iisstate logs

I have three logs here. inetinfo.exe and two dllhost logs. They were
captured while inetinfo was at 60 %

If anyone could help me read these I would appreciate it. This
(inetinfo and dllhost cpu high) happens about once a month or so.

BTW, I have a program that I wrote, thecpuchecker, it runs via a
scheduler and tests for high cpu. When it finds it it will run
iisstate for you before it runs a bat file to reset iis or whatever
other process is causing the problem. It's not a free program but a
very valuable one.

Here are the logs:

Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log'

***********************
Starting new log output
IISState version 3.1

Mon Nov 24 18:53:23 2003

OS = Windows 2000
Executable: dllhost.exe
PID = 1848

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0006fd50 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa483 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c91
ole32!CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c5987e7 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 740
Kernel Time: 0:0:0.171
User Time: 0:0:0.328
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0087fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0087ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf4d USER32!NtUserGetMessage+0xb
01 008fff70 77abae9b ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abadd6 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab46fb ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 750
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc6c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0098fc98 6de8b983 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b8d8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 0098ffb4 7c57b382 TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 758
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 788027f3 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 787ffe2a COMSVCS!CRMRecoveryClerk::RecoveryThread+0x48f
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8c
05 00a0ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 75c
Kernel Time: 0:0:1.531
User Time: 0:0:2.703
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c59a0ed ntdll!NtDelayExecution+0xb
01 00a4ff00 7c59a0b8 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d011a KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 74c
Kernel Time: 0:0:0.156
User Time: 0:0:0.250
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00a8ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 760
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787ee22d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d77fb0 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d95ad7 RPCRT4!Invoke+0x30
05 00acf924 77d8f77e RPCRT4!NdrStubCall2+0x655
06 00acf988 77b22548 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b22823 ole32!SyncStubInvoke+0x61
08 00acfa14 77ab6e81 ole32!StubInvoke+0xa8
09 00acfa78 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b2242d ole32!MTAInvoke+0x18
0b 00acfac4 77b22b58 ole32!AppInvoke+0xb5
0c 00acfb84 77b2289b ole32!ComInvokeWithLockAndIPID+0x29e
0d 00acfba4 77ab3347 ole32!ComInvoke+0x41
0e 00acfbb4 77b23897 ole32!ThreadDispatch+0x21
0f 00acfbc8 77b238dd ole32!DispatchCall+0x24
10 00acfbe0 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x30
11 00acfc20 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d90328 ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95f85 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d77fcb RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f038f RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57b382 COMSVCS!CEventServer::DispatchEvents+0x81
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 788
Kernel Time: 0:0:0.156
User Time: 0:0:0.171
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00b3fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 00b7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 79c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcfd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcfd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcfd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 7a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Distributed Transaction. Checking for running ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 00c1ff40 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00c1ff68 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00c1ff78 6dfceb16 KERNEL32!WaitForSingleObject+0xf
03 00c1ffb0 6dfcea2b
MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0xe6
04 00c1ffb4 7c57b382 MSDTCPRX!CConnectionManager::TimerProc+0x1b
05 00c1ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0126ff28 7c59a0ed ntdll!NtDelayExecution+0xb
01 0126ff48 7c59a0b8 KERNEL32!SleepEx+0x32
02 0126ff54 7424616c KERNEL32!Sleep+0xb
03 0126ff6c 74237249 catsrv!RegSrvrPump+0x34
04 0126ff7c 78008454 catsrv!RunService+0x5f
05 0126ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0126ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 6f4
Kernel Time: 0:0:0.93
User Time: 0:0:0.265
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0132fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0132ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0132ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0132ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0132ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0132ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 18c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0136ff9c 77f85c42 ntdll!NtDelayExecution+0xb
01 0136ffb4 7c57b382 ntdll!RtlpTimerThread+0x42
02 0136ffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file
C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log
Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log'

