IIS terminated unexpectedly

We have the exact same problem with the IIS services terminating regularly on
W2K SP4 with IIS5. The iisstate tool seems to be part of the IIS 6 resource
kit. Will this run OK on IIS5 and if so what do I need to put on the the IIS5
server for it to work, i.e do I just copy the iisstate.exe into a new dir and
run it or are there dependent programs/DLLs that also need to be installed. I
would prefer not to install the IIS 6 resource kit on what is a production
IIS5 front end web server. Your help would be very much appreciated.

"Pat [MSFT]" wrote:

 > It means inetinfo.exe is crashing. You'll need to run IISState to identify
 > the culprit:
 >
 > iisstate -p <pid of inetinfo> -sc <enter>
 >
 > You will then have to wait for the crash. When the crash occurs, a log will
 > be generated and you can post it to the group.
 >
 >
 > Pat
 >
 > <anonymous.RemoveThis@discussions.microsoft.com> wrote in message
 > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
  > >I have IIS 5.0 running on Windows 2000 Advanced Server
  > > Platform. Our server seems to be shutting down all by
  > > itself. Here are the errors we are seeing:
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The FTP Publishing Service service terminated
  > > unexpectedly. It has done this 1 time(s). The following
  > > corrective action will be taken in 0 milliseconds: No
  > > action.
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The World Wide Web Publishing Service service terminated
  > > unexpectedly. It has done this 1 time(s). The following
  > > corrective action will be taken in 0 milliseconds: No
  > > action.
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The IIS Admin Service service terminated unexpectedly. It
  > > has done this X time(s). The following corrective action
  > > will be taken in 1 milliseconds: Run the configured
  > > recovery program.
  > >
  > > Event Type: Dcom
  > > Event Source: None
  > > Event ID: 10005
  > > DCOM got error "The service cannot be started, either
  > > because it is disabled or because it has no enabled
  > > devices associated with it. " attempting to start the
  > > service AOLAgent with arguments "-Service" in order to
  > > run the server:
  > > {29239950-7241-11D2-999B-00A0C932EE54}
  > >
  > > These errors occour almost every 10 - 15 minutes.
  > >
  > > Another error is
  > > Event Type: IISCTLS
  > > Event Source: None
  > > Event ID: 4
  > > IIS kill command received from user NT AUTHORITY\SYSTEM.
  > > The logged data is the status code.
  > >
  > > All the information I can find is pointing to code red
  > > virus. The servers have been patched and no viruses were
  > > detected by our virus scanner.
  > >
  > > Any help is appreciated
  > >
 >
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

I have exactly the same problem since a few days on to IIS 5 servers.
I have no clue what is happening. I think I changed nothing on the
servers....

"Adam Sayer" <Adam Sayer RemoveThis @discussions.microsoft.com> wrote in message
news:5C1F7EDB-998B-43F2-A947-400D867A0075@microsoft.com...
 > We have the exact same problem with the IIS services terminating regularly
on
 > W2K SP4 with IIS5. The iisstate tool seems to be part of the IIS 6
resource
 > kit. Will this run OK on IIS5 and if so what do I need to put on the the
IIS5
 > server for it to work, i.e do I just copy the iisstate.exe into a new dir
and
 > run it or are there dependent programs/DLLs that also need to be
installed. I
 > would prefer not to install the IIS 6 resource kit on what is a production
 > IIS5 front end web server. Your help would be very much appreciated.
 >
 > "Pat [MSFT]" wrote:
 >
  > > It means inetinfo.exe is crashing. You'll need to run IISState to
identify
  > > the culprit:
  > >
  > > iisstate -p <pid of inetinfo> -sc <enter>
  > >
  > > You will then have to wait for the crash. When the crash occurs, a log
will
  > > be generated and you can post it to the group.
  > >
  > >
  > > Pat
  > >
  > > <anonymous RemoveThis @discussions.microsoft.com> wrote in message
  > > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
   > > >I have IIS 5.0 running on Windows 2000 Advanced Server
   > > > Platform. Our server seems to be shutting down all by
   > > > itself. Here are the errors we are seeing:
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The FTP Publishing Service service terminated
   > > > unexpectedly. It has done this 1 time(s). The following
   > > > corrective action will be taken in 0 milliseconds: No
   > > > action.
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The World Wide Web Publishing Service service terminated
   > > > unexpectedly. It has done this 1 time(s). The following
   > > > corrective action will be taken in 0 milliseconds: No
   > > > action.
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The IIS Admin Service service terminated unexpectedly. It
   > > > has done this X time(s). The following corrective action
   > > > will be taken in 1 milliseconds: Run the configured
   > > > recovery program.
   > > >
   > > > Event Type: Dcom
   > > > Event Source: None
   > > > Event ID: 10005
   > > > DCOM got error "The service cannot be started, either
   > > > because it is disabled or because it has no enabled
   > > > devices associated with it. " attempting to start the
   > > > service AOLAgent with arguments "-Service" in order to
   > > > run the server:
   > > > {29239950-7241-11D2-999B-00A0C932EE54}
   > > >
   > > > These errors occour almost every 10 - 15 minutes.
   > > >
   > > > Another error is
   > > > Event Type: IISCTLS
   > > > Event Source: None
   > > > Event ID: 4
   > > > IIS kill command received from user NT AUTHORITY\SYSTEM.
   > > > The logged data is the status code.
   > > >
   > > > All the information I can find is pointing to code red
   > > > virus. The servers have been patched and no viruses were
   > > > detected by our virus scanner.
   > > >
   > > > Any help is appreciated
   > > >
  > >
  > >
  > ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

