App Pool crash - 8007006d

Our production server has recently started experiencing AppPool crashes.
These seem to occur sporadically. sometimes three times a day, sometimes not
for a couple of days.
The error manifests itself to the client as "Service Unavailable".
In the system event log we see the following:
A process serving application pool 'DefaultAppPool' suffered a fatal
communication error with the World Wide Web Publishing Service
With error number: 8007006d

At the same time (but not always) we see this error in the Application Log
"Faulting application w3wp.exe, version 6.0.3790.0, faulting module
kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"

The application does usually start working again after anywhere between 2
and 15 minutes (although no worker process restarts or recycles appear in
our perf logs).

This problems seems to have started occuring following the latest MS patches
being applied to our server. It may just be a coincidence though.

We are running Windows Server 2003 Standard. We are about to apply SP1 in an
attempt to solve this problem, but I wanted to find out if anyone else has
had this problem and what the solution was. I have seen several similarish
posts but nothing concrete as a solution.

I have seen this article
(http://support.microsoft.com/Default.aspx?id=885654) but it doesn't quite
match our situation as we are not running as a domain controller. We haven't
yet tried running registry monitor as I wanted to find out if error
8007006d always equates to a registry permission problem?? before installing
3rd party freeware onto our production server.

Any help is much appreciated

Regards
Ian

Re: App Pool crash - 8007006d

Run IISState in crash mode against w3wp.exe and post the log. It could be
any number of things (a bug in MS stuff, a bug in an app, etc.).

iisstate -p -sc


Pat


"Ian Cox" wrote in message
news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> Our production server has recently started experiencing AppPool crashes.
> These seem to occur sporadically. sometimes three times a day, sometimes
> not
> for a couple of days.
> The error manifests itself to the client as "Service Unavailable".
> In the system event log we see the following:
> A process serving application pool 'DefaultAppPool' suffered a fatal
> communication error with the World Wide Web Publishing Service
> With error number: 8007006d
>
> At the same time (but not always) we see this error in the Application Log
> "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
>
> The application does usually start working again after anywhere between 2
> and 15 minutes (although no worker process restarts or recycles appear in
> our perf logs).
>
> This problems seems to have started occuring following the latest MS
> patches
> being applied to our server. It may just be a coincidence though.
>
> We are running Windows Server 2003 Standard. We are about to apply SP1 in
> an
> attempt to solve this problem, but I wanted to find out if anyone else has
> had this problem and what the solution was. I have seen several similarish
> posts but nothing concrete as a solution.
>
> I have seen this article
> (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't quite
> match our situation as we are not running as a domain controller. We
> haven't
> yet tried running registry monitor as I wanted to find out if error
> 8007006d always equates to a registry permission problem?? before
> installing
> 3rd party freeware onto our production server.
>
> Any help is much appreciated
>
> Regards
> Ian
>
>
>
>
>
>
>

Re: App Pool crash - 8007006d

Thanks Pat. I'll try it out and let you know the results

Regards
Ian

"Pat [MSFT]" wrote in message
news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> Run IISState in crash mode against w3wp.exe and post the log. It could be
> any number of things (a bug in MS stuff, a bug in an app, etc.).
>
> iisstate -p -sc
>
>
> Pat
>
>
> "Ian Cox" wrote in message
> news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > Our production server has recently started experiencing AppPool crashes.
> > These seem to occur sporadically. sometimes three times a day, sometimes
> > not
> > for a couple of days.
> > The error manifests itself to the client as "Service Unavailable".
> > In the system event log we see the following:
> > A process serving application pool 'DefaultAppPool' suffered a fatal
> > communication error with the World Wide Web Publishing Service
> > With error number: 8007006d
> >
> > At the same time (but not always) we see this error in the Application
Log
> > "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> >
> > The application does usually start working again after anywhere between
2
> > and 15 minutes (although no worker process restarts or recycles appear
in
> > our perf logs).
> >
> > This problems seems to have started occuring following the latest MS
> > patches
> > being applied to our server. It may just be a coincidence though.
> >
> > We are running Windows Server 2003 Standard. We are about to apply SP1
in
> > an
> > attempt to solve this problem, but I wanted to find out if anyone else
has
> > had this problem and what the solution was. I have seen several
similarish
> > posts but nothing concrete as a solution.
> >
> > I have seen this article
> > (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't
quite
> > match our situation as we are not running as a domain controller. We
> > haven't
> > yet tried running registry monitor as I wanted to find out if error
> > 8007006d always equates to a registry permission problem?? before
> > installing
> > 3rd party freeware onto our production server.
> >
> > Any help is much appreciated
> >
> > Regards
> > Ian
> >
> >
> >
> >
> >
> >
> >
>
>

Re: App Pool crash - 8007006d

Your plight motivated me to jot some thoughts down... you're already going
down the right path; the blog entry is just to pull everything together into
perspective and give the "why" and "howto".

http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Ian Cox" wrote in message
news:umQLOBlqFHA.3444@TK2MSFTNGP12.phx.gbl...
Thanks Pat. I'll try it out and let you know the results

Regards
Ian

"Pat [MSFT]" wrote in message
news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> Run IISState in crash mode against w3wp.exe and post the log. It could be
> any number of things (a bug in MS stuff, a bug in an app, etc.).
>
> iisstate -p -sc
>
>
> Pat
>
>
> "Ian Cox" wrote in message
> news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > Our production server has recently started experiencing AppPool crashes.
> > These seem to occur sporadically. sometimes three times a day, sometimes
> > not
> > for a couple of days.
> > The error manifests itself to the client as "Service Unavailable".
> > In the system event log we see the following:
> > A process serving application pool 'DefaultAppPool' suffered a fatal
> > communication error with the World Wide Web Publishing Service
> > With error number: 8007006d
> >
> > At the same time (but not always) we see this error in the Application
Log
> > "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> >
> > The application does usually start working again after anywhere between
2
> > and 15 minutes (although no worker process restarts or recycles appear
in
> > our perf logs).
> >
> > This problems seems to have started occuring following the latest MS
> > patches
> > being applied to our server. It may just be a coincidence though.
> >
> > We are running Windows Server 2003 Standard. We are about to apply SP1
in
> > an
> > attempt to solve this problem, but I wanted to find out if anyone else
has
> > had this problem and what the solution was. I have seen several
similarish
> > posts but nothing concrete as a solution.
> >
> > I have seen this article
> > (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't
quite
> > match our situation as we are not running as a domain controller. We
> > haven't
> > yet tried running registry monitor as I wanted to find out if error
> > 8007006d always equates to a registry permission problem?? before
> > installing
> > 3rd party freeware onto our production server.
> >
> > Any help is much appreciated
> >
> > Regards
> > Ian
> >
> >
> >
> >
> >
> >
> >
>
>

Re: App Pool crash - 8007006d

Thanks for that great blog entry David. Very useful


"David Wang [Msft]" wrote in message
news:Occi9FIrFHA.3736@TK2MSFTNGP10.phx.gbl...
> Your plight motivated me to jot some thoughts down... you're already going
> down the right path; the blog entry is just to pull everything together
into
> perspective and give the "why" and "howto".
>
>
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Ian Cox" wrote in message
> news:umQLOBlqFHA.3444@TK2MSFTNGP12.phx.gbl...
> Thanks Pat. I'll try it out and let you know the results
>
> Regards
> Ian
>
> "Pat [MSFT]" wrote in message
> news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> > Run IISState in crash mode against w3wp.exe and post the log. It could
be
> > any number of things (a bug in MS stuff, a bug in an app, etc.).
> >
> > iisstate -p -sc
> >
> >
> > Pat
> >
> >
> > "Ian Cox" wrote in message
> > news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > > Our production server has recently started experiencing AppPool
crashes.
> > > These seem to occur sporadically. sometimes three times a day,
sometimes
> > > not
> > > for a couple of days.
> > > The error manifests itself to the client as "Service Unavailable".
> > > In the system event log we see the following:
> > > A process serving application pool 'DefaultAppPool' suffered a fatal
> > > communication error with the World Wide Web Publishing Service
> > > With error number: 8007006d
> > >
> > > At the same time (but not always) we see this error in the Application
> Log
> > > "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> > > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> > >
> > > The application does usually start working again after anywhere
between
> 2
> > > and 15 minutes (although no worker process restarts or recycles appear
> in
> > > our perf logs).
> > >
> > > This problems seems to have started occuring following the latest MS
> > > patches
> > > being applied to our server. It may just be a coincidence though.
> > >
> > > We are running Windows Server 2003 Standard. We are about to apply SP1
> in
> > > an
> > > attempt to solve this problem, but I wanted to find out if anyone else
> has
> > > had this problem and what the solution was. I have seen several
> similarish
> > > posts but nothing concrete as a solution.
> > >
> > > I have seen this article
> > > (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't
> quite
> > > match our situation as we are not running as a domain controller. We
> > > haven't
> > > yet tried running registry monitor as I wanted to find out if error
> > > 8007006d always equates to a registry permission problem?? before
> > > installing
> > > 3rd party freeware onto our production server.
> > >
> > > Any help is much appreciated
> > >
> > > Regards
> > > Ian
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
>
>
>

Re: App Pool crash - 8007006d

Okay we tried Win 2K3 Sp1. That didn't help.
I tried running IIS state but it seems to pick up a soft crash everytime I
run it when in fact the problems we have been having only happen once or
twice a day. Unless there is some ongoing issue that it is recovering from
most of the time...

Also when IISstate detects this soft crash it kills the IIS process when it
finishes. Is this normal?

Anyway here is my IIS State log file, if any one can make sense of it that
would be much appreciated
******
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Sep 01 19:02:54 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed:




Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:1.640
User Time: 0:0:30.343
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 01a4eb64 02d0830f 0x2f701c5
01 01a4f79c 02dfe27c 0x2d0830f
02 01a4f808 02c014a7 0x2dfe27c
03 01a4f844 02c00f13 0x2c014a7
04 01a4f8a0 023cf792 0x2c00f13
05 01a4f8ec 023cf663 0x23cf792
06 01a4f944 020f9938 0x23cf663
07 01a4f9d4 7923c206 0x20f9938
08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
0b 01a4fba8 0218e928 0x1afa179
0c 0218e928 00000001 0x218e928
Closing open log file D:\program files\iisstate\output\IISState-3420.log
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Sep 01 19:02:54 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: cd4
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23




Thread ID: 1
System Thread ID: dc4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 2
System Thread ID: c80
Kernel Time: 0:0:0.156
User Time: 0:0:0.171
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 3
System Thread ID: c14
Kernel Time: 0:0:0.265
User Time: 0:0:0.250
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00cdffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 4
System Thread ID: 91c
Kernel Time: 0:0:0.500
User Time: 0:0:0.406
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 5
System Thread ID: ca0
Kernel Time: 0:0:0.359
User Time: 0:0:0.390
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 6
System Thread ID: 5b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 7
System Thread ID: 658
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 8
System Thread ID: 80c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
03 0186ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 9
System Thread ID: da8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
02 0196febc 77e424b7 kernel32!SleepEx+0x68
03 0196fecc 791bf4f9 kernel32!Sleep+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
05 0196ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:1.531
User Time: 0:0:27.500
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 019efd78 7c822124 ntdll!KiFastSystemCallRet
01 019efd7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 019efdec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 019efe00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 019efe24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 019effb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 019effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:1.640
User Time: 0:0:30.343
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 01a4eb64 02d0830f 0x2f701c5
01 01a4f79c 02dfe27c 0x2d0830f
02 01a4f808 02c014a7 0x2dfe27c
03 01a4f844 02c00f13 0x2c014a7
04 01a4f8a0 023cf792 0x2c00f13
05 01a4f8ec 023cf663 0x23cf792
06 01a4f944 020f9938 0x23cf663
07 01a4f9d4 7923c206 0x20f9938
08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
0b 01a4fba8 0218e928 0x1afa179
0c 0218e928 00000001 0x218e928




Thread ID: 12
System Thread ID: d54
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 13
System Thread ID: 818
Kernel Time: 0:0:0.78
User Time: 0:0:10.140
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01dfffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 14
System Thread ID: 2a8
Kernel Time: 0:0:0.78
User Time: 0:0:12.203
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 15
System Thread ID: 8e0
Kernel Time: 0:0:0.46
User Time: 0:0:10.796
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 16
System Thread ID: 740
Kernel Time: 0:0:0.46
User Time: 0:0:8.125
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01ebffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 17
System Thread ID: eec
Kernel Time: 0:0:0.0
User Time: 0:0:0.421
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
07 01efffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 18
System Thread ID: 8f0
Kernel Time: 0:0:1.703
User Time: 0:0:32.312
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0201ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 19
System Thread ID: ed0
Kernel Time: 0:0:2.109
User Time: 0:0:30.968
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0209ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 20
System Thread ID: 430
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 022dff38 7c821364 ntdll!KiFastSystemCallRet
01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
02 022dffa4 791cc578 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578




