Re: IIS worker processer carsh
Re: IIS worker processer carsh
am 06.12.2007 18:50:28 von patfilot
This is heap corruption - most likely the corruption itself occurred a long
time before the crash (the thread crashed during tear down).
You'll need to run PageHeap to see if it can be caught.
Pat
"Masoud Bayan" wrote in message
news:utYo$wCOIHA.5160@TK2MSFTNGP05.phx.gbl...
> Hi,
>
> We are experiencing IIS worker process crashes on two test servers we use
> for our web application. You can find following debug dump logs.
>
> Any advice is appreciated.
>
> Thanks, Masoud
>
>
>
> -----------------------------
>
> Analysis Summary
> Type Description Recommendation
> Error In
> w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
> C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to write to memory location
> 0x0000006f on thread 41
>
> Heap corruption was detected in heap 0x00080000, however pageheap was not
> enabled in this dump. Please follow the instructions in the recommendation
> section for troubleshooting heap corruption issues.
>
> Current NTGlobalFlags value: 0x0 An access violation exception thrown by a
> heap memory manager function indicates heap corruption. Please follow the
> steps outlined in the following Knowledge Base article:
> 300966 Howto debug heap corruption issues in Internet Information Services
> (IIS)
> Information DebugDiag determined that this dump file
> (w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Sec ond_Chance_Excep
> tion_C0000005.dmp) is a crash dump and did not perform any hang analysis.
> If
> you wish to enable combined crash and hang analysis for crash dumps, edit
> the IISAnalysis.asp script (located in the DebugDiag\Scripts folder) and
> set
> the g_DoCombinedAnalysis constant to True.
>
>
>
>
> Analysis Details
> Table Of Contents
> w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> ion_C0000005.dmp
> Faulting Thread
> Faulting Module Information
>
>
> Report for
> w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> ion_C0000005.dmp
> Type of Analysis Performed Crash Analysis
> Machine Name TRAINING
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 1
> Process ID 5168
> Process Image c:\WINNT\system32\inetsrv\w3wp.exe
> System Up-Time 1 day(s) 00:11:53
> Process Up-Time 0 day(s) 00:37:32
>
>
> Thread 41 - System ID 3948
> Entry point msvcrt!_endthreadex+2f
> Create time 12/6/2007 11:19:02 AM
> Time spent in user mode 0 Days 0:0:0.62
> Time spent in kernel mode 0 Days 0:0:0.46
>
>
>
>
> Function Arg 1 Arg 2 Arg 3 Source
> ntdll!RtlFreeHeap+402 00080000 00000000 0721e6f0
> ole32!PrivateMemFree+16 0721e6f0 776bb87f 04bda148
> ole32!CFmCtrlUnknown::~CFmCtrlUnknown+e 04bda148 0505fb08
> 776bb868
> ole32!CFmCtrlUnknown::`scalar deleting destructor'+d 00000001
> 00000000 07102080
> ole32!CFmCtrlUnknown::Release+27 04bda148 07102080 4a775e71
> comsvcs!CSTAActivity::~CSTAActivity+45 07102080 0505fb34
> 4a7763a1
> comsvcs!CSTAActivity::`scalar deleting destructor'+d 00000001
> 00000000 07109df0
> comsvcs!CSTAActivity::Release+27 07102080 07109df0 4a775c7d
> comsvcs!CServiceActivity::~CServiceActivity+18 07109df0 0505fb60
> 4a776342
> comsvcs!CServiceActivity::`scalar deleting destructor'+d 00000001
> 05e21f18 06421e90
> comsvcs!CServiceActivity::Release+27 07109df0 06421e90
> 709e57b8
> asp!CViperActivity::UnInit+22 05e21e90 0505fb98 709e47a7
> asp!CViperActivity::`scalar deleting destructor'+d 00000001
> 00000000
> 05e21e90
> asp!CHitObj::~CHitObj+4e 06461e90 0505fbb4 709e2784
> asp!CHitObj::`vector deleting destructor'+d 00000001 00000000
> 04bdc0c0
> asp!CViperAsyncRequest::OnCall+cb 05ea1e90 0008d958 0505fd74
> comsvcs!CSTAActivityWork::STAActivityWorkHelper+32 04bdc0c0
> 0a63ba34
> 00000000
> ole32!EnterForCallback+c4 00000000 0a63ba34 4a77b5b8
> ole32!SwitchForCallback+1a3 0505fc54 4a77b5b8 04bdc0c0
> ole32!PerformCallback+54 0a63ba34 4a77b5b8 04bdc0c0
> ole32!CObjectContext::InternalContextCallback+159 0008d958
> 4a77b5b8
> 04bdc0c0
> ole32!CObjectContext::DoCallback+1c 0008d958 4a77b5b8 04bdc0c0
> comsvcs!CSTAActivityWork::DoWork+12d 0a677510 0a6774f0
> 04b36e9c
> comsvcs!CSTAThread::DoWork+18 04bdc0c0 00000001 0a6774f0
> comsvcs!CSTAThread::ProcessQueueWork+37 00000000 018c90b0
> 018d4c00
> comsvcs!CSTAThread::WorkerLoop+190 0a6774f0 00000000 00000000
> msvcrt!_endthreadex+a3 018d4c00 00000000 00000000
> kernel32!BaseThreadStart+34 77bcb4bc 018d4c00 00000000
>
>
> NTDLL!RTLFREEHEAP+402
>
>
> Detailed Info For Corrupt Heap
> Heap 1 - 0x00080000
> Heap Name Default process heap
> Heap Description This heap is created by default and shared by all
> modules
> in the process
> Reserved memory 8.06 MBytes
> Committed memory 5.09 MBytes (63.08% of reserved)
> Uncommitted memory 2.98 MBytes (36.92% of reserved)
> Number of heap segments 4 segments
> Number of uncommitted ranges 1 range(s)
> Size of largest uncommitted range 2.92 MBytes
> Calculated heap fragmentation 1.97%
>
>
>
> Segment Information
> Base Address Reserved Size Committed Size Uncommitted Size Number of
> uncommitted ranges Largest uncommitted block Calculated heap fragmentation
> 0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> 0x04b10000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> 0x07030000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x0a5e0000 4.00 MBytes 1.08 MBytes 2.92 MBytes 1 2.92 MBytes 0.00%
>
>
>
> Top 5 allocations by size
>
> Allocation Size - 32
> Allocation Size - 16
> Allocation Size - 49160
> Allocation Size - 904
> Allocation Size - 48
>
>
>
>
>
> 195.06 KBytes
> 98.05 KBytes
> 96.02 KBytes
> 88.28 KBytes
> 73.31 KBytes
>
>
> Top 5 allocations by count
>
> Allocation Size - 16
> Allocation Size - 32
> Allocation Size - 12
> Allocation Size - 48
> Allocation Size - 24
>
>
>
>
>
> 6275 allocation(s)
> 6242 allocation(s)
> 4115 allocation(s)
> 1564 allocation(s)
> 1054 allocation(s)
>
> Back to Top
>
>
>
> In
> w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
> C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to write to memory location
> 0x0000006f on thread 41
>
> Heap corruption was detected in heap 0x00080000, however pageheap was not
> enabled in this dump. Please follow the instructions in the recommendation
> section for troubleshooting heap corruption issues.
>
> Current NTGlobalFlags value: 0x0 Module Information
> Image Name: C:\WINNT\system32\ntdll.dll Symbol Type: PDB
> Base address: 0x7c800000 Time Stamp: Sat Feb 17 09:02:00 2007
> Checksum: 0x000bd6f9 Comments:
> COM DLL: False Company Name: Microsoft Corporation
> ISAPIExtension: False File Description: NT Layer DLL
> ISAPIFilter: False File Version: 5.2.3790.3959
> (srv03_sp2_rtm.070216-1710)
> Managed DLL: False Internal Name: ntdll.dll
> VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> reserved.