The latest IISState can be obtained @ <a style='text-decoration: underline;' href="http://www.iisfaq.com/iisstate." target="_blank">www.iisfaq.com/iisstate.</a> It will run
on Win2k.

If you get a log, post it to the group and we can hopefully identify the
culprit.


Pat

"Nicolas" <fpnmml.RemoveThis@free.fr> wrote in message
news:415c2bbe$0$5448$4d4eb98e@read.news.fr.uu.net...
 >I have exactly the same problem since a few days on to IIS 5 servers.
 > I have no clue what is happening. I think I changed nothing on the
 > servers....
 >
 > "Adam Sayer" <Adam Sayer.RemoveThis@discussions.microsoft.com> wrote in message
 > news:5C1F7EDB-998B-43F2-A947-400D867A0075@microsoft.com...
  >> We have the exact same problem with the IIS services terminating
  >> regularly
 > on
  >> W2K SP4 with IIS5. The iisstate tool seems to be part of the IIS 6
 > resource
  >> kit. Will this run OK on IIS5 and if so what do I need to put on the the
 > IIS5
  >> server for it to work, i.e do I just copy the iisstate.exe into a new dir
 > and
  >> run it or are there dependent programs/DLLs that also need to be
 > installed. I
  >> would prefer not to install the IIS 6 resource kit on what is a
  >> production
  >> IIS5 front end web server. Your help would be very much appreciated.
  >>
  >> "Pat [MSFT]" wrote:
  >>
   >> > It means inetinfo.exe is crashing. You'll need to run IISState to
 > identify
   >> > the culprit:
   >> >
   >> > iisstate -p <pid of inetinfo> -sc <enter>
   >> >
   >> > You will then have to wait for the crash. When the crash occurs, a log
 > will
   >> > be generated and you can post it to the group.
   >> >
   >> >
   >> > Pat
   >> >
   >> > <anonymous.RemoveThis@discussions.microsoft.com> wrote in message
   >> > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
   >> > >I have IIS 5.0 running on Windows 2000 Advanced Server
   >> > > Platform. Our server seems to be shutting down all by
   >> > > itself. Here are the errors we are seeing:
   >> > >
   >> > > Event Type: Error
   >> > > Event Source: Service Control Manager
   >> > > Event ID: 7031
   >> > > The FTP Publishing Service service terminated
   >> > > unexpectedly. It has done this 1 time(s). The following
   >> > > corrective action will be taken in 0 milliseconds: No
   >> > > action.
   >> > >
   >> > > Event Type: Error
   >> > > Event Source: Service Control Manager
   >> > > Event ID: 7031
   >> > > The World Wide Web Publishing Service service terminated
   >> > > unexpectedly. It has done this 1 time(s). The following
   >> > > corrective action will be taken in 0 milliseconds: No
   >> > > action.
   >> > >
   >> > > Event Type: Error
   >> > > Event Source: Service Control Manager
   >> > > Event ID: 7031
   >> > > The IIS Admin Service service terminated unexpectedly. It
   >> > > has done this X time(s). The following corrective action
   >> > > will be taken in 1 milliseconds: Run the configured
   >> > > recovery program.
   >> > >
   >> > > Event Type: Dcom
   >> > > Event Source: None
   >> > > Event ID: 10005
   >> > > DCOM got error "The service cannot be started, either
   >> > > because it is disabled or because it has no enabled
   >> > > devices associated with it. " attempting to start the
   >> > > service AOLAgent with arguments "-Service" in order to
   >> > > run the server:
   >> > > {29239950-7241-11D2-999B-00A0C932EE54}
   >> > >
   >> > > These errors occour almost every 10 - 15 minutes.
   >> > >
   >> > > Another error is
   >> > > Event Type: IISCTLS
   >> > > Event Source: None
   >> > > Event ID: 4
   >> > > IIS kill command received from user NT AUTHORITY\SYSTEM.
   >> > > The logged data is the status code.
   >> > >
   >> > > All the information I can find is pointing to code red
   >> > > virus. The servers have been patched and no viruses were
   >> > > detected by our virus scanner.
   >> > >
   >> > > Any help is appreciated
   >> > >
   >> >
   >> >
   >> >
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

If you are running the following: ASP/Access Database try the following on
IIS 5:

1. Open the database(s) one at a time
2. Click on Tools
3. Database Utilities
4. Click on Compact and Repair Database
5. If you have permissions set on this file and not on the folder check and
make sure that it did not reset them, I have found if you don't have the
permissions set on the folder but just on the database it self it will reset
it to read - you may have to reset it to write.
6. Run IISReset afterwards and this should take care of your problem

Take note that if you have never done this to your database(s) you will find
that they are usually smaller then they were before, that's because it has
cleaned up garbage data in the background and this is what is clogging up
the ASP server. I personally seen a 3.5 meg database reduced to 1.5 megs
after running the compact and repair tool.