Thread ID: 21
System Thread ID: 238
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
06 030bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 22
System Thread ID: fd8
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
02 0313fac0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0313fb68 791b3208 0x1b2bce6
06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0313fdb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 23
System Thread ID: d4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0325f9d4 7c821364 ntdll!KiFastSystemCallRet
01 0325f9d8 77e42439 ntdll!NtDelayExecution+0xc
02 0325fa40 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0325fa60 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0325fa70 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0325fae8 791b3208 0x1b2bce6
06 0325faf0 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0325fc00 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0325fcbc 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0325fce4 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0325fd30 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0325fd78 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0325fe24 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0325ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0325ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 24
System Thread ID: a94
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0375ffb8 77e66063 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
04 0375ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 25
System Thread ID: 418
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
00 039cff14 7739c78d ntdll!KiFastSystemCallRet
01 039cff34 77694fed USER32!NtUserGetMessage+0xc
02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
07 039cffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 26
System Thread ID: fcc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
06 03ffffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 27
System Thread ID: 32c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
05 040fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 28
System Thread ID: e78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 009aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 009affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 009affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 29
System Thread ID: d6c
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 096bff7c 7c821bf4 ntdll!KiFastSystemCallRet
01 096bff80 71b23eb4 ntdll!NtRemoveIoCompletion+0xc
02 096bffb8 77e66063 mswsock!SockAsyncThread+0x69
03 096bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 30
System Thread ID: b7c
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 03f3ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 03f3ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03f3ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 03f3ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 03f3ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 03f3ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 03f3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 31
System Thread ID: 820
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0921fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0921fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0921ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0921ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0921ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0921ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0921ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 32
System Thread ID: 6cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 33
System Thread ID: f90
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 040af954 7c821364 ntdll!KiFastSystemCallRet
01 040af958 77e42439 ntdll!NtDelayExecution+0xc
02 040af9c0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 040af9e0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 040af9f0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 040afa68 791b3208 0x1b2bce6
06 040afa70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 040afb80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 040afc3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 040afc64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 040afcb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 040afcf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 040afda4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 040affb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 040affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 34
System Thread ID: 9bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
05 0467ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 35
System Thread ID: 8b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
04 0965ffb0 79e78dca
aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
06 0965ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 36
System Thread ID: f10
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
06 0d9effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 37
System Thread ID: 84c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 38
System Thread ID: 84c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 39
System Thread ID: e60
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 093affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 40
System Thread ID: e60
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 093affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 41
System Thread ID: de4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 092affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 42
System Thread ID: de4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 092affec 00000000 kernel32!BaseThreadStart+0x34

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating D:\program files\iisstate\output\3420-1125594198.dmp - mini user
dump

*****

Closing open log file D:\program files\iisstate\output\IISState-3420.log


*****

Thanks in advance for any help

"Ian Cox" wrote in message
news:OyNygfVrFHA.1032@TK2MSFTNGP12.phx.gbl...
> Thanks for that great blog entry David. Very useful
>
>
> "David Wang [Msft]" wrote in message
> news:Occi9FIrFHA.3736@TK2MSFTNGP10.phx.gbl...
> > Your plight motivated me to jot some thoughts down... you're already
going
> > down the right path; the blog entry is just to pull everything together
> into
> > perspective and give the "why" and "howto".
> >
> >
>
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx
> >
> > --
> > //David
> > IIS
> > http://blogs.msdn.com/David.Wang
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > //
> > "Ian Cox" wrote in message
> > news:umQLOBlqFHA.3444@TK2MSFTNGP12.phx.gbl...
> > Thanks Pat. I'll try it out and let you know the results
> >
> > Regards
> > Ian
> >
> > "Pat [MSFT]" wrote in message
> > news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> > > Run IISState in crash mode against w3wp.exe and post the log. It
could
> be
> > > any number of things (a bug in MS stuff, a bug in an app, etc.).
> > >
> > > iisstate -p -sc
> > >
> > >
> > > Pat
> > >
> > >
> > > "Ian Cox" wrote in message
> > > news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > > > Our production server has recently started experiencing AppPool
> crashes.
> > > > These seem to occur sporadically. sometimes three times a day,
> sometimes
> > > > not
> > > > for a couple of days.
> > > > The error manifests itself to the client as "Service Unavailable".
> > > > In the system event log we see the following:
> > > > A process serving application pool 'DefaultAppPool' suffered a fatal
> > > > communication error with the World Wide Web Publishing Service
> > > > With error number: 8007006d
> > > >
> > > > At the same time (but not always) we see this error in the
Application
> > Log
> > > > "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> > > > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> > > >
> > > > The application does usually start working again after anywhere
> between
> > 2
> > > > and 15 minutes (although no worker process restarts or recycles
appear
> > in
> > > > our perf logs).
> > > >
> > > > This problems seems to have started occuring following the latest MS
> > > > patches
> > > > being applied to our server. It may just be a coincidence though.
> > > >
> > > > We are running Windows Server 2003 Standard. We are about to apply
SP1
> > in
> > > > an
> > > > attempt to solve this problem, but I wanted to find out if anyone
else
> > has
> > > > had this problem and what the solution was. I have seen several
> > similarish
> > > > posts but nothing concrete as a solution.
> > > >
> > > > I have seen this article
> > > > (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't
> > quite
> > > > match our situation as we are not running as a domain controller. We
> > > > haven't
> > > > yet tried running registry monitor as I wanted to find out if error
> > > > 8007006d always equates to a registry permission problem?? before
> > > > installing
> > > > 3rd party freeware onto our production server.
> > > >
> > > > Any help is much appreciated
> > > >
> > > > Regards
> > > > Ian
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
>
>

Re: App Pool crash - 8007006d

Hey, didn't I suggest in the blog entry to NOT try to install random
patches/service-packs or make configuration changes to fix a crash? :-) You
need to catch the crash and identify it first, then determine whether a
patch/service-pack, config change, etc can address the issue.

You want to wait for real crashes. Not whatever you are catching right now

When dealing with a crash, you just wants the log file and stack trace.
Everything else in the process is pretty much toast since data corruption
could have happened on the exceptional event (like a crash) and you
certainly do not want to continue working with known data corruption.

It is much the same rationale for BSOD. Windows rather BSOD when a bad thing
happens in kernel mode than attempt to continue run, possibly causing other
data corruption (especially to the network or filesystem...).

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Ian Cox" wrote in message
news:%23HhI5gxrFHA.2880@TK2MSFTNGP12.phx.gbl...
Okay we tried Win 2K3 Sp1. That didn't help.
I tried running IIS state but it seems to pick up a soft crash everytime I
run it when in fact the problems we have been having only happen once or
twice a day. Unless there is some ongoing issue that it is recovering from
most of the time...

Also when IISstate detects this soft crash it kills the IIS process when it
finishes. Is this normal?

Anyway here is my IIS State log file, if any one can make sense of it that
would be much appreciated
******
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Sep 01 19:02:54 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed:




Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:1.640
User Time: 0:0:30.343
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 01a4eb64 02d0830f 0x2f701c5
01 01a4f79c 02dfe27c 0x2d0830f
02 01a4f808 02c014a7 0x2dfe27c
03 01a4f844 02c00f13 0x2c014a7
04 01a4f8a0 023cf792 0x2c00f13
05 01a4f8ec 023cf663 0x23cf792
06 01a4f944 020f9938 0x23cf663
07 01a4f9d4 7923c206 0x20f9938
08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
0b 01a4fba8 0218e928 0x1afa179
0c 0218e928 00000001 0x218e928
Closing open log file D:\program files\iisstate\output\IISState-3420.log
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Thu Sep 01 19:02:54 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: cd4
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23




Thread ID: 1
System Thread ID: dc4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 2
System Thread ID: c80
Kernel Time: 0:0:0.156
User Time: 0:0:0.171
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 3
System Thread ID: c14
Kernel Time: 0:0:0.265
User Time: 0:0:0.250
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00cdffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 4
System Thread ID: 91c
Kernel Time: 0:0:0.500
User Time: 0:0:0.406
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 5
System Thread ID: ca0
Kernel Time: 0:0:0.359
User Time: 0:0:0.390
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 6
System Thread ID: 5b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 7
System Thread ID: 658
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 8
System Thread ID: 80c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
03 0186ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 9
System Thread ID: da8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
02 0196febc 77e424b7 kernel32!SleepEx+0x68
03 0196fecc 791bf4f9 kernel32!Sleep+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
05 0196ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:1.531
User Time: 0:0:27.500
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 019efd78 7c822124 ntdll!KiFastSystemCallRet
01 019efd7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 019efdec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 019efe00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 019efe24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 019effb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 019effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:1.640
User Time: 0:0:30.343
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 01a4eb64 02d0830f 0x2f701c5
01 01a4f79c 02dfe27c 0x2d0830f
02 01a4f808 02c014a7 0x2dfe27c
03 01a4f844 02c00f13 0x2c014a7
04 01a4f8a0 023cf792 0x2c00f13
05 01a4f8ec 023cf663 0x23cf792
06 01a4f944 020f9938 0x23cf663
07 01a4f9d4 7923c206 0x20f9938
08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
0b 01a4fba8 0218e928 0x1afa179
0c 0218e928 00000001 0x218e928




Thread ID: 12
System Thread ID: d54
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 13
System Thread ID: 818
Kernel Time: 0:0:0.78
User Time: 0:0:10.140
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01dfffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 14
System Thread ID: 2a8
Kernel Time: 0:0:0.78
User Time: 0:0:12.203
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 15
System Thread ID: 8e0
Kernel Time: 0:0:0.46
User Time: 0:0:10.796
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 16
System Thread ID: 740
Kernel Time: 0:0:0.46
User Time: 0:0:8.125
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01ebffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 17
System Thread ID: eec
Kernel Time: 0:0:0.0
User Time: 0:0:0.421
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
07 01efffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 18
System Thread ID: 8f0
Kernel Time: 0:0:1.703
User Time: 0:0:32.312
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0201ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 19
System Thread ID: ed0
Kernel Time: 0:0:2.109
User Time: 0:0:30.968
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0209ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 20
System Thread ID: 430
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 022dff38 7c821364 ntdll!KiFastSystemCallRet
01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
02 022dffa4 791cc578 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578




Thread ID: 21
System Thread ID: 238
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
06 030bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 22
System Thread ID: fd8
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
02 0313fac0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0313fb68 791b3208 0x1b2bce6
06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0313fdb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 23
System Thread ID: d4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0325f9d4 7c821364 ntdll!KiFastSystemCallRet
01 0325f9d8 77e42439 ntdll!NtDelayExecution+0xc
02 0325fa40 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0325fa60 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0325fa70 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0325fae8 791b3208 0x1b2bce6
06 0325faf0 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0325fc00 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0325fcbc 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0325fce4 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0325fd30 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0325fd78 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0325fe24 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0325ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0325ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 24
System Thread ID: a94
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0375ffb8 77e66063 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
04 0375ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 25
System Thread ID: 418
Kernel Time: 0:0:0.0
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
00 039cff14 7739c78d ntdll!KiFastSystemCallRet
01 039cff34 77694fed USER32!NtUserGetMessage+0xc
02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
07 039cffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 26
System Thread ID: fcc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
06 03ffffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 27
System Thread ID: 32c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
05 040fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 28
System Thread ID: e78
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 009aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 009affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 009affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 29
System Thread ID: d6c
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 096bff7c 7c821bf4 ntdll!KiFastSystemCallRet
01 096bff80 71b23eb4 ntdll!NtRemoveIoCompletion+0xc
02 096bffb8 77e66063 mswsock!SockAsyncThread+0x69
03 096bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 30
System Thread ID: b7c
Kernel Time: 0:0:0.15
User Time: 0:0:0.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 03f3ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 03f3ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03f3ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 03f3ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 03f3ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 03f3ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 03f3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 31
System Thread ID: 820
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0921fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0921fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0921ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0921ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0921ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0921ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0921ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 32
System Thread ID: 6cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 33
System Thread ID: f90
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 040af954 7c821364 ntdll!KiFastSystemCallRet
01 040af958 77e42439 ntdll!NtDelayExecution+0xc
02 040af9c0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 040af9e0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 040af9f0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 040afa68 791b3208 0x1b2bce6
06 040afa70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 040afb80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 040afc3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 040afc64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 040afcb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 040afcf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 040afda4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 040affb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 040affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 34
System Thread ID: 9bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
05 0467ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 35
System Thread ID: 8b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
04 0965ffb0 79e78dca
aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
06 0965ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 36
System Thread ID: f10
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
06 0d9effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 37
System Thread ID: 84c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 38
System Thread ID: 84c
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 39
System Thread ID: e60
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 093affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 40
System Thread ID: e60
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 093affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 41
System Thread ID: de4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 092affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 42
System Thread ID: de4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 092affec 00000000 kernel32!BaseThreadStart+0x34

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating D:\program files\iisstate\output\3420-1125594198.dmp - mini user
dump