***********************
Starting new log output
IISState version 3.1

Mon Nov 24 18:55:45 2003

OS = Windows 2000
Executable: dllhost.exe
PID = 1848

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0006fd50 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa483 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c91
ole32!CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c5987e7 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 740
Kernel Time: 0:0:0.171
User Time: 0:0:0.328
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0087fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0087ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf4d USER32!NtUserGetMessage+0xb
01 008fff70 77abae9b ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abadd6 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab46fb ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 750
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc6c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0098fc98 6de8b983 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b8d8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 0098ffb4 7c57b382 TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 758
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 788027f3 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 787ffe2a COMSVCS!CRMRecoveryClerk::RecoveryThread+0x48f
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8c
05 00a0ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 75c
Kernel Time: 0:0:1.531
User Time: 0:0:2.703
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c59a0ed ntdll!NtDelayExecution+0xb
01 00a4ff00 7c59a0b8 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d011a KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 74c
Kernel Time: 0:0:0.156
User Time: 0:0:0.250
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00a8ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 760
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787ee22d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d77fb0 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d95ad7 RPCRT4!Invoke+0x30
05 00acf924 77d8f77e RPCRT4!NdrStubCall2+0x655
06 00acf988 77b22548 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b22823 ole32!SyncStubInvoke+0x61
08 00acfa14 77ab6e81 ole32!StubInvoke+0xa8
09 00acfa78 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b2242d ole32!MTAInvoke+0x18
0b 00acfac4 77b22b58 ole32!AppInvoke+0xb5
0c 00acfb84 77b2289b ole32!ComInvokeWithLockAndIPID+0x29e
0d 00acfba4 77ab3347 ole32!ComInvoke+0x41
0e 00acfbb4 77b23897 ole32!ThreadDispatch+0x21
0f 00acfbc8 77b238dd ole32!DispatchCall+0x24
10 00acfbe0 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x30
11 00acfc20 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d90328 ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95f85 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d77fcb RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f038f RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57b382 COMSVCS!CEventServer::DispatchEvents+0x81
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 788
Kernel Time: 0:0:0.156
User Time: 0:0:0.171
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00b3fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 00b7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 79c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcfd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcfd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcfd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 7a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Distributed Transaction. Checking for running ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 00c1ff40 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00c1ff68 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00c1ff78 6dfceb16 KERNEL32!WaitForSingleObject+0xf
03 00c1ffb0 6dfcea2b
MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0xe6
04 00c1ffb4 7c57b382 MSDTCPRX!CConnectionManager::TimerProc+0x1b
05 00c1ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0126ff28 7c59a0ed ntdll!NtDelayExecution+0xb
01 0126ff48 7c59a0b8 KERNEL32!SleepEx+0x32
02 0126ff54 7424616c KERNEL32!Sleep+0xb
03 0126ff6c 74237249 catsrv!RegSrvrPump+0x34
04 0126ff7c 78008454 catsrv!RunService+0x5f
05 0126ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0126ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 6f4
Kernel Time: 0:0:0.93
User Time: 0:0:0.265
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0132fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0132ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0132ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0132ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0132ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0132ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 18c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0136ff9c 77f85c42 ntdll!NtDelayExecution+0xb
01 0136ffb4 7c57b382 ntdll!RtlpTimerThread+0x42
02 0136ffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file
C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log
Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log'