> Loaded Image Name: ntdll.dll Legal Trademarks:
> Mapped Image Name: Original filename: ntdll.dll
> Module name: ntdll Private Build:
> Single Threaded: False Product Name: Microsoft® Windows® Operating
> System
> Module Size: 768.00 KBytes Product Version: 5.2.3790.3959
> Symbol File Name:
> c:\symcache\ntdll.pdb\93E72E109DC84F16AA54797E4DA8C1682\ntdl l.pdb
> Special
> Build: &
>
>
> ------------------------------------
>
>
>
> Analysis Summary
> Type Description Recommendation
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 25 to determine root cause for the
> exception.
>
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 26
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 26 to determine root cause for the
> exception.
>
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
> exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 25 to determine root cause for the
> exception.
>
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First chance
> exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
>
>
>
>
> Analysis Details
> Table Of Contents
> inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
> exception 0X800706BF.dmp
> Faulting Thread
> Faulting Module Information
>
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
> exception 0X800706BA.dmp
> Faulting Thread
> Faulting Module Information
>
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
> exception 0X800706BA.dmp
> Faulting Thread
> Faulting Module Information
>
>
> Report for
> inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
> exception 0X800706BF.dmp
> Type of Analysis Performed Crash Analysis
> Machine Name TRAINING
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 1
> Process ID 3340
> Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> System Up-Time 1 day(s) 00:12:03
> Process Up-Time 0 day(s) 00:38:02
>
>
> Thread 25 - System ID 4952
> Entry point ntdll!RtlpWorkerThread
> Create time 12/6/2007 11:19:04 AM
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.0
>
>
>
>
> Function Arg 1 Arg 2 Arg 3 Source
> kernel32!RaiseException+53 800706bf 00000001 00000000
> rpcrt4!RpcpRaiseException+24 800706bf 0bae2fc4 036cfafc
> rpcrt4!NdrProxySendReceive+60 0bae2fc4 800706bf 0600016e
> rpcrt4!NdrClientCall2+206 776762b8 776792b0 036cfb34
> rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
> rpcrt4!ObjectStubless+f 0bae2fc4 00000002 04078f40
> ole32!RemoteReleaseRifRefHelper+86 0bae2fc4 08138d80 00000002
> ole32!RemoteReleaseRifRef+74 0bae2fc4 08138d80 00000002
> ole32!CStdMarshal::DisconnectCliIPIDs+245 0ba50f24 0ba50f20
> 00000000
> ole32!CStdMarshal::Disconnect+193 00000002 0ba50fc8 0ba50f20
> ole32!CStdIdentity::~CStdIdentity+89 0ba50f20 036cfc4c
> 776ba675
> ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> 00c2c738
> ffffffff
> ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
> 7769c1c7
> ole32!ReleaseCallback+e 0ba50fc4 00c2c738 00c08e34
> ole32!PerformCallback+17 00c2c738 7769c1d5 0ba50fc4
> ole32!CObjectContext::InternalContextCallback+159 00c2c738
> 7769c1d5
> 0ba50fc4
> ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c104
> 00000000
> ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c104
> 00000000
> coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> 00000000
> coadmin!CADMCOMW::Terminate+40 00000000 0a9ceee0 56f96b3e
> coadmin!CADMCOMW::~CADMCOMW+12 0a9ceee0 036cfe14 56f9791f
> coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0a9ceee0
> 0a9ceee0
> coadmin!CADMCOMW::Release+4f 0a9ceee0 00000001 00000000
> coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0a9ceee0
> 0a9ceee0
> coadmin!CADMCOMW::Release+3c 0a9ceee0 00000001 00000000
> coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> 00000000
> coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0a9ceee0
> 0bae8f00 0bae8fc0
> ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0a9ceee0 0bae8f00
> ntdll!RtlpAsyncWaitCallbackCompletion+37 0bae8fc0 7c889080
> 040b1fe8
> ntdll!RtlpWorkerCallout+71 7c83ca2b 0bae8fc0 00000000
> ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bae8fc0 040b1fe8
> ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bae8fc0
> ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
>
>
> In inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
> chance
> exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Module
> Information
> Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> Checksum: 0x001083fc Comments:
> COM DLL: False Company Name: Microsoft Corporation
> ISAPIExtension: False File Description: Windows NT BASE API Client DLL
> ISAPIFilter: False File Version: 5.2.3790.4062
> (srv03_sp2_gdr.070417-0203)
> Managed DLL: False Internal Name: kernel32
> VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> reserved.
> Loaded Image Name: kernel32.dll Legal Trademarks:
> Mapped Image Name: Original filename: kernel32
> Module name: kernel32 Private Build:
> Single Threaded: False Product Name: Microsoft® Windows® Operating
> System
> Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> Symbol File Name:
> c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> Special Build: &
>
>
>
> Report for
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
> exception 0X800706BA.dmp
> Type of Analysis Performed Crash Analysis
> Machine Name TRAINING
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 1
> Process ID 3340
> Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> System Up-Time 1 day(s) 00:12:11
> Process Up-Time 0 day(s) 00:38:12
>
>
> Thread 26 - System ID 2388
> Entry point ntdll!RtlpWorkerThread
> Create time 12/6/2007 11:19:58 AM
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.0
>
>
>
>
> Function Arg 1 Arg 2 Arg 3 Source
> kernel32!RaiseException+53 800706ba 00000001 00000000
> rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0c89cfc4
> rpcrt4!NdrProxyGetBuffer+57 0c89cfc4 0093f75c 0600016e
> rpcrt4!NdrClientCall2+173 776762b8 776792b0 0093fb34
> rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
> rpcrt4!ObjectStubless+f 0c89cfc4 00000002 0cc9cf40
> ole32!RemoteReleaseRifRefHelper+86 0c89cfc4 08138d80 00000002
> ole32!RemoteReleaseRifRef+74 0c89cfc4 08138d80 00000002
> ole32!CStdMarshal::DisconnectCliIPIDs+245 0c890f24 0c890f20
> 00000000
> ole32!CStdMarshal::Disconnect+193 00000002 0c890fc8 0c890f20
> ole32!CStdIdentity::~CStdIdentity+89 0c890f20 0093fc4c
> 776ba675
> ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> 00c2c738
> ffffffff
> ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
> 7769c1c7
> ole32!ReleaseCallback+e 0c890fc4 00c2c738 00c08e34
> ole32!PerformCallback+17 00c2c738 7769c1d5 0c890fc4
> ole32!CObjectContext::InternalContextCallback+159 00c2c738
> 7769c1d5
> 0c890fc4
> ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c106
> 00000000
> ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c106
> 00000000
> coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> 00000000
> coadmin!CADMCOMW::Terminate+40 00000000 084f6ee0 56f96b3e
> coadmin!CADMCOMW::~CADMCOMW+12 084f6ee0 0093fe14 56f9791f
> coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 084f6ee0
> 084f6ee0
> coadmin!CADMCOMW::Release+4f 084f6ee0 00000001 00000000
> coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 084f6ee0
> 084f6ee0
> coadmin!CADMCOMW::Release+3c 084f6ee0 00000001 00000000
> coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> 00000000
> coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 084f6ee0
> 0c86af00 0c86afc0
> ntdll!RtlpWaitOrTimerCallout+74 56f977ce 084f6ee0 0c86af00
> ntdll!RtlpAsyncWaitCallbackCompletion+37 0c86afc0 7c889080
> 040b9fe8
> ntdll!RtlpWorkerCallout+71 7c83ca2b 0c86afc0 00000000
> ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c86afc0 040b9fe8
> ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c86afc0
> ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
>
>
> In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
> chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 26
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Module
> Information
> Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> Checksum: 0x001083fc Comments:
> COM DLL: False Company Name: Microsoft Corporation
> ISAPIExtension: False File Description: Windows NT BASE API Client DLL
> ISAPIFilter: False File Version: 5.2.3790.4062
> (srv03_sp2_gdr.070417-0203)
> Managed DLL: False Internal Name: kernel32
> VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> reserved.