*****

Closing open log file D:\program files\iisstate\output\IISState-3420.log


*****

Thanks in advance for any help

"Ian Cox" wrote in message
news:OyNygfVrFHA.1032@TK2MSFTNGP12.phx.gbl...
> Thanks for that great blog entry David. Very useful
>
>
> "David Wang [Msft]" wrote in message
> news:Occi9FIrFHA.3736@TK2MSFTNGP10.phx.gbl...
> > Your plight motivated me to jot some thoughts down... you're already
going
> > down the right path; the blog entry is just to pull everything together
> into
> > perspective and give the "why" and "howto".
> >
> >
>
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx
> >
> > --
> > //David
> > IIS
> > http://blogs.msdn.com/David.Wang
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > //
> > "Ian Cox" wrote in message
> > news:umQLOBlqFHA.3444@TK2MSFTNGP12.phx.gbl...
> > Thanks Pat. I'll try it out and let you know the results
> >
> > Regards
> > Ian
> >
> > "Pat [MSFT]" wrote in message
> > news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> > > Run IISState in crash mode against w3wp.exe and post the log. It
could
> be
> > > any number of things (a bug in MS stuff, a bug in an app, etc.).
> > >
> > > iisstate -p -sc
> > >
> > >
> > > Pat
> > >
> > >
> > > "Ian Cox" wrote in message
> > > news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > > > Our production server has recently started experiencing AppPool
> crashes.
> > > > These seem to occur sporadically. sometimes three times a day,
> sometimes
> > > > not
> > > > for a couple of days.
> > > > The error manifests itself to the client as "Service Unavailable".
> > > > In the system event log we see the following:
> > > > A process serving application pool 'DefaultAppPool' suffered a fatal
> > > > communication error with the World Wide Web Publishing Service
> > > > With error number: 8007006d
> > > >
> > > > At the same time (but not always) we see this error in the
Application
> > Log
> > > > "Faulting application w3wp.exe, version 6.0.3790.0, faulting module
> > > > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> > > >
> > > > The application does usually start working again after anywhere
> between
> > 2
> > > > and 15 minutes (although no worker process restarts or recycles
appear
> > in
> > > > our perf logs).
> > > >
> > > > This problems seems to have started occuring following the latest MS
> > > > patches
> > > > being applied to our server. It may just be a coincidence though.
> > > >
> > > > We are running Windows Server 2003 Standard. We are about to apply
SP1
> > in
> > > > an
> > > > attempt to solve this problem, but I wanted to find out if anyone
else
> > has
> > > > had this problem and what the solution was. I have seen several
> > similarish
> > > > posts but nothing concrete as a solution.
> > > >
> > > > I have seen this article
> > > > (http://support.microsoft.com/Default.aspx?id=885654) but it doesn't
> > quite
> > > > match our situation as we are not running as a domain controller. We
> > > > haven't
> > > > yet tried running registry monitor as I wanted to find out if error
> > > > 8007006d always equates to a registry permission problem?? before
> > > > installing
> > > > 3rd party freeware onto our production server.
> > > >
> > > > Any help is much appreciated
> > > >
> > > > Regards
> > > > Ian
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
>
>

Re: App Pool crash - 8007006d

I know you suggested that. Unfortunately, by that point we had already
arranged the service pack install and downtime as well as testing it out on
our test servers, so we were fairly committed.

The problem is that when ever I run IISState (e.g. IISState -p 1234 -sc -d)
it dumps out whatever I sent you and then exits.
Am I doing something wrong? The other problem is that when it does this it
takes out my w3wp process which obviously the users notice.

Your help is much appreciated

Ian

"David Wang [Msft]" wrote in message
news:udlezS5rFHA.2768@TK2MSFTNGP12.phx.gbl...
> Hey, didn't I suggest in the blog entry to NOT try to install random
> patches/service-packs or make configuration changes to fix a crash? :-)
You
> need to catch the crash and identify it first, then determine whether a
> patch/service-pack, config change, etc can address the issue.
>
> You want to wait for real crashes. Not whatever you are catching right now
>
> When dealing with a crash, you just wants the log file and stack trace.
> Everything else in the process is pretty much toast since data corruption
> could have happened on the exceptional event (like a crash) and you
> certainly do not want to continue working with known data corruption.
>
> It is much the same rationale for BSOD. Windows rather BSOD when a bad
thing
> happens in kernel mode than attempt to continue run, possibly causing
other
> data corruption (especially to the network or filesystem...).
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Ian Cox" wrote in message
> news:%23HhI5gxrFHA.2880@TK2MSFTNGP12.phx.gbl...
> Okay we tried Win 2K3 Sp1. That didn't help.
> I tried running IIS state but it seems to pick up a soft crash everytime I
> run it when in fact the problems we have been having only happen once or
> twice a day. Unless there is some ongoing issue that it is recovering from
> most of the time...
>
> Also when IISstate detects this soft crash it kills the IIS process when
it
> finishes. Is this normal?
>
> Anyway here is my IIS State log file, if any one can make sense of it that
> would be much appreciated
> ******
> Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Thu Sep 01 19:02:54 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 3420
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> DLL (!FunctionName) that failed:
>
>
>
>
> Thread ID: 11
> System Thread ID: bf4
> Kernel Time: 0:0:1.640
> User Time: 0:0:30.343
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
for
> C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 00 01a4eb64 02d0830f 0x2f701c5
> 01 01a4f79c 02dfe27c 0x2d0830f
> 02 01a4f808 02c014a7 0x2dfe27c
> 03 01a4f844 02c00f13 0x2c014a7
> 04 01a4f8a0 023cf792 0x2c00f13
> 05 01a4f8ec 023cf663 0x23cf792
> 06 01a4f944 020f9938 0x23cf663
> 07 01a4f9d4 7923c206 0x20f9938
> 08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
> 09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
> 0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
> 0b 01a4fba8 0218e928 0x1afa179
> 0c 0218e928 00000001 0x218e928
> Closing open log file D:\program files\iisstate\output\IISState-3420.log
> Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Thu Sep 01 19:02:54 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 3420
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: cd4
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.31
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
> 01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
> 04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
> 05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
> 06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
> 07 0006ff0c 0100187c w3core!UlW3Start+0x26e
> 08 0006ff44 01001a23 w3wp!wmain+0x22a
> 09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
> 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>
>
>
>
> Thread ID: 1
> System Thread ID: dc4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
> 01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
> 02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
> 03 009effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 2
> System Thread ID: c80
> Kernel Time: 0:0:0.156
> User Time: 0:0:0.171
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 3
> System Thread ID: c14
> Kernel Time: 0:0:0.265
> User Time: 0:0:0.250
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00cdffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 4
> System Thread ID: 91c
> Kernel Time: 0:0:0.500
> User Time: 0:0:0.406
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 5
> System Thread ID: ca0
> Kernel Time: 0:0:0.359
> User Time: 0:0:0.390
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 6
> System Thread ID: 5b0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
> 01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
> 02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
> 03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 7
> System Thread ID: 658
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 017efa84 7c822124 ntdll!KiFastSystemCallRet
> 01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
> 04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
> 05 017effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 8
> System Thread ID: 80c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
> 01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
> 02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
> 03 0186ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 9
> System Thread ID: da8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
> 01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
> 02 0196febc 77e424b7 kernel32!SleepEx+0x68
> 03 0196fecc 791bf4f9 kernel32!Sleep+0xf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
> 05 0196ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 10
> System Thread ID: fe0
> Kernel Time: 0:0:1.531
> User Time: 0:0:27.500
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 019efd78 7c822124 ntdll!KiFastSystemCallRet
> 01 019efd7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 019efdec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 019efe00 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 019efe24 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 019effb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 019effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 11
> System Thread ID: bf4
> Kernel Time: 0:0:1.640
> User Time: 0:0:30.343
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 00 01a4eb64 02d0830f 0x2f701c5
> 01 01a4f79c 02dfe27c 0x2d0830f
> 02 01a4f808 02c014a7 0x2dfe27c
> 03 01a4f844 02c00f13 0x2c014a7
> 04 01a4f8a0 023cf792 0x2c00f13
> 05 01a4f8ec 023cf663 0x23cf792
> 06 01a4f944 020f9938 0x23cf663
> 07 01a4f9d4 7923c206 0x20f9938
> 08 01a4fa14 791cc3c8 mscorsvr!CoUninitializeEE+0xcc3
> 09 01a4fa5c 7923c1c3 mscorsvr!Ordinal76+0x1c3c8
> 0a 01a4fac4 01afa179 mscorsvr!CoUninitializeEE+0xc80
> 0b 01a4fba8 0218e928 0x1afa179
> 0c 0218e928 00000001 0x218e928
>
>
>
>
> Thread ID: 12
> System Thread ID: d54
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
> 01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
> 05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
> 06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 13
> System Thread ID: 818
> Kernel Time: 0:0:0.78
> User Time: 0:0:10.140
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
> 01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01dfffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 14
> System Thread ID: 2a8
> Kernel Time: 0:0:0.78
> User Time: 0:0:12.203
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 15
> System Thread ID: 8e0
> Kernel Time: 0:0:0.46
> User Time: 0:0:10.796
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 16
> System Thread ID: 740
> Kernel Time: 0:0:0.46
> User Time: 0:0:8.125
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01ebffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 17
> System Thread ID: eec
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.421
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
> 01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
> 05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
> 06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 07 01efffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 18
> System Thread ID: 8f0
> Kernel Time: 0:0:1.703
> User Time: 0:0:32.312
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
> 01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 0201ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 19
> System Thread ID: ed0
> Kernel Time: 0:0:2.109
> User Time: 0:0:30.968
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
> 01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 0209ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 20
> System Thread ID: 430
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 022dff38 7c821364 ntdll!KiFastSystemCallRet
> 01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
> 02 022dffa4 791cc578 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578
>
>
>
>
> Thread ID: 21
> System Thread ID: 238
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
> 01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
> 05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
> 06 030bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 22
> System Thread ID: fd8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
> 01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
> 02 0313fac0 7920a823 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
> 04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
> 05 0313fb68 791b3208 0x1b2bce6
> 06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
> 07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
> 08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
> 09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
> 0a 0313fdb0 791cc3c8
mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
> 0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
> 0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
> 0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 23
> System Thread ID: d4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0325f9d4 7c821364 ntdll!KiFastSystemCallRet
> 01 0325f9d8 77e42439 ntdll!NtDelayExecution+0xc
> 02 0325fa40 7920a823 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 0325fa60 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
> 04 0325fa70 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
> 05 0325fae8 791b3208 0x1b2bce6
> 06 0325faf0 791b3ad7 mscorsvr!Ordinal76+0x3208
> 07 0325fc00 791d3ef0 mscorsvr!Ordinal76+0x3ad7
> 08 0325fcbc 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
> 09 0325fce4 7924b0d1 mscorsvr!GetCompileInfo+0x1497
> 0a 0325fd30 791cc3c8
mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
> 0b 0325fd78 7927b7de mscorsvr!Ordinal76+0x1c3c8
> 0c 0325fe24 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
> 0d 0325ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 0e 0325ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 24
> System Thread ID: a94
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
> 01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 0375ffb8 77e66063
mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
> 04 0375ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 25
> System Thread ID: 418
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.46
> Thread Type: Other
> # ChildEBP RetAddr
> 00 039cff14 7739c78d ntdll!KiFastSystemCallRet
> 01 039cff34 77694fed USER32!NtUserGetMessage+0xc
> 02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
> 03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
> 04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
> 05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
> 06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
> 07 039cffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 26
> System Thread ID: fcc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
> 01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
> 04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
> 05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
> 06 03ffffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 27
> System Thread ID: 32c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
> 01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
> 04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
> 05 040fffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 28
> System Thread ID: e78
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009aff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 009aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 009affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 009affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 29
> System Thread ID: d6c
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 096bff7c 7c821bf4 ntdll!KiFastSystemCallRet
> 01 096bff80 71b23eb4 ntdll!NtRemoveIoCompletion+0xc
> 02 096bffb8 77e66063 mswsock!SockAsyncThread+0x69
> 03 096bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 30
> System Thread ID: b7c
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 03f3ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 03f3ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 03f3ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 03f3ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 03f3ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 03f3ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 03f3ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 31
> System Thread ID: 820
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0921fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 0921fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 0921ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 0921ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 0921ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 0921ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 06 0921ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 32
> System Thread ID: 6cc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
> 01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> 04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 33
> System Thread ID: f90
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 040af954 7c821364 ntdll!KiFastSystemCallRet
> 01 040af958 77e42439 ntdll!NtDelayExecution+0xc
> 02 040af9c0 7920a823 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 040af9e0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
> 04 040af9f0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
> 05 040afa68 791b3208 0x1b2bce6
> 06 040afa70 791b3ad7 mscorsvr!Ordinal76+0x3208
> 07 040afb80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
> 08 040afc3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
> 09 040afc64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
> 0a 040afcb0 791cc3c8
mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
> 0b 040afcf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
> 0c 040afda4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
> 0d 040affb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 0e 040affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 34
> System Thread ID: 9bc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
> 01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
> 04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
> 05 0467ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 35
> System Thread ID: 8b4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
> 01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
> 04 0965ffb0 79e78dca
> aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
> 05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
> 06 0965ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 36
> System Thread ID: f10
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
> 01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
> 04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
> 05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
> 06 0d9effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 37
> System Thread ID: 84c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 38
> System Thread ID: 84c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0e47fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 0e47fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 0e47ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 0e47ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 0e47ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 0e47ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 06 0e47ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 39
> System Thread ID: e60
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
> 01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> 04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 05 093affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 40
> System Thread ID: e60
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 093af3c0 7c821bf4 ntdll!KiFastSystemCallRet
> 01 093af3c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 093af3f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 093af424 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> 04 093affb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 05 093affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 41
> System Thread ID: de4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 092affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 42
> System Thread ID: de4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 092aff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 092aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 092affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 092affec 00000000 kernel32!BaseThreadStart+0x34
>
> *****
>
> Dump name is formatted as: PID-Timestamp.dmp
>
> Creating D:\program files\iisstate\output\3420-1125594198.dmp - mini user
> dump
>
> *****
>
> Closing open log file D:\program files\iisstate\output\IISState-3420.log
>
>
> *****
>
> Thanks in advance for any help
>
> "Ian Cox" wrote in message
> news:OyNygfVrFHA.1032@TK2MSFTNGP12.phx.gbl...
> > Thanks for that great blog entry David. Very useful
> >
> >
> > "David Wang [Msft]" wrote in message
> > news:Occi9FIrFHA.3736@TK2MSFTNGP10.phx.gbl...
> > > Your plight motivated me to jot some thoughts down... you're already
> going
> > > down the right path; the blog entry is just to pull everything
together
> > into
> > > perspective and give the "why" and "howto".
> > >
> > >
> >
>
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Diagnose_an_AppPool_Crash.aspx
> > >
> > > --
> > > //David
> > > IIS
> > > http://blogs.msdn.com/David.Wang
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > //
> > > "Ian Cox" wrote in message
> > > news:umQLOBlqFHA.3444@TK2MSFTNGP12.phx.gbl...
> > > Thanks Pat. I'll try it out and let you know the results
> > >
> > > Regards
> > > Ian
> > >
> > > "Pat [MSFT]" wrote in message
> > > news:uniTO7kqFHA.2880@TK2MSFTNGP12.phx.gbl...
> > > > Run IISState in crash mode against w3wp.exe and post the log. It
> could
> > be
> > > > any number of things (a bug in MS stuff, a bug in an app, etc.).
> > > >
> > > > iisstate -p -sc
> > > >
> > > >
> > > > Pat
> > > >
> > > >
> > > > "Ian Cox" wrote in message
> > > > news:u6SH$wiqFHA.2480@TK2MSFTNGP10.phx.gbl...
> > > > > Our production server has recently started experiencing AppPool
> > crashes.
> > > > > These seem to occur sporadically. sometimes three times a day,
> > sometimes
> > > > > not
> > > > > for a couple of days.
> > > > > The error manifests itself to the client as "Service Unavailable".
> > > > > In the system event log we see the following:
> > > > > A process serving application pool 'DefaultAppPool' suffered a
fatal
> > > > > communication error with the World Wide Web Publishing Service
> > > > > With error number: 8007006d
> > > > >
> > > > > At the same time (but not always) we see this error in the
> Application
> > > Log
> > > > > "Faulting application w3wp.exe, version 6.0.3790.0, faulting
module
> > > > > kernel32.dll, version 5.2.3790.0, fault address 0x000249d3"
> > > > >
> > > > > The application does usually start working again after anywhere
> > between
> > > 2
> > > > > and 15 minutes (although no worker process restarts or recycles
> appear
> > > in
> > > > > our perf logs).
> > > > >
> > > > > This problems seems to have started occuring following the latest
MS
> > > > > patches
> > > > > being applied to our server. It may just be a coincidence though.
> > > > >
> > > > > We are running Windows Server 2003 Standard. We are about to apply
> SP1
> > > in
> > > > > an
> > > > > attempt to solve this problem, but I wanted to find out if anyone
> else
> > > has
> > > > > had this problem and what the solution was. I have seen several
> > > similarish
> > > > > posts but nothing concrete as a solution.
> > > > >
> > > > > I have seen this article
> > > > > (http://support.microsoft.com/Default.aspx?id=885654) but it
doesn't
> > > quite
> > > > > match our situation as we are not running as a domain controller.
We
> > > > > haven't
> > > > > yet tried running registry monitor as I wanted to find out if
error
> > > > > 8007006d always equates to a registry permission problem?? before
> > > > > installing
> > > > > 3rd party freeware onto our production server.
> > > > >
> > > > > Any help is much appreciated
> > > > >
> > > > > Regards
> > > > > Ian
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> > >
> >
> >
>
>
>