Some will tell you this does nothing for the server... but they are wrong,
it's been working for me since last fall when it seemed all hell broke
loose.

Please post back to this email and let us know how it works out...

--


Regards,

Carroll


"Adam Sayer" <Adam Sayer RemoveThis @discussions.microsoft.com> wrote in message
news:5C1F7EDB-998B-43F2-A947-400D867A0075@microsoft.com...
 > We have the exact same problem with the IIS services terminating regularly
on
 > W2K SP4 with IIS5. The iisstate tool seems to be part of the IIS 6
resource
 > kit. Will this run OK on IIS5 and if so what do I need to put on the the
IIS5
 > server for it to work, i.e do I just copy the iisstate.exe into a new dir
and
 > run it or are there dependent programs/DLLs that also need to be
installed. I
 > would prefer not to install the IIS 6 resource kit on what is a production
 > IIS5 front end web server. Your help would be very much appreciated.
 >
 > "Pat [MSFT]" wrote:
 >
  > > It means inetinfo.exe is crashing. You'll need to run IISState to
identify
  > > the culprit:
  > >
  > > iisstate -p <pid of inetinfo> -sc <enter>
  > >
  > > You will then have to wait for the crash. When the crash occurs, a log
will
  > > be generated and you can post it to the group.
  > >
  > >
  > > Pat
  > >
  > > <anonymous RemoveThis @discussions.microsoft.com> wrote in message
  > > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
   > > >I have IIS 5.0 running on Windows 2000 Advanced Server
   > > > Platform. Our server seems to be shutting down all by
   > > > itself. Here are the errors we are seeing:
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The FTP Publishing Service service terminated
   > > > unexpectedly. It has done this 1 time(s). The following
   > > > corrective action will be taken in 0 milliseconds: No
   > > > action.
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The World Wide Web Publishing Service service terminated
   > > > unexpectedly. It has done this 1 time(s). The following
   > > > corrective action will be taken in 0 milliseconds: No
   > > > action.
   > > >
   > > > Event Type: Error
   > > > Event Source: Service Control Manager
   > > > Event ID: 7031
   > > > The IIS Admin Service service terminated unexpectedly. It
   > > > has done this X time(s). The following corrective action
   > > > will be taken in 1 milliseconds: Run the configured
   > > > recovery program.
   > > >
   > > > Event Type: Dcom
   > > > Event Source: None
   > > > Event ID: 10005
   > > > DCOM got error "The service cannot be started, either
   > > > because it is disabled or because it has no enabled
   > > > devices associated with it. " attempting to start the
   > > > service AOLAgent with arguments "-Service" in order to
   > > > run the server:
   > > > {29239950-7241-11D2-999B-00A0C932EE54}
   > > >
   > > > These errors occour almost every 10 - 15 minutes.
   > > >
   > > > Another error is
   > > > Event Type: IISCTLS
   > > > Event Source: None
   > > > Event ID: 4
   > > > IIS kill command received from user NT AUTHORITY\SYSTEM.
   > > > The logged data is the status code.
   > > >
   > > > All the information I can find is pointing to code red
   > > > virus. The servers have been patched and no viruses were
   > > > detected by our virus scanner.
   > > >
   > > > Any help is appreciated
   > > >
  > >
  > >
  > ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

We have also seen this problem. It appears to be intermittent.

I have two concerns about this. The first is why does the problem occur?
The second is concerning the pop-up window that appears on the server when
the problem occurs. On an unattended server, this tends to lock up the web
server until the OK button is pressed on the pop-up message box. At that
time IIS appears to restart and browsing can continue. Is there any way to
prevent the pop-up message from coming up on the server if the problem
itself cannot be solved?

--
-----------------------------------
Ken Varn
Senior Software Engineer
Diebold Inc.