> Loaded Image Name: kernel32.dll Legal Trademarks:
> Mapped Image Name: Original filename: kernel32
> Module name: kernel32 Private Build:
> Single Threaded: False Product Name: Microsoft® Windows® Operating
> System
> Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> Symbol File Name:
> c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> Special Build: &
>
>
>
> Report for
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
> exception 0X800706BA.dmp
> Type of Analysis Performed Crash Analysis
> Machine Name TRAINING
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 1
> Process ID 3340
> Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> System Up-Time 1 day(s) 00:12:07
> Process Up-Time 0 day(s) 00:38:09
>
>
> Thread 25 - System ID 4952
> Entry point ntdll!RtlpWorkerThread
> Create time 12/6/2007 11:19:04 AM
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.0
>
>
>
>
> Function Arg 1 Arg 2 Arg 3 Source
> kernel32!RaiseException+53 800706ba 00000001 00000000
> rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0b96afc4
> rpcrt4!NdrProxyGetBuffer+57 0b96afc4 036cf75c 0600016e
> rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
> rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
> rpcrt4!ObjectStubless+f 0b96afc4 00000002 0cd0bf40
> ole32!RemoteReleaseRifRefHelper+86 0b96afc4 08138d80 00000002
> ole32!RemoteReleaseRifRef+74 0b96afc4 08138d80 00000002
> ole32!CStdMarshal::DisconnectCliIPIDs+245 09140f24 09140f20
> 00000000
> ole32!CStdMarshal::Disconnect+193 00000002 09140fc8 09140f20
> ole32!CStdIdentity::~CStdIdentity+89 09140f20 036cfc4c
> 776ba675
> ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> 00c2c738
> ffffffff
> ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
> 7769c1c7
> ole32!ReleaseCallback+e 09140fc4 00c2c738 00c08e34
> ole32!PerformCallback+17 00c2c738 7769c1d5 09140fc4
> ole32!CObjectContext::InternalContextCallback+159 00c2c738
> 7769c1d5
> 09140fc4
> ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c105
> 00000000
> ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c105
> 00000000
> coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> 00000000
> coadmin!CADMCOMW::Terminate+40 00000000 0c824ee0 56f96b3e
> coadmin!CADMCOMW::~CADMCOMW+12 0c824ee0 036cfe14 56f9791f
> coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0c824ee0
> 0c824ee0
> coadmin!CADMCOMW::Release+4f 0c824ee0 00000001 00000000
> coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0c824ee0
> 0c824ee0
> coadmin!CADMCOMW::Release+3c 0c824ee0 00000001 00000000
> coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> 00000000
> coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0c824ee0
> 0baeef00 0baeefc0
> ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0c824ee0 0baeef00
> ntdll!RtlpAsyncWaitCallbackCompletion+37 0baeefc0 7c889080
> 040b7fe8
> ntdll!RtlpWorkerCallout+71 7c83ca2b 0baeefc0 00000000
> ntdll!RtlpExecuteWorkerRequest+4f 00000000 0baeefc0 040b7fe8
> ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0baeefc0
> ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
>
>
> In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
> chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Module
> Information
> Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> Checksum: 0x001083fc Comments:
> COM DLL: False Company Name: Microsoft Corporation
> ISAPIExtension: False File Description: Windows NT BASE API Client DLL
> ISAPIFilter: False File Version: 5.2.3790.4062
> (srv03_sp2_gdr.070417-0203)
> Managed DLL: False Internal Name: kernel32
> VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> reserved.
> Loaded Image Name: kernel32.dll Legal Trademarks:
> Mapped Image Name: Original filename: kernel32
> Module name: kernel32 Private Build:
> Single Threaded: False Product Name: Microsoft® Windows® Operating
> System
> Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> Symbol File Name:
> c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> Special Build: &
>
>
IIS worker processer carsh
am 06.12.2007 21:19:18 von masoud bayan
Hi,
We are experiencing IIS worker process crashes on two test servers we use
for our web application. You can find following debug dump logs.
Any advice is appreciated.
Thanks, Masoud
-----------------------------
Analysis Summary
Type Description Recommendation
Error In
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to write to memory location
0x0000006f on thread 41
Heap corruption was detected in heap 0x00080000, however pageheap was not
enabled in this dump. Please follow the instructions in the recommendation
section for troubleshooting heap corruption issues.
Current NTGlobalFlags value: 0x0 An access violation exception thrown by a
heap memory manager function indicates heap corruption. Please follow the
steps outlined in the following Knowledge Base article:
300966 Howto debug heap corruption issues in Internet Information Services
(IIS)
Information DebugDiag determined that this dump file
(w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Sec ond_Chance_Excep
tion_C0000005.dmp) is a crash dump and did not perform any hang analysis. If
you wish to enable combined crash and hang analysis for crash dumps, edit
the IISAnalysis.asp script (located in the DebugDiag\Scripts folder) and set
the g_DoCombinedAnalysis constant to True.
Analysis Details
Table Of Contents
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
ion_C0000005.dmp
Faulting Thread
Faulting Module Information
Report for
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
ion_C0000005.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 5168
Process Image c:\WINNT\system32\inetsrv\w3wp.exe
System Up-Time 1 day(s) 00:11:53
Process Up-Time 0 day(s) 00:37:32
Thread 41 - System ID 3948
Entry point msvcrt!_endthreadex+2f
Create time 12/6/2007 11:19:02 AM
Time spent in user mode 0 Days 0:0:0.62
Time spent in kernel mode 0 Days 0:0:0.46
Function Arg 1 Arg 2 Arg 3 Source
ntdll!RtlFreeHeap+402 00080000 00000000 0721e6f0
ole32!PrivateMemFree+16 0721e6f0 776bb87f 04bda148
ole32!CFmCtrlUnknown::~CFmCtrlUnknown+e 04bda148 0505fb08
776bb868
ole32!CFmCtrlUnknown::`scalar deleting destructor'+d 00000001
00000000 07102080
ole32!CFmCtrlUnknown::Release+27 04bda148 07102080 4a775e71
comsvcs!CSTAActivity::~CSTAActivity+45 07102080 0505fb34
4a7763a1
comsvcs!CSTAActivity::`scalar deleting destructor'+d 00000001
00000000 07109df0
comsvcs!CSTAActivity::Release+27 07102080 07109df0 4a775c7d
comsvcs!CServiceActivity::~CServiceActivity+18 07109df0 0505fb60
4a776342
comsvcs!CServiceActivity::`scalar deleting destructor'+d 00000001
05e21f18 06421e90
comsvcs!CServiceActivity::Release+27 07109df0 06421e90 709e57b8
asp!CViperActivity::UnInit+22 05e21e90 0505fb98 709e47a7
asp!CViperActivity::`scalar deleting destructor'+d 00000001 00000000
05e21e90
asp!CHitObj::~CHitObj+4e 06461e90 0505fbb4 709e2784
asp!CHitObj::`vector deleting destructor'+d 00000001 00000000
04bdc0c0
asp!CViperAsyncRequest::OnCall+cb 05ea1e90 0008d958 0505fd74
comsvcs!CSTAActivityWork::STAActivityWorkHelper+32 04bdc0c0 0a63ba34
00000000
ole32!EnterForCallback+c4 00000000 0a63ba34 4a77b5b8
ole32!SwitchForCallback+1a3 0505fc54 4a77b5b8 04bdc0c0
ole32!PerformCallback+54 0a63ba34 4a77b5b8 04bdc0c0
ole32!CObjectContext::InternalContextCallback+159 0008d958 4a77b5b8
04bdc0c0
ole32!CObjectContext::DoCallback+1c 0008d958 4a77b5b8 04bdc0c0
comsvcs!CSTAActivityWork::DoWork+12d 0a677510 0a6774f0 04b36e9c
comsvcs!CSTAThread::DoWork+18 04bdc0c0 00000001 0a6774f0
comsvcs!CSTAThread::ProcessQueueWork+37 00000000 018c90b0
018d4c00
comsvcs!CSTAThread::WorkerLoop+190 0a6774f0 00000000 00000000
msvcrt!_endthreadex+a3 018d4c00 00000000 00000000
kernel32!BaseThreadStart+34 77bcb4bc 018d4c00 00000000
NTDLL!RTLFREEHEAP+402
Detailed Info For Corrupt Heap
Heap 1 - 0x00080000
Heap Name Default process heap
Heap Description This heap is created by default and shared by all modules
in the process
Reserved memory 8.06 MBytes
Committed memory 5.09 MBytes (63.08% of reserved)
Uncommitted memory 2.98 MBytes (36.92% of reserved)
Number of heap segments 4 segments
Number of uncommitted ranges 1 range(s)
Size of largest uncommitted range 2.92 MBytes
Calculated heap fragmentation 1.97%
Segment Information
Base Address Reserved Size Committed Size Uncommitted Size Number of
uncommitted ranges Largest uncommitted block Calculated heap fragmentation
0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
0x04b10000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
0x07030000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x0a5e0000 4.00 MBytes 1.08 MBytes 2.92 MBytes 1 2.92 MBytes 0.00%
Top 5 allocations by size
Allocation Size - 32
Allocation Size - 16
Allocation Size - 49160
Allocation Size - 904
Allocation Size - 48
195.06 KBytes
98.05 KBytes
96.02 KBytes
88.28 KBytes
73.31 KBytes
Top 5 allocations by count
Allocation Size - 16
Allocation Size - 32
Allocation Size - 12
Allocation Size - 48
Allocation Size - 24
6275 allocation(s)
6242 allocation(s)
4115 allocation(s)
1564 allocation(s)
1054 allocation(s)
Back to Top
In
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to write to memory location
0x0000006f on thread 41
Heap corruption was detected in heap 0x00080000, however pageheap was not
enabled in this dump. Please follow the instructions in the recommendation
section for troubleshooting heap corruption issues.