***********************
Starting new log output
IISState version 3.1

Tue Nov 25 12:00:42 2003

OS = Windows 2000
Executable: dllhost.exe
PID = 1848

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0006fd50 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa483 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c91
ole32!CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c5987e7 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 740
Kernel Time: 0:0:0.203
User Time: 0:0:0.421
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0087fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0087ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf4d USER32!NtUserGetMessage+0xb
01 008fff70 77abae9b ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abadd6 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab46fb ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 750
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc6c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0098fc98 6de8b983 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b8d8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 0098ffb4 7c57b382 TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 758
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 788027f3 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 787ffe2a COMSVCS!CRMRecoveryClerk::RecoveryThread+0x48f
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8c
05 00a0ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 75c
Kernel Time: 0:0:1.875
User Time: 0:0:3.484
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c59a0ed ntdll!NtDelayExecution+0xb
01 00a4ff00 7c59a0b8 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d011a KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 74c
Kernel Time: 0:0:0.156
User Time: 0:0:0.359
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00a8ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 760
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787ee22d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d77fb0 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d95ad7 RPCRT4!Invoke+0x30
05 00acf924 77d8f77e RPCRT4!NdrStubCall2+0x655
06 00acf988 77b22548 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b22823 ole32!SyncStubInvoke+0x61
08 00acfa14 77ab6e81 ole32!StubInvoke+0xa8
09 00acfa78 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b2242d ole32!MTAInvoke+0x18
0b 00acfac4 77b22b58 ole32!AppInvoke+0xb5
0c 00acfb84 77b2289b ole32!ComInvokeWithLockAndIPID+0x29e
0d 00acfba4 77ab3347 ole32!ComInvoke+0x41
0e 00acfbb4 77b23897 ole32!ThreadDispatch+0x21
0f 00acfbc8 77b238dd ole32!DispatchCall+0x24
10 00acfbe0 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x30
11 00acfc20 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d90328 ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95f85 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d77fcb RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f038f RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57b382 COMSVCS!CEventServer::DispatchEvents+0x81
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 788
Kernel Time: 0:0:0.171
User Time: 0:0:0.203
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00b3fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 00b7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 79c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcfd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcfd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcfd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 7a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Distributed Transaction. Checking for running ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 00c1ff40 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00c1ff68 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00c1ff78 6dfceb16 KERNEL32!WaitForSingleObject+0xf
03 00c1ffb0 6dfcea2b
MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0xe6
04 00c1ffb4 7c57b382 MSDTCPRX!CConnectionManager::TimerProc+0x1b
05 00c1ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6f0
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0126ff28 7c59a0ed ntdll!NtDelayExecution+0xb
01 0126ff48 7c59a0b8 KERNEL32!SleepEx+0x32
02 0126ff54 7424616c KERNEL32!Sleep+0xb
03 0126ff6c 74237249 catsrv!RegSrvrPump+0x34
04 0126ff7c 78008454 catsrv!RunService+0x5f
05 0126ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0126ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 6f4
Kernel Time: 0:0:0.109
User Time: 0:0:0.359
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0132fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0132ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0132ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0132ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0132ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0132ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 18c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0136ff9c 77f85c42 ntdll!NtDelayExecution+0xb
01 0136ffb4 7c57b382 ntdll!RtlpTimerThread+0x42
02 0136ffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file
C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log
Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log'