EmailID = varnk
Domain = Diebold.com
-----------------------------------
<anonymous.RemoveThis@discussions.microsoft.com> wrote in message
news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
 > I have IIS 5.0 running on Windows 2000 Advanced Server
 > Platform. Our server seems to be shutting down all by
 > itself. Here are the errors we are seeing:
 >
 > Event Type: Error
 > Event Source: Service Control Manager
 > Event ID: 7031
 > The FTP Publishing Service service terminated
 > unexpectedly. It has done this 1 time(s). The following
 > corrective action will be taken in 0 milliseconds: No
 > action.
 >
 > Event Type: Error
 > Event Source: Service Control Manager
 > Event ID: 7031
 > The World Wide Web Publishing Service service terminated
 > unexpectedly. It has done this 1 time(s). The following
 > corrective action will be taken in 0 milliseconds: No
 > action.
 >
 > Event Type: Error
 > Event Source: Service Control Manager
 > Event ID: 7031
 > The IIS Admin Service service terminated unexpectedly. It
 > has done this X time(s). The following corrective action
 > will be taken in 1 milliseconds: Run the configured
 > recovery program.
 >
 > Event Type: Dcom
 > Event Source: None
 > Event ID: 10005
 > DCOM got error "The service cannot be started, either
 > because it is disabled or because it has no enabled
 > devices associated with it. " attempting to start the
 > service AOLAgent with arguments "-Service" in order to
 > run the server:
 > {29239950-7241-11D2-999B-00A0C932EE54}
 >
 > These errors occour almost every 10 - 15 minutes.
 >
 > Another error is
 > Event Type: IISCTLS
 > Event Source: None
 > Event ID: 4
 > IIS kill command received from user NT AUTHORITY\SYSTEM.
 > The logged data is the status code.
 >
 > All the information I can find is pointing to code red
 > virus. The servers have been patched and no viruses were
 > detected by our virus scanner.
 >
 > Any help is appreciated
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

We are having the same problem as Ken Varn. The dialog box letting us know
that dllhost.exe has a memory exception -this is preventing our unattended
server from responding. We confirm the dialog box -IIS restarts and the site
begins serving up pages again.

On one hand we'd just like to let IIS crash -log the event and let us
continue our troubleshooting. This is the first time we have had a dialog
box stop IIS from serving up pages in 4 years with the same system. It
happens intermittedly, between every 3-7 days.

"Ken Varn" <nospam> wrote in message
news:Oc7DD9GrEHA.896@TK2MSFTNGP12.phx.gbl...
 > We have also seen this problem. It appears to be intermittent.
 >
 > I have two concerns about this. The first is why does the problem occur?
 > The second is concerning the pop-up window that appears on the server when
 > the problem occurs. On an unattended server, this tends to lock up the
web
 > server until the OK button is pressed on the pop-up message box. At that
 > time IIS appears to restart and browsing can continue. Is there any way
to
 > prevent the pop-up message from coming up on the server if the problem
 > itself cannot be solved?
 >
 > --
 > -----------------------------------
 > Ken Varn
 > Senior Software Engineer
 > Diebold Inc.
 >
 > EmailID = varnk
 > Domain = Diebold.com
 > -----------------------------------
 > <anonymous.RemoveThis@discussions.microsoft.com> wrote in message
 > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
  > > I have IIS 5.0 running on Windows 2000 Advanced Server
  > > Platform. Our server seems to be shutting down all by
  > > itself. Here are the errors we are seeing:
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The FTP Publishing Service service terminated
  > > unexpectedly. It has done this 1 time(s). The following
  > > corrective action will be taken in 0 milliseconds: No
  > > action.
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The World Wide Web Publishing Service service terminated
  > > unexpectedly. It has done this 1 time(s). The following
  > > corrective action will be taken in 0 milliseconds: No
  > > action.
  > >
  > > Event Type: Error
  > > Event Source: Service Control Manager
  > > Event ID: 7031
  > > The IIS Admin Service service terminated unexpectedly. It
  > > has done this X time(s). The following corrective action
  > > will be taken in 1 milliseconds: Run the configured
  > > recovery program.
  > >
  > > Event Type: Dcom
  > > Event Source: None
  > > Event ID: 10005
  > > DCOM got error "The service cannot be started, either
  > > because it is disabled or because it has no enabled
  > > devices associated with it. " attempting to start the
  > > service AOLAgent with arguments "-Service" in order to
  > > run the server:
  > > {29239950-7241-11D2-999B-00A0C932EE54}
  > >
  > > These errors occour almost every 10 - 15 minutes.
  > >
  > > Another error is
  > > Event Type: IISCTLS
  > > Event Source: None
  > > Event ID: 4
  > > IIS kill command received from user NT AUTHORITY\SYSTEM.
  > > The logged data is the status code.
  > >
  > > All the information I can find is pointing to code red
  > > virus. The servers have been patched and no viruses were
  > > detected by our virus scanner.
  > >
  > > Any help is appreciated
  > >
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

It should be going to the Event Log. For some reason it is going to the
desktop. I would also point out that really this is a crash and the process
would have died, if it hadn't hung. So, if the underlying cause is
eliminated (i.e. the crash), the hang will go away. Do you have a thread
stack showing the failure that you could post?