Current NTGlobalFlags value: 0x0 Module Information
Image Name: C:\WINNT\system32\ntdll.dll Symbol Type: PDB
Base address: 0x7c800000 Time Stamp: Sat Feb 17 09:02:00 2007
Checksum: 0x000bd6f9 Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: NT Layer DLL
ISAPIFilter: False File Version: 5.2.3790.3959
(srv03_sp2_rtm.070216-1710)
Managed DLL: False Internal Name: ntdll.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: ntdll.dll Legal Trademarks:
Mapped Image Name: Original filename: ntdll.dll
Module name: ntdll Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 768.00 KBytes Product Version: 5.2.3790.3959
Symbol File Name:
c:\symcache\ntdll.pdb\93E72E109DC84F16AA54797E4DA8C1682\ntdl l.pdb Special
Build: &
------------------------------------
Analysis Summary
Type Description Recommendation
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 25 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 26
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 26 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 25 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First chance
exception 0X800706BF.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Analysis Details
Table Of Contents
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:03
Process Up-Time 0 day(s) 00:38:02
Thread 25 - System ID 4952
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:04 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706bf 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706bf 0bae2fc4 036cfafc
rpcrt4!NdrProxySendReceive+60 0bae2fc4 800706bf 0600016e
rpcrt4!NdrClientCall2+206 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0bae2fc4 00000002 04078f40
ole32!RemoteReleaseRifRefHelper+86 0bae2fc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0bae2fc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0ba50f24 0ba50f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0ba50fc8 0ba50f20
ole32!CStdIdentity::~CStdIdentity+89 0ba50f20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 0ba50fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0ba50fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0ba50fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c104
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c104
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0a9ceee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0a9ceee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0a9ceee0
0a9ceee0
coadmin!CADMCOMW::Release+4f 0a9ceee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0a9ceee0
0a9ceee0
coadmin!CADMCOMW::Release+3c 0a9ceee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0a9ceee0
0bae8f00 0bae8fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0a9ceee0 0bae8f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0bae8fc0 7c889080
040b1fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0bae8fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bae8fc0 040b1fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bae8fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:11
Process Up-Time 0 day(s) 00:38:12
Thread 26 - System ID 2388
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:58 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0c89cfc4
rpcrt4!NdrProxyGetBuffer+57 0c89cfc4 0093f75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 0093fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
rpcrt4!ObjectStubless+f 0c89cfc4 00000002 0cc9cf40
ole32!RemoteReleaseRifRefHelper+86 0c89cfc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0c89cfc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0c890f24 0c890f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0c890fc8 0c890f20
ole32!CStdIdentity::~CStdIdentity+89 0c890f20 0093fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
7769c1c7
ole32!ReleaseCallback+e 0c890fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0c890fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0c890fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c106
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c106
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 084f6ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 084f6ee0 0093fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 084f6ee0
084f6ee0
coadmin!CADMCOMW::Release+4f 084f6ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 084f6ee0
084f6ee0
coadmin!CADMCOMW::Release+3c 084f6ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 084f6ee0
0c86af00 0c86afc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 084f6ee0 0c86af00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0c86afc0 7c889080
040b9fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0c86afc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c86afc0 040b9fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c86afc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 26
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:07
Process Up-Time 0 day(s) 00:38:09
Thread 25 - System ID 4952
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:04 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0b96afc4
rpcrt4!NdrProxyGetBuffer+57 0b96afc4 036cf75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0b96afc4 00000002 0cd0bf40
ole32!RemoteReleaseRifRefHelper+86 0b96afc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0b96afc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 09140f24 09140f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 09140fc8 09140f20
ole32!CStdIdentity::~CStdIdentity+89 09140f20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 09140fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 09140fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
09140fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c105
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c105
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0c824ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0c824ee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0c824ee0
0c824ee0
coadmin!CADMCOMW::Release+4f 0c824ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0c824ee0
0c824ee0
coadmin!CADMCOMW::Release+3c 0c824ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0c824ee0
0baeef00 0baeefc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0c824ee0 0baeef00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0baeefc0 7c889080
040b7fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0baeefc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0baeefc0 040b7fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0baeefc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Re: IIS worker processer carsh
am 07.12.2007 00:47:36 von masoud bayan
Thanks for your reply.
If you look at the debug log, it has two sections and second section is heap
page log. I used the same IIS debug diagnostic tool and used advanced
pageheap config and attach to inetinfo.exe.
Do I need to use PageHeap tool instead?
following I am pasting the advanced pageheap dump analyzes:
Thanks
Analysis Summary
Type Description Recommendation
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 25 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 23
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 23 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 26
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 26 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 44
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 44 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First
chance exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 42
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 42 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 42
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 42 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 25 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 43
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 43 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 25 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Error In inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First
chance exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 24
This exception originated from rpcrt4!RpcpRaiseException+24. Review the
faulting call stack for thread 24 to determine root cause for the exception.
Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINNT\system32\rpcrt4.dll.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46_ _First chance
exception 0X800706BF.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765 __First chance
exception 0X800706BF.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31_ _First chance
exception 0X800706BF.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First chance
exception 0X800706BF.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
folder) and set the g_DoCombinedAnalysis constant to True.
Information DebugDiag determined that this dump file
(inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875 __First chance
exception 0X800706BA.dmp) is a crash dump and did not perform any hang
analysis. If you wish to enable combined crash and hang analysis for crash
dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts fol
der) and set the g_DoCombinedAnalysis constant to True.