Re: App Pool crash - 8007006d

I guess I'm misunderstanding how IISState using the -sc switch works.
When ever I run it it catches an exception and quits

Anyway, we just had another incident and I was able to run IISState during
it.

Here is the log...hopefully its more useful than the last one

Your thoughts are muchly appreciated

****
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Fri Sep 02 18:27:05 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
*** WARNING: Unable to verify checksum for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
4e089_1e3d3e9e\mscorlib.dll
*** ERROR: Module load completed but symbols could not be loaded for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
4e089_1e3d3e9e\mscorlib.dll
DLL (!FunctionName) that failed: mscorlib_79990000




Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:9.875
User Time: 0:3:35.859
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
PDB symbol for mscorsvr.dll not loaded
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 10
ESP EIP
019edc38 79ad8e18 [DEFAULT] Class
System.Runtime.Remoting.Messaging.LogicalCallContext
System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
hread(Class System.Runtime.Remoting.Messaging.IMessage)
019edc44 79ad08da [DEFAULT] Void
System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT] I4
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
019ef92c 020f79f2 [DEFAULT] [hasThis] String
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
String,Class System.Web.Hosting.ServerVarCharBuffer)
019ef944 020f76c4 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
019ef990 020f7615 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequest.Initialize()
019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
019ef9d8 020f6457 [DEFAULT] [hasThis] I4
System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
019efaa0 79217188 [FRAME: ContextTransitionFrame]
019efb80 79217188 [FRAME: ComMethodFrame]


Begin System Thread Information

# ChildEBP RetAddr
00 00000001 00000000 mscorlib_79990000+0x148e18
Closing open log file D:\program files\iisstate\output\IISState-3420.log
Opened log file 'D:\program files\iisstate\output\IISState-3420.log'

***********************
Starting new log output
IISState version 3.3.1

Fri Sep 02 18:27:10 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 3420

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: cd4
Kernel Time: 0:0:0.15
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23




Thread ID: 1
System Thread ID: dc4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 2
System Thread ID: c80
Kernel Time: 0:0:2.421
User Time: 0:0:1.640
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 3
System Thread ID: c14
Kernel Time: 0:0:2.265
User Time: 0:0:1.578
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00cdffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 4
System Thread ID: 91c
Kernel Time: 0:0:1.859
User Time: 0:0:1.421
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 5
System Thread ID: ca0
Kernel Time: 0:0:1.984
User Time: 0:0:1.546
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 6
System Thread ID: 5b0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 7
System Thread ID: 658
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 8
System Thread ID: 80c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
03 0186ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 9
System Thread ID: da8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
02 0196febc 77e424b7 kernel32!SleepEx+0x68
03 0196fecc 791bf4f9 kernel32!Sleep+0xf
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
05 0196ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 10
System Thread ID: fe0
Kernel Time: 0:0:9.875
User Time: 0:3:35.859
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
Thread 10
ESP EIP
019edc38 79ad8e18 [DEFAULT] Class
System.Runtime.Remoting.Messaging.LogicalCallContext
System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
hread(Class System.Runtime.Remoting.Messaging.IMessage)
019edc44 79ad08da [DEFAULT] Void
System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT] I4
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
019ef92c 020f79f2 [DEFAULT] [hasThis] String
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
String,Class System.Web.Hosting.ServerVarCharBuffer)
019ef944 020f76c4 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
019ef990 020f7615 [DEFAULT] [hasThis] Void
System.Web.Hosting.ISAPIWorkerRequest.Initialize()
019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
019ef9d8 020f6457 [DEFAULT] [hasThis] I4
System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
019efaa0 79217188 [FRAME: ContextTransitionFrame]
019efb80 79217188 [FRAME: ComMethodFrame]


Begin System Thread Information

# ChildEBP RetAddr
00 00000001 00000000 mscorlib_79990000+0x148e18




Thread ID: 11
System Thread ID: bf4
Kernel Time: 0:0:10.343
User Time: 0:3:37.125
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01a4fcf8 7c822124 ntdll!KiFastSystemCallRet
01 01a4fcfc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01a4fd6c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01a4fd80 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01a4fda4 791fdacc mscorsvr!GetCompileInfo+0x1512
05 01a4ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 01a4ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 12
System Thread ID: d54
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 13
System Thread ID: 818
Kernel Time: 0:0:0.828
User Time: 0:1:11.218
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01dfffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 14
System Thread ID: 2a8
Kernel Time: 0:0:0.953
User Time: 0:1:16.687
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 15
System Thread ID: 8e0
Kernel Time: 0:0:1.187
User Time: 0:1:16.531
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 16
System Thread ID: 740
Kernel Time: 0:0:0.968
User Time: 0:1:3.390
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
06 01ebffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 17
System Thread ID: eec
Kernel Time: 0:0:0.15
User Time: 0:0:4.500
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
07 01efffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 18
System Thread ID: 8f0
Kernel Time: 0:0:10.859
User Time: 0:3:39.640
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0201ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 19
System Thread ID: ed0
Kernel Time: 0:0:10.796
User Time: 0:3:37.46
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0209ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 20
System Thread ID: 430
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 022dff38 7c821364 ntdll!KiFastSystemCallRet
01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
02 022dffa4 791cc578 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578




Thread ID: 21
System Thread ID: 238
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
06 030bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 22
System Thread ID: fd8
Kernel Time: 0:0:0.0
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
02 0313fac0 7920a823 kernel32!SleepEx+0x68
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
05 0313fb68 791b3208 0x1b2bce6
06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
0a 0313fdb0 791cc3c8 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 23
System Thread ID: a94
Kernel Time: 0:0:0.0
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 0375ffb8 77e66063 mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
04 0375ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 24
System Thread ID: 418
Kernel Time: 0:0:0.203
User Time: 0:0:0.250
Thread Type: Other
# ChildEBP RetAddr
00 039cff14 7739c78d ntdll!KiFastSystemCallRet
01 039cff34 77694fed USER32!NtUserGetMessage+0xc
02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
07 039cffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 25
System Thread ID: fcc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
06 03ffffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 26
System Thread ID: 32c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
05 040fffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 27
System Thread ID: 6cc
Kernel Time: 0:0:0.31
User Time: 0:0:0.218
Thread Type: Other
# ChildEBP RetAddr
00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 28
System Thread ID: 9bc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
05 0467ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 29
System Thread ID: 8b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
04 0965ffb0 79e78dca
aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
06 0965ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 30
System Thread ID: f10
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

# ChildEBP RetAddr
00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
06 0d9effec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 31
System Thread ID: f2c
Kernel Time: 0:0:0.15
User Time: 0:0:0.125
Thread Type: Other
# ChildEBP RetAddr
00 00a9f2c0 7c821bf4 ntdll!KiFastSystemCallRet
01 00a9f2c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 00a9f2f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be
wrong.
03 00a9f324 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
04 00a9ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
05 00a9ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 32
System Thread ID: 29c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 0880fe18 7c821c54 ntdll!KiFastSystemCallRet
01 0880fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 0880ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 0880ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 0880ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 0880ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 0880ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 33
System Thread ID: cbc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0955ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0955ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0955ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0955ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 34
System Thread ID: 248
Kernel Time: 0:0:0.390
User Time: 0:0:0.250
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0884ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 0884ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 0884ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 0884ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 0884ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 0884ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 0884ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 35
System Thread ID: 728
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 092bfeac 7c821bf4 ntdll!KiFastSystemCallRet
01 092bfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 092bfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
03 092bff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
04 092bff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
05 092bff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
06 092bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
07 092bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
08 092bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 36
System Thread ID: 924
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0935ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0935ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0935ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0935ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 37
System Thread ID: eb0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 0927f4f8 7c822124 ntdll!KiFastSystemCallRet
01 0927f4fc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
02 0927f56c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
03 0927f580 791d401f kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be
wrong.
04 0927f5a4 791fdacc mscorsvr!GetCompileInfo+0x1512
05 0927ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
06 0927ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 38
System Thread ID: ee8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0325ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 0325ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 0325ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 0325ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 0325ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 0325ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 0325ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 39
System Thread ID: ba4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 093bfe18 7c821c54 ntdll!KiFastSystemCallRet
01 093bfe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
02 093bff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
03 093bff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
04 093bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
05 093bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
06 093bffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 40
System Thread ID: bc0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0943ff10 7c821364 ntdll!KiFastSystemCallRet
01 0943ff14 77e42439 ntdll!NtDelayExecution+0xc
02 0943ff7c 77e424b7 kernel32!SleepEx+0x68
03 0943ff8c 776b22f4 kernel32!Sleep+0xf
04 0943ff98 776b235b ole32!CROIDTable::WorkerThreadLoop+0x14
05 0943ffa8 77670000 ole32!CRpcThread::WorkerLoop+0x1e
06 0943ffb8 77e66063 ole32!_imp__InstallApplication (ole32+0x0)
07 0943ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 41
System Thread ID: 3d8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 040aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 040aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 040affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 040affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 42
System Thread ID: 460
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

No remote call being made

# ChildEBP RetAddr
00 094cfeac 7c821bf4 ntdll!KiFastSystemCallRet
01 094cfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
02 094cfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
03 094cff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
04 094cff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
05 094cff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
06 094cffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
07 094cffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
08 094cffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 43
System Thread ID: f00
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 095aff70 7c821bf4 ntdll!KiFastSystemCallRet
01 095aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 095affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 095affec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 44
System Thread ID: fe4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0961ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0961ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0961ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0961ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 45
System Thread ID: 580
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0969ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0969ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0969ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0969ffec 00000000 kernel32!BaseThreadStart+0x34




Thread ID: 46
System Thread ID: 478
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0d71ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 0d71ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 0d71ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
03 0d71ffec 00000000 kernel32!BaseThreadStart+0x34

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating D:\program files\iisstate\output\3420-1125678433.dmp - mini user
dump

*****

Closing open log file D:\program files\iisstate\output\IISState-3420.log

Re: App Pool crash - 8007006d

Looks like you are crashing in the CLR. I would make sure that you have the
latest fix/service pack for .Net and see if that helps.