***********************
Starting new log output
IISState version 3.1

Thu Nov 27 06:48:47 2003

OS = Windows 2000
Executable: dllhost.exe
PID = 1848

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0006fd50 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa483 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c91
ole32!CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c5987e7 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 740
Kernel Time: 0:0:0.343
User Time: 0:0:0.593
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0087fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0087ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf4d USER32!NtUserGetMessage+0xb
01 008fff70 77abae9b ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abadd6 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab46fb ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 750
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc6c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0098fc98 6de8b983 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b8d8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 0098ffb4 7c57b382 TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 758
Kernel Time: 0:0:0.31
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 788027f3 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 787ffe2a COMSVCS!CRMRecoveryClerk::RecoveryThread+0x48f
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8c
05 00a0ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 75c
Kernel Time: 0:0:2.750
User Time: 0:0:5.390
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c59a0ed ntdll!NtDelayExecution+0xb
01 00a4ff00 7c59a0b8 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d011a KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 74c
Kernel Time: 0:0:0.203
User Time: 0:0:0.453
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00a8ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 760
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787ee22d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d77fb0 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d95ad7 RPCRT4!Invoke+0x30
05 00acf924 77d8f77e RPCRT4!NdrStubCall2+0x655
06 00acf988 77b22548 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b22823 ole32!SyncStubInvoke+0x61
08 00acfa14 77ab6e81 ole32!StubInvoke+0xa8
09 00acfa78 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b2242d ole32!MTAInvoke+0x18
0b 00acfac4 77b22b58 ole32!AppInvoke+0xb5
0c 00acfb84 77b2289b ole32!ComInvokeWithLockAndIPID+0x29e
0d 00acfba4 77ab3347 ole32!ComInvoke+0x41
0e 00acfbb4 77b23897 ole32!ThreadDispatch+0x21
0f 00acfbc8 77b238dd ole32!DispatchCall+0x24
10 00acfbe0 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x30
11 00acfc20 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d90328 ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95f85 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d77fcb RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f038f RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57b382 COMSVCS!CEventServer::DispatchEvents+0x81
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 788
Kernel Time: 0:0:0.250
User Time: 0:0:0.312
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00b3fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 00b7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 79c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcfd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcfd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcfd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 7a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Distributed Transaction. Checking for running ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 00c1ff40 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00c1ff68 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00c1ff78 6dfceb16 KERNEL32!WaitForSingleObject+0xf
03 00c1ffb0 6dfcea2b
MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0xe6
04 00c1ffb4 7c57b382 MSDTCPRX!CConnectionManager::TimerProc+0x1b
05 00c1ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6f0
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0126ff28 7c59a0ed ntdll!NtDelayExecution+0xb
01 0126ff48 7c59a0b8 KERNEL32!SleepEx+0x32
02 0126ff54 7424616c KERNEL32!Sleep+0xb
03 0126ff6c 74237249 catsrv!RegSrvrPump+0x34
04 0126ff7c 78008454 catsrv!RunService+0x5f
05 0126ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0126ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 6f4
Kernel Time: 0:0:0.203
User Time: 0:0:0.484
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0132fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0132ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0132ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0132ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0132ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0132ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 18c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0136ff9c 77f85c42 ntdll!NtDelayExecution+0xb
01 0136ffb4 7c57b382 ntdll!RtlpTimerThread+0x42
02 0136ffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file
C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log
Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log'