Analysis Details
Table Of Contents
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First chance
exception 0X800706BF.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First chance
exception 0X800706BF.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First chance
exception 0X800706BF.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First chance
exception 0X800706BA.dmp
Faulting Thread
Faulting Module Information
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:03
Process Up-Time 0 day(s) 00:38:02
Thread 25 - System ID 4952
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:04 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706bf 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706bf 0bae2fc4 036cfafc
rpcrt4!NdrProxySendReceive+60 0bae2fc4 800706bf 0600016e
rpcrt4!NdrClientCall2+206 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0bae2fc4 00000002 04078f40
ole32!RemoteReleaseRifRefHelper+86 0bae2fc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0bae2fc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0ba50f24 0ba50f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0ba50fc8 0ba50f20
ole32!CStdIdentity::~CStdIdentity+89 0ba50f20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 0ba50fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0ba50fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0ba50fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c104
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c104
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0a9ceee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0a9ceee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0a9ceee0
0a9ceee0
coadmin!CADMCOMW::Release+4f 0a9ceee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0a9ceee0
0a9ceee0
coadmin!CADMCOMW::Release+3c 0a9ceee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0a9ceee0
0bae8f00 0bae8fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0a9ceee0 0bae8f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0bae8fc0 7c889080
040b1fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0bae8fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bae8fc0 040b1fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bae8fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:11
Process Up-Time 0 day(s) 00:38:12
Thread 26 - System ID 2388
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:58 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0c89cfc4
rpcrt4!NdrProxyGetBuffer+57 0c89cfc4 0093f75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 0093fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
rpcrt4!ObjectStubless+f 0c89cfc4 00000002 0cc9cf40
ole32!RemoteReleaseRifRefHelper+86 0c89cfc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0c89cfc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0c890f24 0c890f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0c890fc8 0c890f20
ole32!CStdIdentity::~CStdIdentity+89 0c890f20 0093fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
7769c1c7
ole32!ReleaseCallback+e 0c890fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0c890fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0c890fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c106
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c106
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 084f6ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 084f6ee0 0093fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 084f6ee0
084f6ee0
coadmin!CADMCOMW::Release+4f 084f6ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 084f6ee0
084f6ee0
coadmin!CADMCOMW::Release+3c 084f6ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 084f6ee0
0c86af00 0c86afc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 084f6ee0 0c86af00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0c86afc0 7c889080
040b9fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0c86afc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c86afc0 040b9fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c86afc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 26
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First
chance exception 0X800706BF.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 4680
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 03:26:31
Process Up-Time 0 day(s) 00:26:12
Thread 42 - System ID 5832
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 2:33:34 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706bf 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706bf 0866cfc4 0093fafc
rpcrt4!NdrProxySendReceive+60 0866cfc4 800706bf 0600016e
rpcrt4!NdrClientCall2+206 776762b8 776792b0 0093fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
rpcrt4!ObjectStubless+f 0866cfc4 00000002 0be7cf40
ole32!RemoteReleaseRifRefHelper+86 0866cfc4 04b28c00 00000002
ole32!RemoteReleaseRifRef+74 0866cfc4 04b28c00 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0867cf24 0867cf20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0867cfc8 0867cf20
ole32!CStdIdentity::~CStdIdentity+89 0867cf20 0093fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
7769c1c7
ole32!ReleaseCallback+e 0867cfc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0867cfc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0867cfc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c206
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c206
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 084aaee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 084aaee0 0093fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 084aaee0
084aaee0
coadmin!CADMCOMW::Release+4f 084aaee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 084aaee0
084aaee0
coadmin!CADMCOMW::Release+3c 084aaee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 084aaee0
08638f00 08638fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 084aaee0 08638f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 08638fc0 7c889080
0c08cfe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 08638fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 08638fc0 0c08cfe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 08638fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 42
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 01:34:26
Process Up-Time 0 day(s) 02:00:28
Thread 25 - System ID 3136
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 12:42:19 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0cc46fc4
rpcrt4!NdrProxyGetBuffer+57 0cc46fc4 0418f75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 0418fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0418fb44
rpcrt4!ObjectStubless+f 0cc46fc4 00000002 0bd16f40
ole32!RemoteReleaseRifRefHelper+86 0cc46fc4 08138c00 00000002
ole32!RemoteReleaseRifRef+74 0cc46fc4 08138c00 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 04c44f24 04c44f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 04c44fc8 04c44f20
ole32!CStdIdentity::~CStdIdentity+89 04c44f20 0418fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0418fc6c
7769c1c7
ole32!ReleaseCallback+e 04c44fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 04c44fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
04c44fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c204
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c204
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0c77eee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0c77eee0 0418fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0c77eee0
0c77eee0
coadmin!CADMCOMW::Release+4f 0c77eee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0c77eee0
0c77eee0
coadmin!CADMCOMW::Release+3c 0c77eee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0c77eee0
0bd94f00 0bd94fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0c77eee0 0bd94f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0bd94fc0 7c889080
0ccd5fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0bd94fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bd94fc0 0ccd5fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bd94fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 00:12:07
Process Up-Time 0 day(s) 00:38:09
Thread 25 - System ID 4952
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 11:19:04 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0b96afc4
rpcrt4!NdrProxyGetBuffer+57 0b96afc4 036cf75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0b96afc4 00000002 0cd0bf40
ole32!RemoteReleaseRifRefHelper+86 0b96afc4 08138d80 00000002
ole32!RemoteReleaseRifRef+74 0b96afc4 08138d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 09140f24 09140f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 09140fc8 09140f20
ole32!CStdIdentity::~CStdIdentity+89 09140f20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 09140fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 09140fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
09140fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c105
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c105
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0c824ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0c824ee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0c824ee0
0c824ee0
coadmin!CADMCOMW::Release+4f 0c824ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0c824ee0
0c824ee0
coadmin!CADMCOMW::Release+3c 0c824ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0c824ee0
0baeef00 0baeefc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0c824ee0 0baeef00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0baeefc0 7c889080
040b7fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0baeefc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0baeefc0 040b7fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0baeefc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 25
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First
chance exception 0X800706BF.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 01:34:20
Process Up-Time 0 day(s) 02:00:23
Thread 24 - System ID 5900
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 12:42:19 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706bf 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706bf 09a8cfc4 0093fafc
rpcrt4!NdrProxySendReceive+60 09a8cfc4 800706bf 0600016e
rpcrt4!NdrClientCall2+206 776762b8 776792b0 0093fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
rpcrt4!ObjectStubless+f 09a8cfc4 00000002 0cc94f40
ole32!RemoteReleaseRifRefHelper+86 09a8cfc4 08138c00 00000002
ole32!RemoteReleaseRifRef+74 09a8cfc4 08138c00 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0bc70f24 0bc70f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0bc70fc8 0bc70f20
ole32!CStdIdentity::~CStdIdentity+89 0bc70f20 0093fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
7769c1c7
ole32!ReleaseCallback+e 0bc70fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0bc70fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0bc70fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c206
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c206
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 08532ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 08532ee0 0093fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 08532ee0
08532ee0
coadmin!CADMCOMW::Release+4f 08532ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 08532ee0
08532ee0
coadmin!CADMCOMW::Release+3c 08532ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 08532ee0
0ba28f00 0ba28fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 08532ee0 0ba28f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0ba28fc0 7c889080