Pat

"David Trebacz" <trebacz.DeleteThis@msn.com> wrote in message
news:uRs5cdUrEHA.1272@TK2MSFTNGP09.phx.gbl...
 > We are having the same problem as Ken Varn. The dialog box letting us know
 > that dllhost.exe has a memory exception -this is preventing our unattended
 > server from responding. We confirm the dialog box -IIS restarts and the
 > site
 > begins serving up pages again.
 >
 > On one hand we'd just like to let IIS crash -log the event and let us
 > continue our troubleshooting. This is the first time we have had a dialog
 > box stop IIS from serving up pages in 4 years with the same system. It
 > happens intermittedly, between every 3-7 days.
 >
 > "Ken Varn" <nospam> wrote in message
 > news:Oc7DD9GrEHA.896@TK2MSFTNGP12.phx.gbl...
  >> We have also seen this problem. It appears to be intermittent.
  >>
  >> I have two concerns about this. The first is why does the problem occur?
  >> The second is concerning the pop-up window that appears on the server
  >> when
  >> the problem occurs. On an unattended server, this tends to lock up the
 > web
  >> server until the OK button is pressed on the pop-up message box. At that
  >> time IIS appears to restart and browsing can continue. Is there any way
 > to
  >> prevent the pop-up message from coming up on the server if the problem
  >> itself cannot be solved?
  >>
  >> --
  >> -----------------------------------
  >> Ken Varn
  >> Senior Software Engineer
  >> Diebold Inc.
  >>
  >> EmailID = varnk
  >> Domain = Diebold.com
  >> -----------------------------------
  >> <anonymous.DeleteThis@discussions.microsoft.com> wrote in message
  >> news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
   >> > I have IIS 5.0 running on Windows 2000 Advanced Server
   >> > Platform. Our server seems to be shutting down all by
   >> > itself. Here are the errors we are seeing:
   >> >
   >> > Event Type: Error
   >> > Event Source: Service Control Manager
   >> > Event ID: 7031
   >> > The FTP Publishing Service service terminated
   >> > unexpectedly. It has done this 1 time(s). The following
   >> > corrective action will be taken in 0 milliseconds: No
   >> > action.
   >> >
   >> > Event Type: Error
   >> > Event Source: Service Control Manager
   >> > Event ID: 7031
   >> > The World Wide Web Publishing Service service terminated
   >> > unexpectedly. It has done this 1 time(s). The following
   >> > corrective action will be taken in 0 milliseconds: No
   >> > action.
   >> >
   >> > Event Type: Error
   >> > Event Source: Service Control Manager
   >> > Event ID: 7031
   >> > The IIS Admin Service service terminated unexpectedly. It
   >> > has done this X time(s). The following corrective action
   >> > will be taken in 1 milliseconds: Run the configured
   >> > recovery program.
   >> >
   >> > Event Type: Dcom
   >> > Event Source: None
   >> > Event ID: 10005
   >> > DCOM got error "The service cannot be started, either
   >> > because it is disabled or because it has no enabled
   >> > devices associated with it. " attempting to start the
   >> > service AOLAgent with arguments "-Service" in order to
   >> > run the server:
   >> > {29239950-7241-11D2-999B-00A0C932EE54}
   >> >
   >> > These errors occour almost every 10 - 15 minutes.
   >> >
   >> > Another error is
   >> > Event Type: IISCTLS
   >> > Event Source: None
   >> > Event ID: 4
   >> > IIS kill command received from user NT AUTHORITY\SYSTEM.
   >> > The logged data is the status code.
   >> >
   >> > All the information I can find is pointing to code red
   >> > virus. The servers have been patched and no viruses were
   >> > detected by our virus scanner.
   >> >
   >> > Any help is appreciated
   >> >
  >>
  >>
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly 

Here is the log I got with IISState.
Could you help me to analyse it?

Thanks

Nicolas


Opened log file 'C:\iisstate\output\IISState-1232.log'

***********************
Starting new log output
IISState version 3.3.1

Tue Oct 12 16:39:21 2004

OS = Windows 2000
Executable: inetinfo.exe
PID = 1232

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed: MSVCRT!__from_strstr_to_strchr




Thread ID: 8
System Thread ID: 4ac
Kernel Time: 0:0:2.333
User Time: 0:0:1.432
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f5ed30 6c8536d3 MSVCRT!__from_strstr_to_strchr+0x30
01 00f5f604 65f27103 md5filt!HttpFilterProc+0x1c6
02 00f5f62c 65f1dc7e w3svc!FILTER_LIST::NotifyFilters+0x9d
03 00f5f64c 65f1c4fb w3svc!HTTP_FILTER::NotifyLogFilters+0x30
04 00f5ff1c 65f01e1d w3svc!HTTP_REQ_BASE::WriteLogRecord+0x17f
05 00f5ff38 65f047ef w3svc!CLIENT_CONN::DoWork+0x21d
06 00f5ff4c 6d701a22 w3svc!W3Completion+0x43
07 00f5ff80 6d7029a6 ISATQ!AtqpProcessContext+0x266
08 00f5ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8
09 00f5ffec 00000000 KERNEL32!BaseThreadStart+0x52
Closing open log file C:\iisstate\output\IISState-1232.log
Opened log file 'C:\iisstate\output\IISState-1232.log'