Pat

"Ian Cox" wrote in message
news:u3XNby9rFHA.1172@TK2MSFTNGP11.phx.gbl...
>I guess I'm misunderstanding how IISState using the -sc switch works.
> When ever I run it it catches an exception and quits
>
> Anyway, we just had another incident and I was able to run IISState during
> it.
>
> Here is the log...hopefully its more useful than the last one
>
> Your thoughts are muchly appreciated
>
> ****
> Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Fri Sep 02 18:27:05 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 3420
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> *** WARNING: Unable to verify checksum for
> c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
> 4e089_1e3d3e9e\mscorlib.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
> 4e089_1e3d3e9e\mscorlib.dll
> DLL (!FunctionName) that failed: mscorlib_79990000
>
>
>
>
> Thread ID: 10
> System Thread ID: fe0
> Kernel Time: 0:0:9.875
> User Time: 0:3:35.859
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
> PDB symbol for mscorsvr.dll not loaded
> succeeded
> Loaded Son of Strike data table version 5 from
> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
> Thread 10
> ESP EIP
> 019edc38 79ad8e18 [DEFAULT] Class
> System.Runtime.Remoting.Messaging.LogicalCallContext
> System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
> hread(Class System.Runtime.Remoting.Messaging.IMessage)
> 019edc44 79ad08da [DEFAULT] Void
> System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
> 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT]
> I4
> System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
> 019ef92c 020f79f2 [DEFAULT] [hasThis] String
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
> String,Class System.Web.Hosting.ServerVarCharBuffer)
> 019ef944 020f76c4 [DEFAULT] [hasThis] Void
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
> 019ef990 020f7615 [DEFAULT] [hasThis] Void
> System.Web.Hosting.ISAPIWorkerRequest.Initialize()
> 019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
> System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
> 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
> System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
> 019efaa0 79217188 [FRAME: ContextTransitionFrame]
> 019efb80 79217188 [FRAME: ComMethodFrame]
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> 00 00000001 00000000 mscorlib_79990000+0x148e18
> Closing open log file D:\program files\iisstate\output\IISState-3420.log
> Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Fri Sep 02 18:27:10 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 3420
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: cd4
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.31
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
> 01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
> 04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
> 05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
> 06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
> 07 0006ff0c 0100187c w3core!UlW3Start+0x26e
> 08 0006ff44 01001a23 w3wp!wmain+0x22a
> 09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
> 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>
>
>
>
> Thread ID: 1
> System Thread ID: dc4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
> 01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
> 02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
> 03 009effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 2
> System Thread ID: c80
> Kernel Time: 0:0:2.421
> User Time: 0:0:1.640
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 3
> System Thread ID: c14
> Kernel Time: 0:0:2.265
> User Time: 0:0:1.578
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00cdffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 4
> System Thread ID: 91c
> Kernel Time: 0:0:1.859
> User Time: 0:0:1.421
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 5
> System Thread ID: ca0
> Kernel Time: 0:0:1.984
> User Time: 0:0:1.546
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 6
> System Thread ID: 5b0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
> 01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
> 02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
> 03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 7
> System Thread ID: 658
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> 00 017efa84 7c822124 ntdll!KiFastSystemCallRet
> 01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
> 04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
> 05 017effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 8
> System Thread ID: 80c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
> 01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
> 02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
> 03 0186ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 9
> System Thread ID: da8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
> 01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
> 02 0196febc 77e424b7 kernel32!SleepEx+0x68
> 03 0196fecc 791bf4f9 kernel32!Sleep+0xf
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
> 05 0196ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 10
> System Thread ID: fe0
> Kernel Time: 0:0:9.875
> User Time: 0:3:35.859
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> Thread 10
> ESP EIP
> 019edc38 79ad8e18 [DEFAULT] Class
> System.Runtime.Remoting.Messaging.LogicalCallContext
> System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
> hread(Class System.Runtime.Remoting.Messaging.IMessage)
> 019edc44 79ad08da [DEFAULT] Void
> System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
> 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup] [DEFAULT]
> I4
> System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
> 019ef92c 020f79f2 [DEFAULT] [hasThis] String
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
> String,Class System.Web.Hosting.ServerVarCharBuffer)
> 019ef944 020f76c4 [DEFAULT] [hasThis] Void
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
> 019ef990 020f7615 [DEFAULT] [hasThis] Void
> System.Web.Hosting.ISAPIWorkerRequest.Initialize()
> 019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
> System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
> 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
> System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
> 019efaa0 79217188 [FRAME: ContextTransitionFrame]
> 019efb80 79217188 [FRAME: ComMethodFrame]
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> 00 00000001 00000000 mscorlib_79990000+0x148e18
>
>
>
>
> Thread ID: 11
> System Thread ID: bf4
> Kernel Time: 0:0:10.343
> User Time: 0:3:37.125
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01a4fcf8 7c822124 ntdll!KiFastSystemCallRet
> 01 01a4fcfc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01a4fd6c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01a4fd80 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01a4fda4 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 01a4ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 01a4ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 12
> System Thread ID: d54
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
> 01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
> 05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
> 06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 13
> System Thread ID: 818
> Kernel Time: 0:0:0.828
> User Time: 0:1:11.218
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
> 01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01dfffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 14
> System Thread ID: 2a8
> Kernel Time: 0:0:0.953
> User Time: 0:1:16.687
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 15
> System Thread ID: 8e0
> Kernel Time: 0:0:1.187
> User Time: 0:1:16.531
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 16
> System Thread ID: 740
> Kernel Time: 0:0:0.968
> User Time: 0:1:3.390
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
> 01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> 05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> 06 01ebffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 17
> System Thread ID: eec
> Kernel Time: 0:0:0.15
> User Time: 0:0:4.500
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
> 01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
> 05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
> 06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 07 01efffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 18
> System Thread ID: 8f0
> Kernel Time: 0:0:10.859
> User Time: 0:3:39.640
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
> 01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 0201ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 19
> System Thread ID: ed0
> Kernel Time: 0:0:10.796
> User Time: 0:3:37.46
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
> 01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 0209ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 20
> System Thread ID: 430
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 022dff38 7c821364 ntdll!KiFastSystemCallRet
> 01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
> 02 022dffa4 791cc578 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578
>
>
>
>
> Thread ID: 21
> System Thread ID: 238
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
> 01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> 04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
> 05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
> 06 030bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 22
> System Thread ID: fd8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
> 01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
> 02 0313fac0 7920a823 kernel32!SleepEx+0x68
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
> 04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
> 05 0313fb68 791b3208 0x1b2bce6
> 06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
> 07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
> 08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
> 09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
> 0a 0313fdb0 791cc3c8
> mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
> 0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
> 0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
> 0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> 0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 23
> System Thread ID: a94
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
> 01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 0375ffb8 77e66063
> mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
> 04 0375ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 24
> System Thread ID: 418
> Kernel Time: 0:0:0.203
> User Time: 0:0:0.250
> Thread Type: Other
> # ChildEBP RetAddr
> 00 039cff14 7739c78d ntdll!KiFastSystemCallRet
> 01 039cff34 77694fed USER32!NtUserGetMessage+0xc
> 02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
> 03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
> 04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
> 05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
> 06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
> 07 039cffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 25
> System Thread ID: fcc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
> 01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
> 04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
> 05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
> 06 03ffffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 26
> System Thread ID: 32c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
> 01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
> 04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
> 05 040fffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 27
> System Thread ID: 6cc
> Kernel Time: 0:0:0.31
> User Time: 0:0:0.218
> Thread Type: Other
> # ChildEBP RetAddr
> 00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
> 01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> 04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 28
> System Thread ID: 9bc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
> 01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> 02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
> 04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
> 05 0467ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 29
> System Thread ID: 8b4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
> 01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
> 04 0965ffb0 79e78dca
> aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
> 05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
> 06 0965ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 30
> System Thread ID: f10
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: ASP
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> # ChildEBP RetAddr
> 00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
> 01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
> 04 0d9effb0 79e78ddd aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
> 05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
> 06 0d9effec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 31
> System Thread ID: f2c
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.125
> Thread Type: Other
> # ChildEBP RetAddr
> 00 00a9f2c0 7c821bf4 ntdll!KiFastSystemCallRet
> 01 00a9f2c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 00a9f2f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 03 00a9f324 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> 04 00a9ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 05 00a9ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 32
> System Thread ID: 29c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 0880fe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 0880fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 0880ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 0880ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 0880ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 0880ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 06 0880ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 33
> System Thread ID: cbc
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0955ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0955ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 0955ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 0955ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 34
> System Thread ID: 248
> Kernel Time: 0:0:0.390
> User Time: 0:0:0.250
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 0884ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0884ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 0884ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 0884ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 0884ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 0884ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 0884ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 35
> System Thread ID: 728
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 092bfeac 7c821bf4 ntdll!KiFastSystemCallRet
> 01 092bfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 092bfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
> 03 092bff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
> 04 092bff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
> 05 092bff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
> 06 092bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 07 092bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 08 092bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 36
> System Thread ID: 924
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0935ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0935ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 0935ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 0935ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 37
> System Thread ID: eb0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0927f4f8 7c822124 ntdll!KiFastSystemCallRet
> 01 0927f4fc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> 02 0927f56c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> 03 0927f580 791d401f kernel32!WaitForSingleObject+0x12
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 04 0927f5a4 791fdacc mscorsvr!GetCompileInfo+0x1512
> 05 0927ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> 06 0927ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 38
> System Thread ID: ee8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> 00 0325ff24 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0325ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 0325ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> 03 0325ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> 04 0325ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> 05 0325ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> 06 0325ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 39
> System Thread ID: ba4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 093bfe18 7c821c54 ntdll!KiFastSystemCallRet
> 01 093bfe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> 02 093bff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> 03 093bff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> 04 093bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 05 093bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 06 093bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 40
> System Thread ID: bc0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0943ff10 7c821364 ntdll!KiFastSystemCallRet
> 01 0943ff14 77e42439 ntdll!NtDelayExecution+0xc
> 02 0943ff7c 77e424b7 kernel32!SleepEx+0x68
> 03 0943ff8c 776b22f4 kernel32!Sleep+0xf
> 04 0943ff98 776b235b ole32!CROIDTable::WorkerThreadLoop+0x14
> 05 0943ffa8 77670000 ole32!CRpcThread::WorkerLoop+0x1e
> 06 0943ffb8 77e66063 ole32!_imp__InstallApplication (ole32+0x0)
> 07 0943ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 41
> System Thread ID: 3d8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 040aff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 040aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 040affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 040affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 42
> System Thread ID: 460
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> No remote call being made
>
> # ChildEBP RetAddr
> 00 094cfeac 7c821bf4 ntdll!KiFastSystemCallRet
> 01 094cfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
> 02 094cfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
> 03 094cff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
> 04 094cff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
> 05 094cff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
> 06 094cffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> 07 094cffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> 08 094cffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 43
> System Thread ID: f00
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 095aff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 095aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 095affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 095affec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 44
> System Thread ID: fe4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0961ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0961ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 0961ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 0961ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 45
> System Thread ID: 580
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0969ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0969ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 0969ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 0969ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
>
>
> Thread ID: 46
> System Thread ID: 478
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0d71ff70 7c821bf4 ntdll!KiFastSystemCallRet
> 01 0d71ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> 02 0d71ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> 03 0d71ffec 00000000 kernel32!BaseThreadStart+0x34
>
> *****
>
> Dump name is formatted as: PID-Timestamp.dmp
>
> Creating D:\program files\iisstate\output\3420-1125678433.dmp - mini user
> dump
>
> *****
>
> Closing open log file D:\program files\iisstate\output\IISState-3420.log
>
>
>

Re: App Pool crash - 8007006d

Unfortrunately we already have the latest service packs on there.
I'm trying to see if there are any hotfixes that might be related but that
seems to contradict David's methodology to debug these things, as its a bit
like shooting in the dark.
Using WinDbg on the crash dump the error appears to be this:
"0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx".
The memory could not be "%s""

I guess it is time to call MS Support?