09fa2fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0ba28fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0ba28fc0 09fa2fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0ba28fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 24
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First chance
exception 0X800706BF.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 4680
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 03:15:55
Process Up-Time 0 day(s) 00:15:35
Thread 43 - System ID 4032
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 2:23:24 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706bf 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706bf 0c103fc4 0093fafc
rpcrt4!NdrProxySendReceive+60 0c103fc4 800706bf 0600016e
rpcrt4!NdrClientCall2+206 776762b8 776792b0 0093fb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
rpcrt4!ObjectStubless+f 0c103fc4 00000002 03cf0f40
ole32!RemoteReleaseRifRefHelper+86 0c103fc4 04b28d80 00000002
ole32!RemoteReleaseRifRef+74 0c103fc4 04b28d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0bf40f24 0bf40f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0bf40fc8 0bf40f20
ole32!CStdIdentity::~CStdIdentity+89 0bf40f20 0093fc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
7769c1c7
ole32!ReleaseCallback+e 0bf40fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0bf40fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0bf40fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c104
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c104
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 083e2ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 083e2ee0 0093fe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 083e2ee0
083e2ee0
coadmin!CADMCOMW::Release+4f 083e2ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 083e2ee0
083e2ee0
coadmin!CADMCOMW::Release+3c 083e2ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 083e2ee0
0c2a6f00 0c2a6fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 083e2ee0 0c2a6f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0c2a6fc0 7c889080
03938fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0c2a6fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c2a6fc0 03938fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c2a6fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First chance
exception 0X800706BF.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706bf) on thread 43
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 4680
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 03:16:03
Process Up-Time 0 day(s) 00:15:43
Thread 42 - System ID 4296
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 2:22:24 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0bf4cfc4
rpcrt4!NdrProxyGetBuffer+57 0bf4cfc4 054cf75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 054cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 054cfb44
rpcrt4!ObjectStubless+f 0bf4cfc4 00000002 0c14df40
ole32!RemoteReleaseRifRefHelper+86 0bf4cfc4 04b28d80 00000002
ole32!RemoteReleaseRifRef+74 0bf4cfc4 04b28d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0c1d4f24 0c1d4f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0c1d4fc8 0c1d4f20
ole32!CStdIdentity::~CStdIdentity+89 0c1d4f20 054cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 054cfc6c
7769c1c7
ole32!ReleaseCallback+e 0c1d4fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0c1d4fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0c1d4fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c106
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c106
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0a026ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0a026ee0 054cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0a026ee0
0a026ee0
coadmin!CADMCOMW::Release+4f 0a026ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0a026ee0
0a026ee0
coadmin!CADMCOMW::Release+3c 0a026ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0a026ee0
0ba1af00 0ba1afc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0a026ee0 0ba1af00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0ba1afc0 7c889080
0865efe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0ba1afc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0ba1afc0 0865efe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0ba1afc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 42
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 4680
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 03:15:58
Process Up-Time 0 day(s) 00:15:39
Thread 44 - System ID 4192
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 2:23:24 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0c264fc4
rpcrt4!NdrProxyGetBuffer+57 0c264fc4 036cf75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0c264fc4 00000002 0ab09f40
ole32!RemoteReleaseRifRefHelper+86 0c264fc4 04b28d80 00000002
ole32!RemoteReleaseRifRef+74 0c264fc4 04b28d80 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0c25cf24 0c25cf20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0c25cfc8 0c25cf20
ole32!CStdIdentity::~CStdIdentity+89 0c25cf20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 0c25cfc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0c25cfc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0c25cfc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c105
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c105
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0841eee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0841eee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0841eee0
0841eee0
coadmin!CADMCOMW::Release+4f 0841eee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0841eee0
0841eee0
coadmin!CADMCOMW::Release+3c 0841eee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0841eee0
0c0d2f00 0c0d2fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0841eee0 0c0d2f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0c0d2fc0 7c889080
0c17efe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0c0d2fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c0d2fc0 0c17efe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c0d2fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 44
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Report for
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First chance
exception 0X800706BA.dmp
Type of Analysis Performed Crash Analysis
Machine Name TRAINING
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 1
Process ID 3340
Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
System Up-Time 1 day(s) 01:34:23
Process Up-Time 0 day(s) 02:00:25
Thread 23 - System ID 3600
Entry point ntdll!RtlpWorkerThread
Create time 12/6/2007 12:41:19 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 800706ba 00000001 00000000
rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0afbefc4
rpcrt4!NdrProxyGetBuffer+57 0afbefc4 036cf75c 0600016e
rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
rpcrt4!ObjectStubless+f 0afbefc4 00000002 0c916f40
ole32!RemoteReleaseRifRefHelper+86 0afbefc4 08138c00 00000002
ole32!RemoteReleaseRifRef+74 0afbefc4 08138c00 00000002
ole32!CStdMarshal::DisconnectCliIPIDs+245 0afd4f24 0afd4f20
00000000
ole32!CStdMarshal::Disconnect+193 00000002 0afd4fc8 0afd4f20
ole32!CStdIdentity::~CStdIdentity+89 0afd4f20 036cfc4c 776ba675
ole32!CStdIdentity::`scalar deleting destructor'+d 00000001 00c2c738
ffffffff
ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
7769c1c7
ole32!ReleaseCallback+e 0afd4fc4 00c2c738 00c08e34
ole32!PerformCallback+17 00c2c738 7769c1d5 0afd4fc4
ole32!CObjectContext::InternalContextCallback+159 00c2c738 7769c1d5
0afd4fc4
ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c205
00000000
ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c205
00000000
coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
00000000
coadmin!CADMCOMW::Terminate+40 00000000 0cba6ee0 56f96b3e
coadmin!CADMCOMW::~CADMCOMW+12 0cba6ee0 036cfe14 56f9791f
coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001 0cba6ee0
0cba6ee0
coadmin!CADMCOMW::Release+4f 0cba6ee0 00000001 00000000
coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0cba6ee0
0cba6ee0
coadmin!CADMCOMW::Release+3c 0cba6ee0 00000001 00000000
coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
00000000
coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0cba6ee0
0bb20f00 0bb20fc0
ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0cba6ee0 0bb20f00
ntdll!RtlpAsyncWaitCallbackCompletion+37 0bb20fc0 7c889080
09fa4fe8
ntdll!RtlpWorkerCallout+71 7c83ca2b 0bb20fc0 00000000
ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bb20fc0 09fa4fe8
ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bb20fc0
ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
In inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First chance
exception 0X800706BA.dmp the assembly instruction at
kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
Corporation has caused an unknown exception (0x800706ba) on thread 23
This exception originated from rpcrt4!RpcpRaiseException+24. Module
Information
Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
Checksum: 0x001083fc Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Windows NT BASE API Client DLL
ISAPIFilter: False File Version: 5.2.3790.4062
(srv03_sp2_gdr.070417-0203)
Managed DLL: False Internal Name: kernel32
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: kernel32.dll Legal Trademarks:
Mapped Image Name: Original filename: kernel32
Module name: kernel32 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating
System
Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
Symbol File Name:
c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
Special Build: &
Script Summary
Script Name Status Error Code Error Source Error Description Source Line
IISAnalysis.asp Completed
"Pat [MSFT]" wrote in message
news:81C5E727-378B-4D51-928C-79F0FDB06E53@microsoft.com...
> This is heap corruption - most likely the corruption itself occurred a
long
> time before the crash (the thread crashed during tear down).
>
> You'll need to run PageHeap to see if it can be caught.
>
>
> Pat
>
> "Masoud Bayan" wrote in message
> news:utYo$wCOIHA.5160@TK2MSFTNGP05.phx.gbl...
> > Hi,
> >
> > We are experiencing IIS worker process crashes on two test servers we
use
> > for our web application. You can find following debug dump logs.
> >
> > Any advice is appreciated.
> >
> > Thanks, Masoud
> >
> >
> >
> > -----------------------------
> >
> > Analysis Summary
> > Type Description Recommendation
> > Error In
> >
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> > ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
> > C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to write to memory location
> > 0x0000006f on thread 41
> >
> > Heap corruption was detected in heap 0x00080000, however pageheap was
not
> > enabled in this dump. Please follow the instructions in the
recommendation
> > section for troubleshooting heap corruption issues.
> >
> > Current NTGlobalFlags value: 0x0 An access violation exception thrown by
a
> > heap memory manager function indicates heap corruption. Please follow
the
> > steps outlined in the following Knowledge Base article:
> > 300966 Howto debug heap corruption issues in Internet Information
Services
> > (IIS)
> > Information DebugDiag determined that this dump file
> >
(w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Sec ond_Chance_Excep
> > tion_C0000005.dmp) is a crash dump and did not perform any hang
analysis.
> > If
> > you wish to enable combined crash and hang analysis for crash dumps,
edit
> > the IISAnalysis.asp script (located in the DebugDiag\Scripts folder) and
> > set
> > the g_DoCombinedAnalysis constant to True.