***********************
Starting new log output
IISState version 3.3.1

Tue Oct 12 17:12:20 2004

OS = Windows 2000
Executable: inetinfo.exe
PID = 1232

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 4cc
Kernel Time: 0:0:0.10
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c5785d1 ntdll!ZwReadFile+0xb
01 0006f910 7c2e4cd9 KERNEL32!ReadFile+0x181
02 0006f93c 7c2e4b5f ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e6632 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c581af6 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d




Thread ID: 1
System Thread ID: 64c
Kernel Time: 0:0:0.50
User Time: 0:0:0.70
Thread Type: Other
# ChildEBP RetAddr
00 0059fd1c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0059fd44 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0059fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 0059fd70 01002440 iisadmin!ServiceEntry+0x156
04 0059ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
05 0059ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
06 0059ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 2
System Thread ID: 418
Kernel Time: 0:0:0.0
User Time: 0:0:0.30
Thread Type: Other
# ChildEBP RetAddr
00 006dfe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 006dfeac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 006dff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 006dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 006dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 006dffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 006dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 3
System Thread ID: 6a8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57438b MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 4
System Thread ID: 538
Kernel Time: 0:0:0.50
User Time: 0:0:0.110
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 00b8fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 00b8ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 00b8ff78 77d359c3 RPCRT4!RecvLotsaCallsWrapper+0x9
03 00b8ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x11f
04 00b8ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 00b8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 5
System Thread ID: 44c
Kernel Time: 0:0:0.220
User Time: 0:0:0.210
Thread Type: Other
# ChildEBP RetAddr
00 00e1fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e1fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e1fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e1fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e1fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e1fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e1ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e1ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e1ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 6
System Thread ID: 438
Kernel Time: 0:0:0.30
User Time: 0:0:0.60
Thread Type: Other
# ChildEBP RetAddr
00 00e5fc1c 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 00e5fc6c 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e5fcc8 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e5fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e5fd30 6fc6b2f0 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e5fd70 01002440 ftpsvc2!ServiceEntry+0xc7
06 00e5ffa4 7c2e4e9b inetinfo!InetinfoStartService+0x2bd
07 00e5ffb4 7c57438b ADVAPI32!ScSvcctrlThreadW+0xe
08 00e5ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 7
System Thread ID: 4a8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f1ff5c 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f1ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
02 00f1ffb4 7c57438b ISATQ!I_AtqOplockThreadFunc+0x32
03 00f1ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 8
System Thread ID: 4ac
Kernel Time: 0:0:2.333
User Time: 0:0:1.432
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f5ed30 6c8536d3 MSVCRT!__from_strstr_to_strchr+0x30
01 00f5f604 65f27103 md5filt!HttpFilterProc+0x1c6
02 00f5f62c 65f1dc7e w3svc!FILTER_LIST::NotifyFilters+0x9d
03 00f5f64c 65f1c4fb w3svc!HTTP_FILTER::NotifyLogFilters+0x30
04 00f5ff1c 65f01e1d w3svc!HTTP_REQ_BASE::WriteLogRecord+0x17f
05 00f5ff38 65f047ef w3svc!CLIENT_CONN::DoWork+0x21d
06 00f5ff4c 6d701a22 w3svc!W3Completion+0x43
07 00f5ff80 6d7029a6 ISATQ!AtqpProcessContext+0x266
08 00f5ffb4 7c57438b ISATQ!AtqPoolThread+0x1a8
09 00f5ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 9
System Thread ID: 43c
Kernel Time: 0:0:2.333
User Time: 0:0:1.512
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f9ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 00f9ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00f9ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 00f9ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 10
System Thread ID: 5e4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0120fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0120ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0120ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0120ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0120ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0120ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 11
System Thread ID: 4bc
Kernel Time: 0:0:0.10
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0124fd20 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0124fd70 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 0124fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0124ffb4 7c57438b RTUTILS!TraceServerThread+0xde
04 0124ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 12
System Thread ID: 5dc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0139feb8 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0139fee4 77d31394 KERNEL32!GetQueuedCompletionStatus+0x27
02 0139ff20 77d3e93f RPCRT4!COMMON_ProcessCalls+0x9e
03 0139ff74 77d3e8c2 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 0139ff78 77d35924 RPCRT4!ProcessIOEventsWrapper+0x9
05 0139ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
06 0139ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
07 0139ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 13
System Thread ID: 5d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 013dff00 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 013dff50 75037871 KERNEL32!WaitForMultipleObjectsEx+0xea
02 013dff6c 6fc66e80 WS2_32!WSAWaitForMultipleEvents+0x18
03 013dffb4 7c57438b ftpsvc2!PASV_ACCEPT_CONTEXT::AcceptThreadFunc+0x39
04 013dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 14
System Thread ID: 448
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0141ff5c 7c573b28 ntdll!ZwWaitForSingleObject+0xb
01 0141ff84 7c573b50 KERNEL32!WaitForSingleObjectEx+0x71
02 0141ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0141ffb4 7c57438b compfilt!CompressionThread+0x29
04 0141ffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 15
System Thread ID: 4a4
Kernel Time: 0:0:0.20
User Time: 0:0:0.30
Thread Type: Other
# ChildEBP RetAddr
00 0153fe70 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0153fec0 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0153ff1c 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0153ff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 0153ff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 0153ffb4 7c57438b MSVCRT!_endthread+0xc6
06 0153ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 16
System Thread ID: 5c8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0157fea8 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 0157fef8 77e119e6 KERNEL32!WaitForMultipleObjectsEx+0xea
02 0157ff54 77e11ace USER32!MsgWaitForMultipleObjectsEx+0x153
03 0157ff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 0157ffb4 7c57438b w3svc!OleHackThread+0x88
05 0157ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 17
System Thread ID: 444
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 015ffce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 015ffd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 015ffe08 750312f5 msafd!WSPSelect+0x24e
03 015ffe6c 6e2b3b6e WS2_32!select+0xe7
04 015fffb4 7c57438b inetsloc!SocketListenThread+0x51
05 015fffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 18
System Thread ID: 50c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0163fdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb
01 0163fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0163ff24 750312f5 msafd!WSPSelect+0x24e
03 0163ff88 6d7075bd WS2_32!select+0xe7
04 0163ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 0163ffb4 7c57438b ISATQ!BmonThreadFunc+0x9
06 0163ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 19
System Thread ID: 3b8
Kernel Time: 0:0:1.672
User Time: 0:0:1.151
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0229ff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 0229ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0229ffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 0229ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 20
System Thread ID: 630
Kernel Time: 0:0:2.613
User Time: 0:0:1.532
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 022dff50 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 022dff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 022dffb4 7c57438b ISATQ!AtqPoolThread+0x40
03 022dffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 21
System Thread ID: 258
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 02acff08 7c573c23 ntdll!ZwWaitForMultipleObjects+0xb
01 02acff58 7c578f0d KERNEL32!WaitForMultipleObjectsEx+0xea
02 02acff70 787f58ce KERNEL32!WaitForMultipleObjects+0x17
03 02acffb4 7c57438b COMSVCS!CEventDispatcher::PushEvents+0x4e
04 02acffc0 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 22
System Thread ID: 30c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