"Pat [MSFT]" wrote in message
news:uWoVk0%23rFHA.1256@TK2MSFTNGP09.phx.gbl...
> Looks like you are crashing in the CLR. I would make sure that you have
the
> latest fix/service pack for .Net and see if that helps.
>
> Pat
>
> "Ian Cox" wrote in message
> news:u3XNby9rFHA.1172@TK2MSFTNGP11.phx.gbl...
> >I guess I'm misunderstanding how IISState using the -sc switch works.
> > When ever I run it it catches an exception and quits
> >
> > Anyway, we just had another incident and I was able to run IISState
during
> > it.
> >
> > Here is the log...hopefully its more useful than the last one
> >
> > Your thoughts are muchly appreciated
> >
> > ****
> > Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
> >
> > ***********************
> > Starting new log output
> > IISState version 3.3.1
> >
> > Fri Sep 02 18:27:05 2005
> >
> > OS = Windows 2003 Server
> > Executable: w3wp.exe
> > PID = 3420
> >
> > Note: Thread times are formatted as HH:MM:SS.ms
> >
> > ***********************
> >
> >
> > IIS has crashed...
> > Beginning Analysis
> > *** WARNING: Unable to verify checksum for
> >
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
> > 4e089_1e3d3e9e\mscorlib.dll
> > *** ERROR: Module load completed but symbols could not be loaded for
> >
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
> > 4e089_1e3d3e9e\mscorlib.dll
> > DLL (!FunctionName) that failed: mscorlib_79990000
> >
> >
> >
> >
> > Thread ID: 10
> > System Thread ID: fe0
> > Kernel Time: 0:0:9.875
> > User Time: 0:3:35.859
> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> > *** ERROR: Symbol file could not be found. Defaulted to export symbols
> > for
> > C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
> > PDB symbol for mscorsvr.dll not loaded
> > succeeded
> > Loaded Son of Strike data table version 5 from
> > "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
> > Thread 10
> > ESP EIP
> > 019edc38 79ad8e18 [DEFAULT] Class
> > System.Runtime.Remoting.Messaging.LogicalCallContext
> >
System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
> > hread(Class System.Runtime.Remoting.Messaging.IMessage)
> > 019edc44 79ad08da [DEFAULT] Void
> > System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
> > 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup]
[DEFAULT]
> > I4
> >
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
> > 019ef92c 020f79f2 [DEFAULT] [hasThis] String
> >
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
> > String,Class System.Web.Hosting.ServerVarCharBuffer)
> > 019ef944 020f76c4 [DEFAULT] [hasThis] Void
> > System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
> > 019ef990 020f7615 [DEFAULT] [hasThis] Void
> > System.Web.Hosting.ISAPIWorkerRequest.Initialize()
> > 019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
> > System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
> > 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
> > System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
> > 019efaa0 79217188 [FRAME: ContextTransitionFrame]
> > 019efb80 79217188 [FRAME: ComMethodFrame]
> >
> >
> > Begin System Thread Information
> >
> > # ChildEBP RetAddr
> > 00 00000001 00000000 mscorlib_79990000+0x148e18
> > Closing open log file D:\program files\iisstate\output\IISState-3420.log
> > Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
> >
> > ***********************
> > Starting new log output
> > IISState version 3.3.1
> >
> > Fri Sep 02 18:27:10 2005
> >
> > OS = Windows 2003 Server
> > Executable: w3wp.exe
> > PID = 3420
> >
> > Note: Thread times are formatted as HH:MM:SS.ms
> >
> > ***********************
> >
> >
> >
> >
> > Thread ID: 0
> > System Thread ID: cd4
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.31
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: HTTP Compression Thread
> > # ChildEBP RetAddr
> > 00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
> > 01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
> > 04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
> > 05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
> > 06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
> > 07 0006ff0c 0100187c w3core!UlW3Start+0x26e
> > 08 0006ff44 01001a23 w3wp!wmain+0x22a
> > 09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
> > 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
> >
> >
> >
> >
> > Thread ID: 1
> > System Thread ID: dc4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
> > 01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
> > 02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
> > 03 009effec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 2
> > System Thread ID: c80
> > Kernel Time: 0:0:2.421
> > User Time: 0:0:1.640
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 3
> > System Thread ID: c14
> > Kernel Time: 0:0:2.265
> > User Time: 0:0:1.578
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 00cdffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 4
> > System Thread ID: 91c
> > Kernel Time: 0:0:1.859
> > User Time: 0:0:1.421
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 5
> > System Thread ID: ca0
> > Kernel Time: 0:0:1.984
> > User Time: 0:0:1.546
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 6
> > System Thread ID: 5b0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
> > 01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
> > 02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
> > 03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 7
> > System Thread ID: 658
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: HTTP Compression Thread
> > # ChildEBP RetAddr
> > 00 017efa84 7c822124 ntdll!KiFastSystemCallRet
> > 01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
> > 04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
> > 05 017effec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 8
> > System Thread ID: 80c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
> > 01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
> > 02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
> > 03 0186ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 9
> > System Thread ID: da8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
> > 01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
> > 02 0196febc 77e424b7 kernel32!SleepEx+0x68
> > 03 0196fecc 791bf4f9 kernel32!Sleep+0xf
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
> > 05 0196ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 10
> > System Thread ID: fe0
> > Kernel Time: 0:0:9.875
> > User Time: 0:3:35.859
> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> > Thread 10
> > ESP EIP
> > 019edc38 79ad8e18 [DEFAULT] Class
> > System.Runtime.Remoting.Messaging.LogicalCallContext
> >
System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
> > hread(Class System.Runtime.Remoting.Messaging.IMessage)
> > 019edc44 79ad08da [DEFAULT] Void
> > System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
> > 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup]
[DEFAULT]
> > I4
> >
System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
> > 019ef92c 020f79f2 [DEFAULT] [hasThis] String
> >
System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
> > String,Class System.Web.Hosting.ServerVarCharBuffer)
> > 019ef944 020f76c4 [DEFAULT] [hasThis] Void
> > System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
> > 019ef990 020f7615 [DEFAULT] [hasThis] Void
> > System.Web.Hosting.ISAPIWorkerRequest.Initialize()
> > 019ef998 020f660f [DEFAULT] Class System.Web.Hosting.ISAPIWorkerRequest
> > System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
> > 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
> > System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
> > 019efaa0 79217188 [FRAME: ContextTransitionFrame]
> > 019efb80 79217188 [FRAME: ComMethodFrame]
> >
> >
> > Begin System Thread Information
> >
> > # ChildEBP RetAddr
> > 00 00000001 00000000 mscorlib_79990000+0x148e18
> >
> >
> >
> >
> > Thread ID: 11
> > System Thread ID: bf4
> > Kernel Time: 0:0:10.343
> > User Time: 0:3:37.125
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01a4fcf8 7c822124 ntdll!KiFastSystemCallRet
> > 01 01a4fcfc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 01a4fd6c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 01a4fd80 791d401f kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01a4fda4 791fdacc mscorsvr!GetCompileInfo+0x1512
> > 05 01a4ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 06 01a4ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 12
> > System Thread ID: d54
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
> > 01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
> > 05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
> > 06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 13
> > System Thread ID: 818
> > Kernel Time: 0:0:0.828
> > User Time: 0:1:11.218
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
> > 01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> > 05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> > 06 01dfffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 14
> > System Thread ID: 2a8
> > Kernel Time: 0:0:0.953
> > User Time: 0:1:16.687
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
> > 01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> > 05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> > 06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 15
> > System Thread ID: 8e0
> > Kernel Time: 0:0:1.187
> > User Time: 0:1:16.531
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
> > 01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> > 05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> > 06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 16
> > System Thread ID: 740
> > Kernel Time: 0:0:0.968
> > User Time: 0:1:3.390
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
> > 01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
> > 05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
> > 06 01ebffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 17
> > System Thread ID: eec
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:4.500
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
> > 01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
> > 05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
> > 06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> > 07 01efffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 18
> > System Thread ID: 8f0
> > Kernel Time: 0:0:10.859
> > User Time: 0:3:39.640
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
> > 01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
> > 05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 06 0201ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 19
> > System Thread ID: ed0
> > Kernel Time: 0:0:10.796
> > User Time: 0:3:37.46
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
> > 01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
> > 05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 06 0209ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 20
> > System Thread ID: 430
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 022dff38 7c821364 ntdll!KiFastSystemCallRet
> > 01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
> > 02 022dffa4 791cc578 kernel32!SleepEx+0x68
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578
> >
> >
> >
> >
> > Thread ID: 21
> > System Thread ID: 238
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
> > 01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
> > 04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
> > 05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
> > 06 030bffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 22
> > System Thread ID: fd8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.31
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
> > 01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
> > 02 0313fac0 7920a823 kernel32!SleepEx+0x68
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
> > 04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
> > 05 0313fb68 791b3208 0x1b2bce6
> > 06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
> > 07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
> > 08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
> > 09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
> > 0a 0313fdb0 791cc3c8
> > mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
> > 0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
> > 0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
> > 0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
> > 0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 23
> > System Thread ID: a94
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.15
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
> > 01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 03 0375ffb8 77e66063
> > mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
> > 04 0375ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 24
> > System Thread ID: 418
> > Kernel Time: 0:0:0.203
> > User Time: 0:0:0.250
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 039cff14 7739c78d ntdll!KiFastSystemCallRet
> > 01 039cff34 77694fed USER32!NtUserGetMessage+0xc
> > 02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
> > 03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
> > 04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
> > 05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
> > 06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
> > 07 039cffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 25
> > System Thread ID: fcc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
> > 01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
> > 04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
> > 05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
> > 06 03ffffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 26
> > System Thread ID: 32c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
> > 01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
> > 04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
> > 05 040fffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 27
> > System Thread ID: 6cc
> > Kernel Time: 0:0:0.31
> > User Time: 0:0:0.218
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> > 04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 28
> > System Thread ID: 9bc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
> > 01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
> > 02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
> > 03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
> > 04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
> > 05 0467ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 29
> > System Thread ID: 8b4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: ASP
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > # ChildEBP RetAddr
> > 00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
> > 01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
> > 04 0965ffb0 79e78dca
> > aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
> > 05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
> > 06 0965ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 30
> > System Thread ID: f10
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: ASP
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > # ChildEBP RetAddr
> > 00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
> > 01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
> > 04 0d9effb0 79e78ddd
aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
> > 05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
> > 06 0d9effec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 31
> > System Thread ID: f2c
> > Kernel Time: 0:0:0.15
> > User Time: 0:0:0.125
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 00a9f2c0 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 00a9f2c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 00a9f2f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 03 00a9f324 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
> > 04 00a9ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 05 00a9ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 32
> > System Thread ID: 29c
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > No remote call being made
> >
> > # ChildEBP RetAddr
> > 00 0880fe18 7c821c54 ntdll!KiFastSystemCallRet
> > 01 0880fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> > 02 0880ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> > 03 0880ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> > 04 0880ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> > 05 0880ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> > 06 0880ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 33
> > System Thread ID: cbc
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0955ff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0955ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 0955ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 0955ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 34
> > System Thread ID: 248
> > Kernel Time: 0:0:0.390
> > User Time: 0:0:0.250
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 0884ff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0884ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 0884ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 0884ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 0884ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 0884ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 0884ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 35
> > System Thread ID: 728
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > No remote call being made
> >
> > # ChildEBP RetAddr
> > 00 092bfeac 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 092bfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 092bfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
> > 03 092bff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
> > 04 092bff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
> > 05 092bff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
> > 06 092bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> > 07 092bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> > 08 092bffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 36
> > System Thread ID: 924
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0935ff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0935ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 0935ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 0935ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 37
> > System Thread ID: eb0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Status: Thread is in a WAIT state.
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0927f4f8 7c822124 ntdll!KiFastSystemCallRet
> > 01 0927f4fc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
> > 02 0927f56c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
> > 03 0927f580 791d401f kernel32!WaitForSingleObject+0x12
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 04 0927f5a4 791fdacc mscorsvr!GetCompileInfo+0x1512
> > 05 0927ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
> > 06 0927ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 38
> > System Thread ID: ee8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: HTTP Listener
> > # ChildEBP RetAddr
> > 00 0325ff24 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0325ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 0325ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
> > 03 0325ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
> > 04 0325ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
> > 05 0325ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
> > 06 0325ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 39
> > System Thread ID: ba4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > No remote call being made
> >
> > # ChildEBP RetAddr
> > 00 093bfe18 7c821c54 ntdll!KiFastSystemCallRet
> > 01 093bfe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
> > 02 093bff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
> > 03 093bff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
> > 04 093bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> > 05 093bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> > 06 093bffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 40
> > System Thread ID: bc0
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0943ff10 7c821364 ntdll!KiFastSystemCallRet
> > 01 0943ff14 77e42439 ntdll!NtDelayExecution+0xc
> > 02 0943ff7c 77e424b7 kernel32!SleepEx+0x68
> > 03 0943ff8c 776b22f4 kernel32!Sleep+0xf
> > 04 0943ff98 776b235b ole32!CROIDTable::WorkerThreadLoop+0x14
> > 05 0943ffa8 77670000 ole32!CRpcThread::WorkerLoop+0x1e
> > 06 0943ffb8 77e66063 ole32!_imp__InstallApplication (ole32+0x0)
> > 07 0943ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 41
> > System Thread ID: 3d8
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 040aff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 040aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 040affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 040affec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 42
> > System Thread ID: 460
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Possible ASP page. Possible DCOM activity
> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> > Continuing with other analysis.
> >
> > No remote call being made
> >
> > # ChildEBP RetAddr
> > 00 094cfeac 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 094cfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
> > 02 094cfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
> > 03 094cff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
> > 04 094cff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
> > 05 094cff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
> > 06 094cffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
> > 07 094cffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
> > 08 094cffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 43
> > System Thread ID: f00
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 095aff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 095aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 095affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 095affec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 44
> > System Thread ID: fe4
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0961ff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0961ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 0961ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 0961ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 45
> > System Thread ID: 580
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0969ff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0969ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 0969ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 0969ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> >
> >
> >
> > Thread ID: 46
> > System Thread ID: 478
> > Kernel Time: 0:0:0.0
> > User Time: 0:0:0.0
> > Thread Type: Other
> > # ChildEBP RetAddr
> > 00 0d71ff70 7c821bf4 ntdll!KiFastSystemCallRet
> > 01 0d71ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
> > 02 0d71ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
> > 03 0d71ffec 00000000 kernel32!BaseThreadStart+0x34
> >
> > *****
> >
> > Dump name is formatted as: PID-Timestamp.dmp
> >
> > Creating D:\program files\iisstate\output\3420-1125678433.dmp - mini
user
> > dump
> >
> > *****
> >
> > Closing open log file D:\program files\iisstate\output\IISState-3420.log
> >
> >
> >
>
>

Re: App Pool crash - 8007006d

Yep. Also, it would seem that you did not get good symbols for WinDBG.