> >
> >
> >
> >
> > Analysis Details
> > Table Of Contents
> >
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> > ion_C0000005.dmp
> > Faulting Thread
> > Faulting Module Information
> >
> >
> > Report for
> >
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> > ion_C0000005.dmp
> > Type of Analysis Performed Crash Analysis
> > Machine Name TRAINING
> > Operating System Windows Server 2003 Service Pack 2
> > Number Of Processors 1
> > Process ID 5168
> > Process Image c:\WINNT\system32\inetsrv\w3wp.exe
> > System Up-Time 1 day(s) 00:11:53
> > Process Up-Time 0 day(s) 00:37:32
> >
> >
> > Thread 41 - System ID 3948
> > Entry point msvcrt!_endthreadex+2f
> > Create time 12/6/2007 11:19:02 AM
> > Time spent in user mode 0 Days 0:0:0.62
> > Time spent in kernel mode 0 Days 0:0:0.46
> >
> >
> >
> >
> > Function Arg 1 Arg 2 Arg 3 Source
> > ntdll!RtlFreeHeap+402 00080000 00000000 0721e6f0
> > ole32!PrivateMemFree+16 0721e6f0 776bb87f 04bda148
> > ole32!CFmCtrlUnknown::~CFmCtrlUnknown+e 04bda148 0505fb08
> > 776bb868
> > ole32!CFmCtrlUnknown::`scalar deleting destructor'+d 00000001
> > 00000000 07102080
> > ole32!CFmCtrlUnknown::Release+27 04bda148 07102080 4a775e71
> > comsvcs!CSTAActivity::~CSTAActivity+45 07102080 0505fb34
> > 4a7763a1
> > comsvcs!CSTAActivity::`scalar deleting destructor'+d 00000001
> > 00000000 07109df0
> > comsvcs!CSTAActivity::Release+27 07102080 07109df0 4a775c7d
> > comsvcs!CServiceActivity::~CServiceActivity+18 07109df0 0505fb60
> > 4a776342
> > comsvcs!CServiceActivity::`scalar deleting destructor'+d 00000001
> > 05e21f18 06421e90
> > comsvcs!CServiceActivity::Release+27 07109df0 06421e90
> > 709e57b8
> > asp!CViperActivity::UnInit+22 05e21e90 0505fb98 709e47a7
> > asp!CViperActivity::`scalar deleting destructor'+d 00000001
> > 00000000
> > 05e21e90
> > asp!CHitObj::~CHitObj+4e 06461e90 0505fbb4 709e2784
> > asp!CHitObj::`vector deleting destructor'+d 00000001 00000000
> > 04bdc0c0
> > asp!CViperAsyncRequest::OnCall+cb 05ea1e90 0008d958 0505fd74
> > comsvcs!CSTAActivityWork::STAActivityWorkHelper+32 04bdc0c0
> > 0a63ba34
> > 00000000
> > ole32!EnterForCallback+c4 00000000 0a63ba34 4a77b5b8
> > ole32!SwitchForCallback+1a3 0505fc54 4a77b5b8 04bdc0c0
> > ole32!PerformCallback+54 0a63ba34 4a77b5b8 04bdc0c0
> > ole32!CObjectContext::InternalContextCallback+159 0008d958
> > 4a77b5b8
> > 04bdc0c0
> > ole32!CObjectContext::DoCallback+1c 0008d958 4a77b5b8
04bdc0c0
> > comsvcs!CSTAActivityWork::DoWork+12d 0a677510 0a6774f0
> > 04b36e9c
> > comsvcs!CSTAThread::DoWork+18 04bdc0c0 00000001 0a6774f0
> > comsvcs!CSTAThread::ProcessQueueWork+37 00000000 018c90b0
> > 018d4c00
> > comsvcs!CSTAThread::WorkerLoop+190 0a6774f0 00000000
00000000
> > msvcrt!_endthreadex+a3 018d4c00 00000000 00000000
> > kernel32!BaseThreadStart+34 77bcb4bc 018d4c00 00000000
> >
> >
> > NTDLL!RTLFREEHEAP+402
> >
> >
> > Detailed Info For Corrupt Heap
> > Heap 1 - 0x00080000
> > Heap Name Default process heap
> > Heap Description This heap is created by default and shared by all
> > modules
> > in the process
> > Reserved memory 8.06 MBytes
> > Committed memory 5.09 MBytes (63.08% of reserved)
> > Uncommitted memory 2.98 MBytes (36.92% of reserved)
> > Number of heap segments 4 segments
> > Number of uncommitted ranges 1 range(s)
> > Size of largest uncommitted range 2.92 MBytes
> > Calculated heap fragmentation 1.97%
> >
> >
> >
> > Segment Information
> > Base Address Reserved Size Committed Size Uncommitted Size Number of
> > uncommitted ranges Largest uncommitted block Calculated heap
fragmentation
> > 0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> > 0x04b10000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> > 0x07030000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> > 0x0a5e0000 4.00 MBytes 1.08 MBytes 2.92 MBytes 1 2.92 MBytes 0.00%
> >
> >
> >
> > Top 5 allocations by size
> >
> > Allocation Size - 32
> > Allocation Size - 16
> > Allocation Size - 49160
> > Allocation Size - 904
> > Allocation Size - 48
> >
> >
> >
> >
> >
> > 195.06 KBytes
> > 98.05 KBytes
> > 96.02 KBytes
> > 88.28 KBytes
> > 73.31 KBytes
> >
> >
> > Top 5 allocations by count
> >
> > Allocation Size - 16
> > Allocation Size - 32
> > Allocation Size - 12
> > Allocation Size - 48
> > Allocation Size - 24
> >
> >
> >
> >
> >
> > 6275 allocation(s)
> > 6242 allocation(s)
> > 4115 allocation(s)
> > 1564 allocation(s)
> > 1054 allocation(s)
> >
> > Back to Top
> >
> >
> >
> > In
> >
w3wp__PID__5168__Date__12_06_2007__Time_11_19_36AM__93__Seco nd_Chance_Except
> > ion_C0000005.dmp the assembly instruction at ntdll!RtlFreeHeap+402 in
> > C:\WINNT\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to write to memory location
> > 0x0000006f on thread 41
> >
> > Heap corruption was detected in heap 0x00080000, however pageheap was
not
> > enabled in this dump. Please follow the instructions in the
recommendation
> > section for troubleshooting heap corruption issues.
> >
> > Current NTGlobalFlags value: 0x0 Module Information
> > Image Name: C:\WINNT\system32\ntdll.dll Symbol Type: PDB
> > Base address: 0x7c800000 Time Stamp: Sat Feb 17 09:02:00 2007
> > Checksum: 0x000bd6f9 Comments:
> > COM DLL: False Company Name: Microsoft Corporation
> > ISAPIExtension: False File Description: NT Layer DLL
> > ISAPIFilter: False File Version: 5.2.3790.3959
> > (srv03_sp2_rtm.070216-1710)
> > Managed DLL: False Internal Name: ntdll.dll
> > VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> > reserved.
> > Loaded Image Name: ntdll.dll Legal Trademarks:
> > Mapped Image Name: Original filename: ntdll.dll
> > Module name: ntdll Private Build:
> > Single Threaded: False Product Name: Microsoft® Windows® Operating
> > System
> > Module Size: 768.00 KBytes Product Version: 5.2.3790.3959
> > Symbol File Name:
> > c:\symcache\ntdll.pdb\93E72E109DC84F16AA54797E4DA8C1682\ntdl l.pdb
> > Special
> > Build: &
> >
> >
> > ------------------------------------
> >
> >
> >
> > Analysis Summary
> > Type Description Recommendation
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 25 to determine root cause for the
> > exception.
> >
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 26
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 26 to determine root cause for the
> > exception.
> >
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
chance
> > exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 25 to determine root cause for the
> > exception.