***********************
Starting new log output
IISState version 3.1

Fri Dec 05 19:07:06 2003

OS = Windows 2000
Executable: dllhost.exe
PID = 1848

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 734
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0006fd28 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0006fd50 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0006fd60 77aaa483 KERNEL32!WaitForSingleObject+0xf
03 0006fd80 77aa9c91
ole32!CSurrogateProcessActivator::WaitForSurrogateTimeout+0x4f
04 0006fd9c 01001230 ole32!CoRegisterSurrogateEx+0x169
05 0006ff24 010014c6 dllhost!WinMain+0xb0
06 0006ffc0 7c5987e7 dllhost!WinMainCRTStartup+0x156
07 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 740
Kernel Time: 0:0:0.984
User Time: 0:0:1.671
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0087fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0087ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0087ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0087ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0087ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0087ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 748
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 008fff30 77abaf4d USER32!NtUserGetMessage+0xb
01 008fff70 77abae9b ole32!CDllHost::STAWorkerLoop+0x40
02 008fff8c 77abadd6 ole32!CDllHost::WorkerThread+0xc2
03 008fff90 77ab46fb ole32!DLLHostThreadEntry+0x9
04 008fffa8 77ab4653 ole32!CRpcThread::WorkerLoop+0x22
05 008fffb4 7c57b382 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a
06 008fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 750
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0098fc6c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0098fc98 6de8b983 KERNEL32!GetQueuedCompletionStatus+0x27
02 0098fd94 6de8b8d8 TxfAux!WORK_QUEUE::WorkerLoop+0x83
03 0098ffb4 7c57b382 TxfAux!WORK_QUEUE::ThreadLoop+0x58
04 0098ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 758
Kernel Time: 0:0:0.62
User Time: 0:0:0.46
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a0fdd8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00a0fe28 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00a0fe40 788027f3 KERNEL32!WaitForMultipleObjects+0x17
03 00a0ff30 787ffe2a COMSVCS!CRMRecoveryClerk::RecoveryThread+0x48f
04 00a0ff7c 78008454 COMSVCS!RecoveryThreadFunction+0x8c
05 00a0ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 00a0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 75c
Kernel Time: 0:0:8.687
User Time: 0:0:17.656
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00a4fee0 7c59a0ed ntdll!NtDelayExecution+0xb
01 00a4ff00 7c59a0b8 KERNEL32!SleepEx+0x32
02 00a4ff0c 787d011a KERNEL32!Sleep+0xb
03 00a4ff7c 780085bc COMSVCS!PostData+0xf2
04 00a4ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
05 00a4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 74c
Kernel Time: 0:0:0.781
User Time: 0:0:1.343
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00a8fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 00a8ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00a8ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00a8ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 00a8ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 00a8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 760
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00acf5f0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00acf640 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00acf658 787ee22d KERNEL32!WaitForMultipleObjects+0x17
03 00acf6a4 77d77fb0 COMSVCS!CLceDisp::DoWork+0xab
04 00acf6c0 77d95ad7 RPCRT4!Invoke+0x30
05 00acf924 77d8f77e RPCRT4!NdrStubCall2+0x655
06 00acf988 77b22548 RPCRT4!CStdStubBuffer_Invoke+0xc8
07 00acf9cc 77b22823 ole32!SyncStubInvoke+0x61
08 00acfa14 77ab6e81 ole32!StubInvoke+0xa8
09 00acfa78 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0xbb
0a 00acfa94 77b2242d ole32!MTAInvoke+0x18
0b 00acfac4 77b22b58 ole32!AppInvoke+0xb5
0c 00acfb84 77b2289b ole32!ComInvokeWithLockAndIPID+0x29e
0d 00acfba4 77ab3347 ole32!ComInvoke+0x41
0e 00acfbb4 77b23897 ole32!ThreadDispatch+0x21
0f 00acfbc8 77b238dd ole32!DispatchCall+0x24
10 00acfbe0 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x30
11 00acfc20 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
12 00acfc30 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
13 00acfc90 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
14 00acfce8 77d90328 ole32!CCtxComChnl::SendReceive+0x124
15 00acfd04 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
16 00acff4c 77d95f85 RPCRT4!NdrClientCall2+0x4f5
17 00acff68 77d77fcb RPCRT4!ObjectStublessClient+0x76
18 00acff78 787f038f RPCRT4!ObjectStubless+0xf
19 00acffb4 7c57b382 COMSVCS!CEventServer::DispatchEvents+0x81
1a 00acffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 788
Kernel Time: 0:0:0.796
User Time: 0:0:1.359
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 00b3f73c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00b3f764 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00b3f774 77ac6375 KERNEL32!WaitForSingleObject+0xf
03 00b3f78c 77ac3c3c ole32!CNotify::QueryNotify+0x31
04 00b3f7a8 77ac3fee ole32!CCache::CheckNotify+0x35
05 00b3f7cc 77ac236f ole32!CCache::GetElement+0xd2
06 00b3f810 77ac203a ole32!CComCatalog::GetClassInfoW+0x6c
07 00b3f82c 787b2393 ole32!CComCatalog::GetClassInfoW+0x1d
08 00b3f844 787b1e5c
COMSVCS!CSecurityCallCtx::FaultInComClassInfo+0x23
09 00b3f8a0 787afae2 COMSVCS!CSecurityCallCtx::GetFastProp+0x224
0a 00b3f8f4 78791963 COMSVCS!CRolePolicy::VerifyTrust+0xfe
0b 00b3f9dc 787ace94 COMSVCS!CTrustManager::VerifyTrust+0x76f
0c 00b3fa8c 77aa7f6e COMSVCS!CSecurity::EnterWithBuffer+0x1ce
0d 00b3fac4 77aa7d49 ole32!CPolicySet::DeliverEvents+0x1cc
0e 00b3fb50 77ab6e5b ole32!CPolicySet::Notify+0x338
0f 00b3fba8 77aa9a11 ole32!CCtxComChnl::ContextInvoke+0x95
10 00b3fbc4 77b2242d ole32!MTAInvoke+0x18
11 00b3fbf4 77b22b58 ole32!AppInvoke+0xb5
12 00b3fcb4 77b20360 ole32!ComInvokeWithLockAndIPID+0x29e
13 00b3fcf4 77d52156 ole32!ThreadInvoke+0x1b7
14 00b3fd2c 77d37ee1 RPCRT4!DispatchToStubInC+0x32
15 00b3fd84 77d37db5 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x100
16 00b3fda4 77d38081 RPCRT4!RPC_INTERFACE::DispatchToStub+0x5e
17 00b3fdd4 77d58bda
RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0xa9
18 00b3fe10 77d5717a RPCRT4!LRPC_SCALL::DealWithRequestMessage+0x1cd
19 00b3fe28 77d57689 RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0x10c
1a 00b3ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x229
1b 00b3ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
1c 00b3ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
1d 00b3ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
1e 00b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 78c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00b7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 00b7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 00b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 79c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 00bcfd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00bcfd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 00bcfd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 00bcffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 00bcffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 7a0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Distributed Transaction. Checking for running ASP page
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 00c1ff40 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 00c1ff68 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 00c1ff78 6dfceb16 KERNEL32!WaitForSingleObject+0xf
03 00c1ffb0 6dfcea2b
MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0xe6
04 00c1ffb4 7c57b382 MSDTCPRX!CConnectionManager::TimerProc+0x1b
05 00c1ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 6f0
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 0126ff28 7c59a0ed ntdll!NtDelayExecution+0xb
01 0126ff48 7c59a0b8 KERNEL32!SleepEx+0x32
02 0126ff54 7424616c KERNEL32!Sleep+0xb
03 0126ff6c 74237249 catsrv!RegSrvrPump+0x34
04 0126ff7c 78008454 catsrv!RunService+0x5f
05 0126ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0126ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 6f4
Kernel Time: 0:0:0.843
User Time: 0:0:1.453
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0132fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0132ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0132ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0132ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0132ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0132ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 18c
Kernel Time: 0:0:0.31
User Time: 0:0:0.62
Thread Type: Other
# ChildEBP RetAddr
00 0136ff9c 77f85c42 ntdll!NtDelayExecution+0xb
01 0136ffb4 7c57b382 ntdll!RtlpTimerThread+0x42
02 0136ffec 00000000 KERNEL32!BaseThreadStart+0x52