Pat

"Ian Cox" wrote in message
news:ervqHLgsFHA.1172@TK2MSFTNGP11.phx.gbl...
> Unfortrunately we already have the latest service packs on there.
> I'm trying to see if there are any hotfixes that might be related but that
> seems to contradict David's methodology to debug these things, as its a
> bit
> like shooting in the dark.
> Using WinDbg on the crash dump the error appears to be this:
> "0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx".
> The memory could not be "%s""
>
> I guess it is time to call MS Support?
>
> "Pat [MSFT]" wrote in message
> news:uWoVk0%23rFHA.1256@TK2MSFTNGP09.phx.gbl...
>> Looks like you are crashing in the CLR. I would make sure that you have
> the
>> latest fix/service pack for .Net and see if that helps.
>>
>> Pat
>>
>> "Ian Cox" wrote in message
>> news:u3XNby9rFHA.1172@TK2MSFTNGP11.phx.gbl...
>> >I guess I'm misunderstanding how IISState using the -sc switch works.
>> > When ever I run it it catches an exception and quits
>> >
>> > Anyway, we just had another incident and I was able to run IISState
> during
>> > it.
>> >
>> > Here is the log...hopefully its more useful than the last one
>> >
>> > Your thoughts are muchly appreciated
>> >
>> > ****
>> > Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>> >
>> > ***********************
>> > Starting new log output
>> > IISState version 3.3.1
>> >
>> > Fri Sep 02 18:27:05 2005
>> >
>> > OS = Windows 2003 Server
>> > Executable: w3wp.exe
>> > PID = 3420
>> >
>> > Note: Thread times are formatted as HH:MM:SS.ms
>> >
>> > ***********************
>> >
>> >
>> > IIS has crashed...
>> > Beginning Analysis
>> > *** WARNING: Unable to verify checksum for
>> >
> c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
>> > 4e089_1e3d3e9e\mscorlib.dll
>> > *** ERROR: Module load completed but symbols could not be loaded for
>> >
> c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500 0.0__b77a5c56193
>> > 4e089_1e3d3e9e\mscorlib.dll
>> > DLL (!FunctionName) that failed: mscorlib_79990000
>> >
>> >
>> >
>> >
>> > Thread ID: 10
>> > System Thread ID: fe0
>> > Kernel Time: 0:0:9.875
>> > User Time: 0:3:35.859
>> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
>> > *** ERROR: Symbol file could not be found. Defaulted to export symbols
>> > for
>> > C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll -
>> > PDB symbol for mscorsvr.dll not loaded
>> > succeeded
>> > Loaded Son of Strike data table version 5 from
>> > "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
>> > Thread 10
>> > ESP EIP
>> > 019edc38 79ad8e18 [DEFAULT] Class
>> > System.Runtime.Remoting.Messaging.LogicalCallContext
>> >
> System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
>> > hread(Class System.Runtime.Remoting.Messaging.IMessage)
>> > 019edc44 79ad08da [DEFAULT] Void
>> > System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
>> > 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup]
> [DEFAULT]
>> > I4
>> >
> System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
>> > 019ef92c 020f79f2 [DEFAULT] [hasThis] String
>> >
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
>> > String,Class System.Web.Hosting.ServerVarCharBuffer)
>> > 019ef944 020f76c4 [DEFAULT] [hasThis] Void
>> > System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
>> > 019ef990 020f7615 [DEFAULT] [hasThis] Void
>> > System.Web.Hosting.ISAPIWorkerRequest.Initialize()
>> > 019ef998 020f660f [DEFAULT] Class
>> > System.Web.Hosting.ISAPIWorkerRequest
>> > System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
>> > 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
>> > System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
>> > 019efaa0 79217188 [FRAME: ContextTransitionFrame]
>> > 019efb80 79217188 [FRAME: ComMethodFrame]
>> >
>> >
>> > Begin System Thread Information
>> >
>> > # ChildEBP RetAddr
>> > 00 00000001 00000000 mscorlib_79990000+0x148e18
>> > Closing open log file D:\program
>> > files\iisstate\output\IISState-3420.log
>> > Opened log file 'D:\program files\iisstate\output\IISState-3420.log'
>> >
>> > ***********************
>> > Starting new log output
>> > IISState version 3.3.1
>> >
>> > Fri Sep 02 18:27:10 2005
>> >
>> > OS = Windows 2003 Server
>> > Executable: w3wp.exe
>> > PID = 3420
>> >
>> > Note: Thread times are formatted as HH:MM:SS.ms
>> >
>> > ***********************
>> >
>> >
>> >
>> >
>> > Thread ID: 0
>> > System Thread ID: cd4
>> > Kernel Time: 0:0:0.15
>> > User Time: 0:0:0.31
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: HTTP Compression Thread
>> > # ChildEBP RetAddr
>> > 00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0006fc0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0006fc7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
>> > 04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
>> > 05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
>> > 06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
>> > 07 0006ff0c 0100187c w3core!UlW3Start+0x26e
>> > 08 0006ff44 01001a23 w3wp!wmain+0x22a
>> > 09 0006ffc0 77e523cd w3wp!wmainCRTStartup+0x12b
>> > 0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23
>> >
>> >
>> >
>> >
>> > Thread ID: 1
>> > System Thread ID: dc4
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
>> > 01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
>> > 02 009effb8 77e66063 ntdll!RtlpTimerThread+0x47
>> > 03 009effec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 2
>> > System Thread ID: c80
>> > Kernel Time: 0:0:2.421
>> > User Time: 0:0:1.640
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 00c9ff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 00c9ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 00c9ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 00c9ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 00c9ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 00c9ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 00c9ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 3
>> > System Thread ID: c14
>> > Kernel Time: 0:0:2.265
>> > User Time: 0:0:1.578
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 00cdff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 00cdff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 00cdff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 00cdff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 00cdffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 00cdffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 00cdffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 4
>> > System Thread ID: 91c
>> > Kernel Time: 0:0:1.859
>> > User Time: 0:0:1.421
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 00d1ff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 00d1ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 00d1ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 00d1ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 00d1ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 00d1ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 00d1ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 5
>> > System Thread ID: ca0
>> > Kernel Time: 0:0:1.984
>> > User Time: 0:0:1.546
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 00d5ff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 00d5ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 00d5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 00d5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 00d5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 00d5ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 00d5ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 6
>> > System Thread ID: 5b0
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 00e1fcec 7c822114 ntdll!KiFastSystemCallRet
>> > 01 00e1fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
>> > 02 00e1ffb8 77e66063 ntdll!RtlpWaitThread+0x161
>> > 03 00e1ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 7
>> > System Thread ID: 658
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: HTTP Compression Thread
>> > # ChildEBP RetAddr
>> > 00 017efa84 7c822124 ntdll!KiFastSystemCallRet
>> > 01 017efa88 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 017efaf8 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
>> > 04 017effb8 77e66063 w3core!HTTP_COMPRESSION::CompressionThread+0x126
>> > 05 017effec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 8
>> > System Thread ID: 80c
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
>> > 01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
>> > 02 0186ffb8 77e66063 ntdll!RtlpIOWorkerThread+0x3f
>> > 03 0186ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 9
>> > System Thread ID: da8
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0196fe50 7c821364 ntdll!KiFastSystemCallRet
>> > 01 0196fe54 77e42439 ntdll!NtDelayExecution+0xc
>> > 02 0196febc 77e424b7 kernel32!SleepEx+0x68
>> > 03 0196fecc 791bf4f9 kernel32!Sleep+0xf
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 0196ffb8 77e66063 mscorsvr!Ordinal76+0xf4f9
>> > 05 0196ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 10
>> > System Thread ID: fe0
>> > Kernel Time: 0:0:9.875
>> > User Time: 0:3:35.859
>> > Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
>> > Thread 10
>> > ESP EIP
>> > 019edc38 79ad8e18 [DEFAULT] Class
>> > System.Runtime.Remoting.Messaging.LogicalCallContext
>> >
> System.Runtime.Remoting.Messaging.Message.PropagateCallConte xtFromMessageToT
>> > hread(Class System.Runtime.Remoting.Messaging.IMessage)
>> > 019edc44 79ad08da [DEFAULT] Void
>> > System.Runtime.Remoting.Contexts.Context.DoCallBackFromEE(I4 ,I4,I4)
>> > 019ef914 791b3208 [FRAME: NDirectMethodFrameStandaloneCleanup]
> [DEFAULT]
>> > I4
>> >
> System.Web.UnsafeNativeMethods.EcbGetUnicodeServerVariable(I ,String,I,I4)
>> > 019ef92c 020f79f2 [DEFAULT] [hasThis] String
>> >
> System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.GetUnicod eServerVariable(
>> > String,Class System.Web.Hosting.ServerVarCharBuffer)
>> > 019ef944 020f76c4 [DEFAULT] [hasThis] Void
>> > System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.ReadReque stBasics()
>> > 019ef990 020f7615 [DEFAULT] [hasThis] Void
>> > System.Web.Hosting.ISAPIWorkerRequest.Initialize()
>> > 019ef998 020f660f [DEFAULT] Class
>> > System.Web.Hosting.ISAPIWorkerRequest
>> > System.Web.Hosting.ISAPIWorkerRequest.CreateWorkerRequest(I, I4)
>> > 019ef9d8 020f6457 [DEFAULT] [hasThis] I4
>> > System.Web.Hosting.ISAPIRuntime.ProcessRequest(I,I4)
>> > 019efaa0 79217188 [FRAME: ContextTransitionFrame]
>> > 019efb80 79217188 [FRAME: ComMethodFrame]
>> >
>> >
>> > Begin System Thread Information
>> >
>> > # ChildEBP RetAddr
>> > 00 00000001 00000000 mscorlib_79990000+0x148e18
>> >
>> >
>> >
>> >
>> > Thread ID: 11
>> > System Thread ID: bf4
>> > Kernel Time: 0:0:10.343
>> > User Time: 0:3:37.125
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01a4fcf8 7c822124 ntdll!KiFastSystemCallRet
>> > 01 01a4fcfc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 01a4fd6c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 01a4fd80 791d401f kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01a4fda4 791fdacc mscorsvr!GetCompileInfo+0x1512
>> > 05 01a4ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 06 01a4ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 12
>> > System Thread ID: d54
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01b6fe70 7c822114 ntdll!KiFastSystemCallRet
>> > 01 01b6fe74 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 01b6ff1c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 01b6ff38 79238fd6 kernel32!WaitForMultipleObjects+0x18
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01b6ffa0 79238f4d mscorsvr!CoInitializeCor+0x43ad
>> > 05 01b6ffb8 77e66063 mscorsvr!CoInitializeCor+0x4324
>> > 06 01b6ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 13
>> > System Thread ID: 818
>> > Kernel Time: 0:0:0.828
>> > User Time: 0:1:11.218
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01dffefc 7c822124 ntdll!KiFastSystemCallRet
>> > 01 01dfff00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 01dfff70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 01dfff84 791fe6b0 kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01dfffac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
>> > 05 01dfffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
>> > 06 01dfffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 14
>> > System Thread ID: 2a8
>> > Kernel Time: 0:0:0.953
>> > User Time: 0:1:16.687
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01e3fdfc 7c822124 ntdll!KiFastSystemCallRet
>> > 01 01e3fe00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 01e3fe70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 01e3fe84 791fe6b0 kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01e3feac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
>> > 05 01e3ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
>> > 06 01e3ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 15
>> > System Thread ID: 8e0
>> > Kernel Time: 0:0:1.187
>> > User Time: 0:1:16.531
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01e7fcfc 7c822124 ntdll!KiFastSystemCallRet
>> > 01 01e7fd00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 01e7fd70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 01e7fd84 791fe6b0 kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01e7fdac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
>> > 05 01e7ffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
>> > 06 01e7ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 16
>> > System Thread ID: 740
>> > Kernel Time: 0:0:0.968
>> > User Time: 0:1:3.390
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01ebfbfc 7c822124 ntdll!KiFastSystemCallRet
>> > 01 01ebfc00 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 01ebfc70 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 01ebfc84 791fe6b0 kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01ebfcac 792356bf mscorsvr!GetAssemblyMDImport+0x15d97
>> > 05 01ebffb8 77e66063 mscorsvr!CoInitializeCor+0xa96
>> > 06 01ebffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 17
>> > System Thread ID: eec
>> > Kernel Time: 0:0:0.15
>> > User Time: 0:0:4.500
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 01effdf8 7c822114 ntdll!KiFastSystemCallRet
>> > 01 01effdfc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 01effea4 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 01effec0 7927826b kernel32!WaitForMultipleObjects+0x18
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 01effee0 791fecf4 mscorsvr!CoEEShutDownCOM+0x2516a
>> > 05 01efff24 79245681 mscorsvr!GetAssemblyMDImport+0x163db
>> > 06 01efffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
>> > 07 01efffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 18
>> > System Thread ID: 8f0
>> > Kernel Time: 0:0:10.859
>> > User Time: 0:3:39.640
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0201fc78 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0201fc7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0201fcec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0201fd00 791d401f kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 0201fd24 791fdacc mscorsvr!GetCompileInfo+0x1512
>> > 05 0201ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 06 0201ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 19
>> > System Thread ID: ed0
>> > Kernel Time: 0:0:10.796
>> > User Time: 0:3:37.46
