ZwWaitForSingleObject+0xb
01 1eb2dc50 77f8819b ntdll!RtlpWaitForCriticalSection+0x9e
02 1eb2dc58 6fb16cdf ntdll!RtlEnterCriticalSection+0x46
03 1eb2dd14 6fab084c MAPI32!ScInitMapiX+0x8f
04 1eb2dd30 6f088844 MAPI32!MAPIInitialize+0x7c
05 1eb2e394 6f084302 cdo!
CSession::M_ScLoadUserProfile+0x204
06 1eb2e3f4 6f083720 cdo!CSession::M_ScDo_Logon+0x152
07 1eb2e3f8 6f06cd80 cdo!CSession::V_HrInvoke+0xf0
08 1eb2e408 6b614279 cdo!CDispatchObj::Invoke+0xa0
WARNING: Stack unwind information not available. Following
frames may be wrong.
09 1eb2e484 6b61866f vbscript!DllCanUnloadNow+0x8e24
0a 00000000 00000000 vbscript!DllCanUnloadNow+0xd21a




Thread ID: 60
System Thread ID: 5b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 1f4efe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 1f4eff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
02 1f4effa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
03 1f4effb4 7c57438b RPCRT4!RpcBindingFree+0x492
04 1f4effec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 61
System Thread ID: 830
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: Unable to locate ASP page

OLE32.dll Symbols not found. Unable to proceed with DCOM
check.
Continuing other analysis.

# ChildEBP RetAddr
00 1f52fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
WARNING: Stack unwind information not available. Following
frames may be wrong.
01 1f52ff74 77d37b4c RPCRT4!NdrCorrelationInitialize+0xd1
02 1f52ffa8 77d358d6 RPCRT4!NdrCorrelationInitialize+0x76
03 1f52ffb4 7c57438b RPCRT4!RpcBindingFree+0x492
04 1f52ffec 00000000 KERNEL32!BaseThreadStart+0x52

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating D:\iisState\output\1920-1082557005.dmp - mini
user dump

*****

Closing open log file D:\iisState\output\IISState-1920.log



 >-----Original Message-----
 >Hmmm.
 >
 >Well, this is a crash caused by:
 >
 >C:\Program Files\ISS\issSensors\slcowa1_ss_1
\ISAPI\rsiisfilter.dll
 >
 >I think that I have seen that before and there is a fix
from the vendor. It
 >wasn't causing 100% CPU though.
 >
 >In fact, none of the threads appear to have used very
much of the processor.
 >To capture the 100% CPU, you need to run IISState against
the DLLHost while
 >it is having the problem:
 >
 >iisstate -p <pid for dllhost> <enter>
 >
 >So, the short answer is that you have at least 2
problems. This one
 >(rsiisfilter.dll) and another that causes 100% CPU.
 >
 >
 >Pat
 >
 >"Aaron" <anonymous.DeleteThis@discussions.microsoft.com> wrote in
message
 >news:189db01c4231d$a8cc6dd0$a001280a@phx.gbl...
  >> I am running OWA 5.5 on win2k SP4 (IIS 5). The server
hits
  >> 100% utilization once or twice a day with the
DLLHOST.EXE
  >> process. Either killing the process or restarting the
box
  >> fixes the problem temporarily. The event log has asp
  >> errors (events 5 and 9), which led me to run iisstate.
  >> Here is the log file. If you can point me in the right
  >> direction as to what is happening, I'd greatly
appreciate
  >> it.
  >>
  >> ~~~~~~~~~~~~~~~~~~~~~~~
  >> Opened log file 'D:\iisState\output\IISState-1232.log'
  >>
  >> ***********************
  >> Starting new log output
  >> IISState version 3.3.1
  >>
  >> Thu Apr 15 12:41:31 2004
  >>
  >> OS = Windows 2000
  >> Executable: inetinfo.exe
  >> PID = 1232
  >>
  >> Note: Thread times are formatted as HH:MM:SS.ms
  >>
  >> ***********************
  >>
  >>
  >> IIS has crashed...
  >> Beginning Analysis
  >> *** WARNING: Unable to verify checksum for C:\Program
  >> Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-pam1.dll
  >> *** ERROR: Symbol file could not be found. Defaulted to
  >> export symbols for C:\Program
  >> Files\ISS\issSensors\slcowa1_ss_1\BlackICE\iss-
pam1.dll -
  >> DLL (!FunctionName) that failed: iss_pam1!
  >> psomReadSignatures
  >>
  >>