Closing open log file
C:\dscinc\cpuchecker\iisstate31\output\IISState-1848.log



Opened log file
'C:\dscinc\cpuchecker\iisstate31\output\IISState-3464.log'

***********************
Starting new log output
IISState version 3.1

Fri Dec 05 19:06:44 2003

OS = Windows 2000
Executable: inetinfo.exe
PID = 3464

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 8f4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c586235 ntdll!ZwReadFile+0xb
01 0006f910 7c2e0135 KERNEL32!ReadFile+0x181
02 0006f93c 7c2dffbb ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e1995 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c5987e7 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 818
Kernel Time: 0:0:0.46
User Time: 0:0:0.390
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0059fd1c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0059fd44 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
04 0059ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
05 0059ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: ae4
Kernel Time: 0:0:19.140
User Time: 0:0:11.359
Thread Type: Other
# ChildEBP RetAddr
00 006dfe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 006dfeac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 006dff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 006dffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 704
Kernel Time: 0:0:20.453
User Time: 0:0:12.500
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: f24
Kernel Time: 0:0:0.328
User Time: 0:0:1.78
Thread Type: Other
# ChildEBP RetAddr
00 0104fc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0104fc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0104fcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0104fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 0104fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 0104fd70 01002440 w3svc!ServiceEntry+0x1b5
06 0104ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 0104ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: f74
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0110ff5c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0110ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
02 0110ffb4 7c57b382 ISATQ!I_AtqOplockThreadFunc+0x32
03 0110ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: f98
Kernel Time: 0:0:5.375
User Time: 0:0:4.234
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