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0209fb78 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0209fb7c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0209fbec 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0209fc00 791d401f kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 0209fc24 791fdacc mscorsvr!GetCompileInfo+0x1512
>> > 05 0209ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 06 0209ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 20
>> > System Thread ID: 430
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 022dff38 7c821364 ntdll!KiFastSystemCallRet
>> > 01 022dff3c 77e42439 ntdll!NtDelayExecution+0xc
>> > 02 022dffa4 791cc578 kernel32!SleepEx+0x68
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 03 022dffec 00000000 mscorsvr!Ordinal76+0x1c578
>> >
>> >
>> >
>> >
>> > Thread ID: 21
>> > System Thread ID: 238
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 030bfe48 7c822114 ntdll!KiFastSystemCallRet
>> > 01 030bfe4c 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 030bfef4 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 030bff50 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
>> > 04 030bff6c 4dda6ad4 USER32!MsgWaitForMultipleObjects+0x1f
>> > 05 030bffb8 77e66063 gdiplus!BackgroundThreadProc+0x59
>> > 06 030bffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 22
>> > System Thread ID: fd8
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.31
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0313fa54 7c821364 ntdll!KiFastSystemCallRet
>> > 01 0313fa58 77e42439 ntdll!NtDelayExecution+0xc
>> > 02 0313fac0 7920a823 kernel32!SleepEx+0x68
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 03 0313fae0 7920a89b mscorsvr!GetAssemblyMDImport+0x21f0a
>> > 04 0313faf0 01b2bce6 mscorsvr!GetAssemblyMDImport+0x21f82
>> > 05 0313fb68 791b3208 0x1b2bce6
>> > 06 0313fb70 791b3ad7 mscorsvr!Ordinal76+0x3208
>> > 07 0313fc80 791d3ef0 mscorsvr!Ordinal76+0x3ad7
>> > 08 0313fd3c 791d3fa4 mscorsvr!GetCompileInfo+0x13e3
>> > 09 0313fd64 7924b0d1 mscorsvr!GetCompileInfo+0x1497
>> > 0a 0313fdb0 791cc3c8
>> > mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x4571
>> > 0b 0313fdf8 7927b7de mscorsvr!Ordinal76+0x1c3c8
>> > 0c 0313fea4 79245681 mscorsvr!CoEEShutDownCOM+0x286dd
>> > 0d 0313ffb8 77e66063 mscorsvr!CoUninitializeEE+0xa13e
>> > 0e 0313ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 23
>> > System Thread ID: a94
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.15
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0375fed8 7c822114 ntdll!KiFastSystemCallRet
>> > 01 0375fedc 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 0375ff84 79249f16 kernel32!WaitForMultipleObjectsEx+0x11a
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 03 0375ffb8 77e66063
>> > mscorsvr!GetMetaDataPublicInterfaceFromInternal+0x33b6
>> > 04 0375ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 24
>> > System Thread ID: 418
>> > Kernel Time: 0:0:0.203
>> > User Time: 0:0:0.250
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 039cff14 7739c78d ntdll!KiFastSystemCallRet
>> > 01 039cff34 77694fed USER32!NtUserGetMessage+0xc
>> > 02 039cff74 776cf3a3 ole32!CDllHost::STAWorkerLoop+0x72
>> > 03 039cff90 776cf2eb ole32!CDllHost::WorkerThread+0xc8
>> > 04 039cff98 776b235b ole32!DLLHostThreadEntry+0xd
>> > 05 039cffac 776b23c8 ole32!CRpcThread::WorkerLoop+0x1e
>> > 06 039cffb8 77e66063 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
>> > 07 039cffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 25
>> > System Thread ID: fcc
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 03fffeb4 7c822114 ntdll!KiFastSystemCallRet
>> > 01 03fffeb8 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 03ffff60 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 03ffff7c 614d96ff kernel32!WaitForMultipleObjects+0x18
>> > 04 03ffffb0 614d972a mqsec!CCancelRpc::ProcessEvents+0xb2
>> > 05 03ffffb8 77e66063 mqsec!CCancelRpc::CancelThread+0xd
>> > 06 03ffffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 26
>> > System Thread ID: 32c
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 040ffec0 7c822114 ntdll!KiFastSystemCallRet
>> > 01 040ffec4 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 040fff6c 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 040fff88 76928415 kernel32!WaitForMultipleObjects+0x18
>> > 04 040fffb8 77e66063 USERENV!NotificationThread+0x5f
>> > 05 040fffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 27
>> > System Thread ID: 6cc
>> > Kernel Time: 0:0:0.31
>> > User Time: 0:0:0.218
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 03d5f740 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 03d5f744 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 03d5f770 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 03 03d5f7a4 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
>> > 04 03d5ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 05 03d5ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 28
>> > System Thread ID: 9bc
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0467fe94 7c822114 ntdll!KiFastSystemCallRet
>> > 01 0467fe98 77e6711b ntdll!NtWaitForMultipleObjects+0xc
>> > 02 0467ff40 77e61075 kernel32!WaitForMultipleObjectsEx+0x11a
>> > 03 0467ff5c 7976d243 kernel32!WaitForMultipleObjects+0x18
>> > 04 0467ffb8 77e66063 CorperfmonExt!HandlerAuxThreadProc+0x3f
>> > 05 0467ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 29
>> > System Thread ID: 8b4
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: ASP
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > # ChildEBP RetAddr
>> > 00 0965ff08 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0965ff0c 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0965ff7c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0965ff90 79e796b6 kernel32!WaitForSingleObject+0x12
>> > 04 0965ffb0 79e78dca
>> > aspnet_isapi!CPerfCounterClient::MonitorPerfPipeNames+0x6b
>> > 05 0965ffb8 77e66063 aspnet_isapi!RegistryMonitorThreadStart+0xa
>> > 06 0965ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 30
>> > System Thread ID: f10
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: ASP
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > # ChildEBP RetAddr
>> > 00 0d9efed4 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0d9efed8 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0d9eff48 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0d9eff5c 79e79b00 kernel32!WaitForSingleObject+0x12
>> > 04 0d9effb0 79e78ddd
> aspnet_isapi!CPerfCounterClient::GatherPerfData+0x210
>> > 05 0d9effb8 77e66063 aspnet_isapi!PerfDataGatherThreadStart+0xa
>> > 06 0d9effec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 31
>> > System Thread ID: f2c
>> > Kernel Time: 0:0:0.15
>> > User Time: 0:0:0.125
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 00a9f2c0 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 00a9f2c4 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 00a9f2f0 791fdb22 kernel32!GetQueuedCompletionStatus+0x29
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 03 00a9f324 791fdacc mscorsvr!GetAssemblyMDImport+0x15209
>> > 04 00a9ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 05 00a9ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 32
>> > System Thread ID: 29c
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Possible ASP page. Possible DCOM activity
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > No remote call being made
>> >
>> > # ChildEBP RetAddr
>> > 00 0880fe18 7c821c54 ntdll!KiFastSystemCallRet
>> > 01 0880fe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
>> > 02 0880ff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
>> > 03 0880ff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
>> > 04 0880ffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
>> > 05 0880ffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
>> > 06 0880ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 33
>> > System Thread ID: cbc
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0955ff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0955ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 0955ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 0955ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 34
>> > System Thread ID: 248
>> > Kernel Time: 0:0:0.390
>> > User Time: 0:0:0.250
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 0884ff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0884ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 0884ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 0884ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 0884ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 0884ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 0884ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 35
>> > System Thread ID: 728
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Possible ASP page. Possible DCOM activity
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > No remote call being made
>> >
>> > # ChildEBP RetAddr
>> > 00 092bfeac 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 092bfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 092bfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
>> > 03 092bff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
>> > 04 092bff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
>> > 05 092bff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
>> > 06 092bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
>> > 07 092bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
>> > 08 092bffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 36
>> > System Thread ID: 924
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0935ff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0935ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 0935ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 0935ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 37
>> > System Thread ID: eb0
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Status: Thread is in a WAIT state.
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0927f4f8 7c822124 ntdll!KiFastSystemCallRet
>> > 01 0927f4fc 77e6baa8 ntdll!NtWaitForSingleObject+0xc
>> > 02 0927f56c 77e6ba12 kernel32!WaitForSingleObjectEx+0xac
>> > 03 0927f580 791d401f kernel32!WaitForSingleObject+0x12
>> > WARNING: Stack unwind information not available. Following frames may
>> > be
>> > wrong.
>> > 04 0927f5a4 791fdacc mscorsvr!GetCompileInfo+0x1512
>> > 05 0927ffb8 77e66063 mscorsvr!GetAssemblyMDImport+0x151b3
>> > 06 0927ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 38
>> > System Thread ID: ee8
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: HTTP Listener
>> > # ChildEBP RetAddr
>> > 00 0325ff24 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0325ff28 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 0325ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
>> > 03 0325ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
>> > 04 0325ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
>> > 05 0325ffb8 77e66063 W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
>> > 06 0325ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 39
>> > System Thread ID: ba4
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Possible ASP page. Possible DCOM activity
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > No remote call being made
>> >
>> > # ChildEBP RetAddr
>> > 00 093bfe18 7c821c54 ntdll!KiFastSystemCallRet
>> > 01 093bfe1c 77c7538c ntdll!ZwReplyWaitReceivePortEx+0xc
>> > 02 093bff84 77c5778f RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
>> > 03 093bff8c 77c5f7dd RPCRT4!RecvLotsaCallsWrapper+0xd
>> > 04 093bffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
>> > 05 093bffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
>> > 06 093bffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 40
>> > System Thread ID: bc0
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0943ff10 7c821364 ntdll!KiFastSystemCallRet
>> > 01 0943ff14 77e42439 ntdll!NtDelayExecution+0xc
>> > 02 0943ff7c 77e424b7 kernel32!SleepEx+0x68
>> > 03 0943ff8c 776b22f4 kernel32!Sleep+0xf
>> > 04 0943ff98 776b235b ole32!CROIDTable::WorkerThreadLoop+0x14
>> > 05 0943ffa8 77670000 ole32!CRpcThread::WorkerLoop+0x1e
>> > 06 0943ffb8 77e66063 ole32!_imp__InstallApplication (ole32+0x0)
>> > 07 0943ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 41
>> > System Thread ID: 3d8
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 040aff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 040aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 040affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 040affec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 42
>> > System Thread ID: 460
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Possible ASP page. Possible DCOM activity
>> > Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
>> > Continuing with other analysis.
>> >
>> > No remote call being made
>> >
>> > # ChildEBP RetAddr
>> > 00 094cfeac 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 094cfeb0 77e6611a ntdll!NtRemoveIoCompletion+0xc
>> > 02 094cfedc 77c604c3 kernel32!GetQueuedCompletionStatus+0x29
>> > 03 094cff18 77c60655 RPCRT4!COMMON_ProcessCalls+0xa1
>> > 04 094cff84 77c5f9f1 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x117
>> > 05 094cff8c 77c5f7dd RPCRT4!ProcessIOEventsWrapper+0xd
>> > 06 094cffac 77c5de88 RPCRT4!BaseCachedThreadRoutine+0x9d
>> > 07 094cffb8 77e66063 RPCRT4!ThreadStartRoutine+0x1b
>> > 08 094cffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 43
>> > System Thread ID: f00
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 095aff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 095aff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 095affb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 095affec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 44
>> > System Thread ID: fe4
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0961ff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0961ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 0961ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 0961ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 45
>> > System Thread ID: 580
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0969ff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0969ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 0969ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 0969ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> >
>> >
>> >
>> > Thread ID: 46
>> > System Thread ID: 478
>> > Kernel Time: 0:0:0.0
>> > User Time: 0:0:0.0
>> > Thread Type: Other
>> > # ChildEBP RetAddr
>> > 00 0d71ff70 7c821bf4 ntdll!KiFastSystemCallRet
>> > 01 0d71ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
>> > 02 0d71ffb8 77e66063 ntdll!RtlpWorkerThread+0x3d
>> > 03 0d71ffec 00000000 kernel32!BaseThreadStart+0x34
>> >
>> > *****
>> >
>> > Dump name is formatted as: PID-Timestamp.dmp
>> >
>> > Creating D:\program files\iisstate\output\3420-1125678433.dmp - mini
> user
>> > dump
>> >
>> > *****
>> >
>> > Closing open log file D:\program
>> > files\iisstate\output\IISState-3420.log
>> >
>> >
>> >
>>
>>
>
>

RE: App Pool crash - 8007006d

I've been working a similar issue and have also engaged Microsoft support. ~10 days in and no solution yet. I'll be sure to post findings.

From http://developmentnow.com/g/59_2005_8_0_0_587274/App-Pool-cr ash--8007006d.htm

Posted via DevelopmentNow.com Groups
http://www.developmentnow.com