Remote call is either to a MTA object or object not initialized. Also,
possible utility thread.
DCOM call being made to Process ID: 1332
Waiting on thread id: ffffffff

# ChildEBP RetAddr
00 02b0fb68 77d4256d ntdll!ZwRequestWaitReplyPort+0xb
01 02b0fb94 77d3ac56 RPCRT4!LRPC_CCALL::SendReceive+0x11e
02 02b0fba0 77b25b87 RPCRT4!I_RpcSendReceive+0x2c
03 02b0fbc0 77b25a52 ole32!ThreadSendReceive+0xef
04 02b0fbd8 77b22ab6 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x14f
05 02b0fc18 77b258c6 ole32!CRpcChannelBuffer::SendReceive2+0x96
06 02b0fc28 77a6cb5d ole32!CRpcChannelBuffer::SendReceive+0x11
07 02b0fc88 77ab74c3 ole32!CAptRpcChnl::SendReceive+0xa9
08 02b0fce0 77d94c1a ole32!CCtxComChnl::SendReceive+0x124
09 02b0fcfc 77d9487d RPCRT4!NdrProxySendReceive+0x4c
0a 02b0ff44 77d95136 RPCRT4!NdrClientCall2+0x4f5
0b 02b0ff60 77d46e75 RPCRT4!ObjectStublessClient+0x76
0c 02b0ff70 787f5818 RPCRT4!ObjectStubless+0xf
0d 02b0ffb4 7c57438b
COMSVCS!CEventDispatcher::GetEventServerInfoThread+0x118
0e 02b0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 23
System Thread ID: 6b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02c0ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02c0ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02c0ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02c0ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02c0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 24
System Thread ID: 120
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02c4ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02c4ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02c4ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02c4ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02c4ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 25
System Thread ID: 698
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02c8ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02c8ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02c8ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02c8ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02c8ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 26
System Thread ID: 3bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02ccff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02ccff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02ccff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02ccffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02ccffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 27
System Thread ID: 3c8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: WebDav Worker Thread
# ChildEBP RetAddr
00 02d0ff30 7c573c73 ntdll!ZwRemoveIoCompletion+0xb
01 02d0ff5c 6b5e99c2 KERNEL32!GetQueuedCompletionStatus+0x27
02 02d0ff8c 6b5e997a httpext!CDavWorkerThread::GetWorkCompletion+0x23
03 02d0ffb4 7c57438b httpext!CDavWorkerThread::ThreadDispatcher+0x30
04 02d0ffec 00000000 KERNEL32!BaseThreadStart+0x52




Thread ID: 28
System Thread ID: 6e0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made
# ChildEBP RetAddr
00 0320fe24 77d37ba7 ntdll!ZwReplyWaitReceivePortEx+0xb
01 0320ff74 77d37b4c RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0320ff78 77d35924 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0320ffa8 77d358d6 RPCRT4!BaseCachedThreadRoutine+0x4f
04 0320ffb4 7c57438b RPCRT4!ThreadStartRoutine+0x18
05 0320ffec 00000000 KERNEL32!BaseThreadStart+0x52