DCOM call being made to Process ID: 4236
Waiting on thread id: 0

# ChildEBP RetAddr
00 0114ea28 77d4ec77 ntdll!NtRequestWaitReplyPort+0xb
01 0114ea54 77d3a2c7 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 0114ea60 77b23b2c RPCRT4!I_RpcSendReceive+0x2c
03 0114ea80 77b239f7 ole32!ThreadSendReceive+0xef
04 0114ea98 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14a
05 0114ead8 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 0114eae8 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
07 0114eb48 77ab6a37 ole32!CAptRpcChnl::SendReceive+0xa9
08 0114eba0 77d90328 ole32!CCtxComChnl::SendReceive+0x98
09 0114ebbc 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
0a 0114ee04 77d95f85 RPCRT4!NdrClientCall2+0x4f5
0b 0114ee20 77d77fcb RPCRT4!ObjectStublessClient+0x76
0c 0114ee30 65f369f2 RPCRT4!ObjectStubless+0xf
0d 0114f49c 65f04c38 w3svc!CWamInfoOutProc::DoProcessRequestCall+0x163
0e 0114f4c4 65f03d71 w3svc!CWamInfo::ProcessWamRequest+0xb9
0f 0114fcfc 65f03c49 w3svc!WAM_DICTATOR::ProcessWamRequest+0x1e5
10 0114fd20 65f03aa2 w3svc!HTTP_REQUEST::DoWamRequest+0x75
11 0114fd44 65f0249e w3svc!HTTP_REQUEST::ProcessBGI+0x166
12 0114fec4 65f01d97 w3svc!HTTP_REQUEST::DoWork+0x43f
13 0114fee4 65f06be5 w3svc!CLIENT_CONN::DoWork+0x1aa
14 0114ff08 65f06b58 w3svc!CreateClient+0x7b
15 0114ff4c 6d701ad2 w3svc!W3OnConnectEx+0x118
16 0114ff80 6d7029a6 ISATQ!AtqpProcessContext+0x23e
17 0114ffb4 7c57b382 ISATQ!AtqPoolThread+0x1a8
18 0114ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: f9c
Kernel Time: 0:0:3.359
User Time: 0:0:2.203
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0118ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0118ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0118ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 0118ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 137c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made
# ChildEBP RetAddr
00 0130feb8 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0130fee4 77d809da KERNEL32!GetQueuedCompletionStatus+0x27
02 0130ff20 77d50ede RPCRT4!COMMON_ProcessCalls+0x9e
03 0130ff74 77d50d17 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0130ff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
05 0130ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
06 0130ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
07 0130ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: fe0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0154fd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0154fd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0154fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0154ffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 0154ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 110c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0159ff5c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0159ff84 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0159ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0159ffb4 7c57b382 compfilt!CompressionThread+0x29
04 0159ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 1338
Kernel Time: 0:0:0.109
User Time: 0:0:0.265
Thread Type: Other
# ChildEBP RetAddr
00 0161fe70 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0161fec0 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0161ff1c 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0161ff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 0161ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 0161ffb4 7c57b382 MSVCRT!_endthread+0xc6
06 0161ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: e80
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0165fea8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0165fef8 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0165ff54 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0165ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 0165ffb4 7c57b382 w3svc!OleHackThread+0x88
05 0165ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 109c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 016dfce0 74fd1394 ntdll!NtWaitForSingleObject+0xb
01 016dfd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 016dfe08 750312f5 msafd!WSPSelect+0x24e
03 016dfe6c 6e2b3b6e WS2_32!select+0xe7
04 016dffb4 7c57b382 inetsloc!SocketListenThread+0x51
05 016dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 105c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0171fdfc 74fd1394 ntdll!NtWaitForSingleObject+0xb
01 0171fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0171ff24 750312f5 msafd!WSPSelect+0x24e
03 0171ff88 6d7075bd WS2_32!select+0xe7
04 0171ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 0171ffb4 7c57b382 ISATQ!BmonThreadFunc+0x9
06 017200ac 65f02a5e KERNEL32!BaseThreadStart+0x52
07 00000d58 00000000 w3svc!HTTP_REQUEST::Parse+0x1b7