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating C:\iisstate\output\1232-1097594085.dmp - mini user dump

*****

Closing open log file C:\iisstate\output\IISState-1232.log



"Pat [MSFT]" <patfilot RemoveThis @online.microsoft.com> wrote in message
news:e2jxbr0pEHA.3708@TK2MSFTNGP10.phx.gbl...
 > The latest IISState can be obtained @ <a style='text-decoration: underline;' href="http://www.iisfaq.com/iisstate." target="_blank">www.iisfaq.com/iisstate.</a> It will
run
 > on Win2k.
 >
 > If you get a log, post it to the group and we can hopefully identify the
 > culprit.
 >
 >
 > Pat
 >
 > "Nicolas" <fpnmml RemoveThis @free.fr> wrote in message
 > news:415c2bbe$0$5448$4d4eb98e@read.news.fr.uu.net...
  > >I have exactly the same problem since a few days on to IIS 5 servers.
  > > I have no clue what is happening. I think I changed nothing on the
  > > servers....
  > >
  > > "Adam Sayer" <Adam Sayer RemoveThis @discussions.microsoft.com> wrote in message
  > > news:5C1F7EDB-998B-43F2-A947-400D867A0075@microsoft.com...
   > >> We have the exact same problem with the IIS services terminating
   > >> regularly
  > > on
   > >> W2K SP4 with IIS5. The iisstate tool seems to be part of the IIS 6
  > > resource
   > >> kit. Will this run OK on IIS5 and if so what do I need to put on the
the
  > > IIS5
   > >> server for it to work, i.e do I just copy the iisstate.exe into a new
dir
  > > and
   > >> run it or are there dependent programs/DLLs that also need to be
  > > installed. I
   > >> would prefer not to install the IIS 6 resource kit on what is a
   > >> production
   > >> IIS5 front end web server. Your help would be very much appreciated.
   > >>
   > >> "Pat [MSFT]" wrote:
   > >>
   > >> > It means inetinfo.exe is crashing. You'll need to run IISState to
  > > identify
   > >> > the culprit:
   > >> >
   > >> > iisstate -p <pid of inetinfo> -sc <enter>
   > >> >
   > >> > You will then have to wait for the crash. When the crash occurs, a
log
  > > will
   > >> > be generated and you can post it to the group.
   > >> >
   > >> >
   > >> > Pat
   > >> >
   > >> > <anonymous RemoveThis @discussions.microsoft.com> wrote in message
   > >> > news:319d01c4a255$dbdb03a0$a601280a@phx.gbl...
   > >> > >I have IIS 5.0 running on Windows 2000 Advanced Server
   > >> > > Platform. Our server seems to be shutting down all by
   > >> > > itself. Here are the errors we are seeing:
   > >> > >
   > >> > > Event Type: Error
   > >> > > Event Source: Service Control Manager
   > >> > > Event ID: 7031
   > >> > > The FTP Publishing Service service terminated
   > >> > > unexpectedly. It has done this 1 time(s). The following
   > >> > > corrective action will be taken in 0 milliseconds: No
   > >> > > action.
   > >> > >
   > >> > > Event Type: Error
   > >> > > Event Source: Service Control Manager
   > >> > > Event ID: 7031
   > >> > > The World Wide Web Publishing Service service terminated
   > >> > > unexpectedly. It has done this 1 time(s). The following
   > >> > > corrective action will be taken in 0 milliseconds: No
   > >> > > action.
   > >> > >
   > >> > > Event Type: Error
   > >> > > Event Source: Service Control Manager
   > >> > > Event ID: 7031
   > >> > > The IIS Admin Service service terminated unexpectedly. It
   > >> > > has done this X time(s). The following corrective action
   > >> > > will be taken in 1 milliseconds: Run the configured
   > >> > > recovery program.
   > >> > >
   > >> > > Event Type: Dcom
   > >> > > Event Source: None
   > >> > > Event ID: 10005
   > >> > > DCOM got error "The service cannot be started, either
   > >> > > because it is disabled or because it has no enabled
   > >> > > devices associated with it. " attempting to start the
   > >> > > service AOLAgent with arguments "-Service" in order to
   > >> > > run the server:
   > >> > > {29239950-7241-11D2-999B-00A0C932EE54}
   > >> > >
   > >> > > These errors occour almost every 10 - 15 minutes.
   > >> > >
   > >> > > Another error is
   > >> > > Event Type: IISCTLS
   > >> > > Event Source: None
   > >> > > Event ID: 4
   > >> > > IIS kill command received from user NT AUTHORITY\SYSTEM.
   > >> > > The logged data is the status code.
   > >> > >
   > >> > > All the information I can find is pointing to code red
   > >> > > virus. The servers have been patched and no viruses were
   > >> > > detected by our virus scanner.
   > >> > >
   > >> > > Any help is appreciated
   > >> > >
   > >> >
   > >> >
   > >> >
  > >
  > >
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: IIS terminated unexpectedly