Thread ID: 15
System Thread ID: 104c
Kernel Time: 0:0:7.515
User Time: 0:0:5.593
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 01c5ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 01c5ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 01c5ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 01c5ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 9f4
Kernel Time: 0:0:4.375
User Time: 0:0:3.62
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02b6ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 02b6ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 02b6ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 02b6ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 17
System Thread ID: e30
Kernel Time: 0:0:4.734
User Time: 0:0:3.328
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02baff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 02baff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 02baffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 02baffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 18
System Thread ID: 1028
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 038fff08 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 038fff58 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 038fff70 787f37d4 KERNEL32!WaitForMultipleObjects+0x17
03 038fffb4 7c57b382 comsvcs!CEventDispatcher::PushEvents+0x44
04 038fffc0 00000008 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: d3c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

Remote call is either to a MTA object or object not initialized. Also,
possible utility thread.
DCOM call being made to Process ID: 1848
Waiting on thread id: ffffffff

# ChildEBP RetAddr
00 0393fb68 77d4ec77 ntdll!NtRequestWaitReplyPort+0xb
01 0393fb94 77d3a2c7 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 0393fba0 77b23b2c RPCRT4!I_RpcSendReceive+0x2c
03 0393fbc0 77b239f7 ole32!ThreadSendReceive+0xef
04 0393fbd8 77b20aa5
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14a
05 0393fc18 77b23870 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 0393fc28 77a6c767 ole32!CRpcChannelBuffer::SendReceive+0x11
07 0393fc88 77ab6ac3 ole32!CAptRpcChnl::SendReceive+0xa9
08 0393fce0 77d90328 ole32!CCtxComChnl::SendReceive+0x124
09 0393fcfc 77d92b3f RPCRT4!NdrProxySendReceive+0x4c
0a 0393ff44 77d95f85 RPCRT4!NdrClientCall2+0x4f5
0b 0393ff60 77d77fcb RPCRT4!ObjectStublessClient+0x76
0c 0393ff70 787f372e RPCRT4!ObjectStubless+0xf
0d 0393ffb4 7c57b382
comsvcs!CEventDispatcher::GetEventServerInfoThread+0x10e
0e 0393ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 3b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03abff30 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 03abff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 03abff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 03abffb4 7c57b382 httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 03abffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 8c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03afff30 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 03afff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 03afff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 03afffb4 7c57b382 httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 03afffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 64c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03b3ff30 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 03b3ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 03b3ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 03b3ffb4 7c57b382 httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 03b3ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 1128
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03b7ff30 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 03b7ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 03b7ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 03b7ffb4 7c57b382 httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 03b7ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 24
System Thread ID: 790
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03bbff30 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 03bbff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 03bbff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 03bbffb4 7c57b382 httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 03bbffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 25
System Thread ID: d74
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03e8ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 03e8ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 03e8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 26
System Thread ID: d00
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03ecff1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 03ecff6c 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 03ecff84 7c121fef KERNEL32!WaitForMultipleObjects+0x17
03 03ecffb4 7c57b382 USERENV!NotificationThread+0x5f
04 03ecffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 27
System Thread ID: e48
Kernel Time: 0:0:5.109
User Time: 0:0:4.31
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0413ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0413ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0413ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 0413ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 28
System Thread ID: 328
Kernel Time: 0:0:6.125
User Time: 0:0:4.968
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

DCOM call being made to...(message truncated)

Inetinfo.exe is making DCOM calls to DLLHost. Basically, a few requests
have come in and inetinfo uses DCOM to marshal the request to the DLLHost
that the site is running in. The DLLHost is in the process of initializing
some objects (called from ColdFusion). Nothing else really going on. Looks
like a spike in traffic (possibly being crawled).

Pat