> >
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First
chance
> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> >
> >
> >
> >
> > Analysis Details
> > Table Of Contents
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
chance
> > exception 0X800706BF.dmp
> > Faulting Thread
> > Faulting Module Information
> >
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
chance
> > exception 0X800706BA.dmp
> > Faulting Thread
> > Faulting Module Information
> >
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
chance
> > exception 0X800706BA.dmp
> > Faulting Thread
> > Faulting Module Information
> >
> >
> > Report for
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
chance
> > exception 0X800706BF.dmp
> > Type of Analysis Performed Crash Analysis
> > Machine Name TRAINING
> > Operating System Windows Server 2003 Service Pack 2
> > Number Of Processors 1
> > Process ID 3340
> > Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> > System Up-Time 1 day(s) 00:12:03
> > Process Up-Time 0 day(s) 00:38:02
> >
> >
> > Thread 25 - System ID 4952
> > Entry point ntdll!RtlpWorkerThread
> > Create time 12/6/2007 11:19:04 AM
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.0
> >
> >
> >
> >
> > Function Arg 1 Arg 2 Arg 3 Source
> > kernel32!RaiseException+53 800706bf 00000001 00000000
> > rpcrt4!RpcpRaiseException+24 800706bf 0bae2fc4 036cfafc
> > rpcrt4!NdrProxySendReceive+60 0bae2fc4 800706bf 0600016e
> > rpcrt4!NdrClientCall2+206 776762b8 776792b0 036cfb34
> > rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
> > rpcrt4!ObjectStubless+f 0bae2fc4 00000002 04078f40
> > ole32!RemoteReleaseRifRefHelper+86 0bae2fc4 08138d80
00000002
> > ole32!RemoteReleaseRifRef+74 0bae2fc4 08138d80 00000002
> > ole32!CStdMarshal::DisconnectCliIPIDs+245 0ba50f24 0ba50f20
> > 00000000
> > ole32!CStdMarshal::Disconnect+193 00000002 0ba50fc8 0ba50f20
> > ole32!CStdIdentity::~CStdIdentity+89 0ba50f20 036cfc4c
> > 776ba675
> > ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> > 00c2c738
> > ffffffff
> > ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
> > 7769c1c7
> > ole32!ReleaseCallback+e 0ba50fc4 00c2c738 00c08e34
> > ole32!PerformCallback+17 00c2c738 7769c1d5 0ba50fc4
> > ole32!CObjectContext::InternalContextCallback+159 00c2c738
> > 7769c1d5
> > 0ba50fc4
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c104
> > 00000000
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c104
> > 00000000
> > coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> > 00000000
> > coadmin!CADMCOMW::Terminate+40 00000000 0a9ceee0 56f96b3e
> > coadmin!CADMCOMW::~CADMCOMW+12 0a9ceee0 036cfe14 56f9791f
> > coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001
0a9ceee0
> > 0a9ceee0
> > coadmin!CADMCOMW::Release+4f 0a9ceee0 00000001 00000000
> > coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0a9ceee0
> > 0a9ceee0
> > coadmin!CADMCOMW::Release+3c 0a9ceee0 00000001 00000000
> > coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> > 00000000
> > coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0a9ceee0
> > 0bae8f00 0bae8fc0
> > ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0a9ceee0 0bae8f00
> > ntdll!RtlpAsyncWaitCallbackCompletion+37 0bae8fc0 7c889080
> > 040b1fe8
> > ntdll!RtlpWorkerCallout+71 7c83ca2b 0bae8fc0 00000000
> > ntdll!RtlpExecuteWorkerRequest+4f 00000000 0bae8fc0 040b1fe8
> > ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0bae8fc0
> > ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> > kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
> >
> >
> > In inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
> > chance
> > exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Module
> > Information
> > Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> > Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> > Checksum: 0x001083fc Comments:
> > COM DLL: False Company Name: Microsoft Corporation
> > ISAPIExtension: False File Description: Windows NT BASE API Client
DLL
> > ISAPIFilter: False File Version: 5.2.3790.4062
> > (srv03_sp2_gdr.070417-0203)
> > Managed DLL: False Internal Name: kernel32
> > VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> > reserved.
> > Loaded Image Name: kernel32.dll Legal Trademarks:
> > Mapped Image Name: Original filename: kernel32
> > Module name: kernel32 Private Build:
> > Single Threaded: False Product Name: Microsoft® Windows® Operating
> > System
> > Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> > Symbol File Name:
> > c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> > Special Build: &
> >
> >
> >
> > Report for
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
chance
> > exception 0X800706BA.dmp
> > Type of Analysis Performed Crash Analysis
> > Machine Name TRAINING
> > Operating System Windows Server 2003 Service Pack 2
> > Number Of Processors 1
> > Process ID 3340
> > Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> > System Up-Time 1 day(s) 00:12:11
> > Process Up-Time 0 day(s) 00:38:12
> >
> >
> > Thread 26 - System ID 2388
> > Entry point ntdll!RtlpWorkerThread
> > Create time 12/6/2007 11:19:58 AM
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.0
> >
> >
> >
> >
> > Function Arg 1 Arg 2 Arg 3 Source
> > kernel32!RaiseException+53 800706ba 00000001 00000000
> > rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0c89cfc4
> > rpcrt4!NdrProxyGetBuffer+57 0c89cfc4 0093f75c 0600016e
> > rpcrt4!NdrClientCall2+173 776762b8 776792b0 0093fb34
> > rpcrt4!ObjectStublessClient+8b 00000010 00000005 0093fb44
> > rpcrt4!ObjectStubless+f 0c89cfc4 00000002 0cc9cf40
> > ole32!RemoteReleaseRifRefHelper+86 0c89cfc4 08138d80
00000002
> > ole32!RemoteReleaseRifRef+74 0c89cfc4 08138d80 00000002
> > ole32!CStdMarshal::DisconnectCliIPIDs+245 0c890f24 0c890f20
> > 00000000
> > ole32!CStdMarshal::Disconnect+193 00000002 0c890fc8 0c890f20
> > ole32!CStdIdentity::~CStdIdentity+89 0c890f20 0093fc4c
> > 776ba675
> > ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> > 00c2c738
> > ffffffff
> > ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 0093fc6c
> > 7769c1c7
> > ole32!ReleaseCallback+e 0c890fc4 00c2c738 00c08e34
> > ole32!PerformCallback+17 00c2c738 7769c1d5 0c890fc4
> > ole32!CObjectContext::InternalContextCallback+159 00c2c738
> > 7769c1d5
> > 0c890fc4
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c106
> > 00000000
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c106
> > 00000000
> > coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> > 00000000
> > coadmin!CADMCOMW::Terminate+40 00000000 084f6ee0 56f96b3e
> > coadmin!CADMCOMW::~CADMCOMW+12 084f6ee0 0093fe14 56f9791f
> > coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001
084f6ee0
> > 084f6ee0
> > coadmin!CADMCOMW::Release+4f 084f6ee0 00000001 00000000
> > coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 084f6ee0
> > 084f6ee0
> > coadmin!CADMCOMW::Release+3c 084f6ee0 00000001 00000000
> > coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> > 00000000
> > coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 084f6ee0
> > 0c86af00 0c86afc0
> > ntdll!RtlpWaitOrTimerCallout+74 56f977ce 084f6ee0 0c86af00
> > ntdll!RtlpAsyncWaitCallbackCompletion+37 0c86afc0 7c889080
> > 040b9fe8
> > ntdll!RtlpWorkerCallout+71 7c83ca2b 0c86afc0 00000000
> > ntdll!RtlpExecuteWorkerRequest+4f 00000000 0c86afc0 040b9fe8
> > ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0c86afc0
> > ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> > kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
> >
> >
> > In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
> > chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 26
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Module
> > Information
> > Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> > Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> > Checksum: 0x001083fc Comments:
> > COM DLL: False Company Name: Microsoft Corporation
> > ISAPIExtension: False File Description: Windows NT BASE API Client
DLL
> > ISAPIFilter: False File Version: 5.2.3790.4062
> > (srv03_sp2_gdr.070417-0203)
> > Managed DLL: False Internal Name: kernel32
> > VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> > reserved.
> > Loaded Image Name: kernel32.dll Legal Trademarks:
> > Mapped Image Name: Original filename: kernel32
> > Module name: kernel32 Private Build:
> > Single Threaded: False Product Name: Microsoft® Windows® Operating
> > System
> > Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> > Symbol File Name:
> > c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> > Special Build: &
> >
> >
> >
> > Report for
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
chance
> > exception 0X800706BA.dmp
> > Type of Analysis Performed Crash Analysis
> > Machine Name TRAINING
> > Operating System Windows Server 2003 Service Pack 2
> > Number Of Processors 1
> > Process ID 3340
> > Process Image C:\WINNT\system32\inetsrv\inetinfo.exe
> > System Up-Time 1 day(s) 00:12:07
> > Process Up-Time 0 day(s) 00:38:09
> >
> >
> > Thread 25 - System ID 4952
> > Entry point ntdll!RtlpWorkerThread
> > Create time 12/6/2007 11:19:04 AM
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.0
> >
> >
> >
> >
> > Function Arg 1 Arg 2 Arg 3 Source
> > kernel32!RaiseException+53 800706ba 00000001 00000000
> > rpcrt4!RpcpRaiseException+24 800706ba 776762b8 0b96afc4
> > rpcrt4!NdrProxyGetBuffer+57 0b96afc4 036cf75c 0600016e
> > rpcrt4!NdrClientCall2+173 776762b8 776792b0 036cfb34
> > rpcrt4!ObjectStublessClient+8b 00000010 00000005 036cfb44
> > rpcrt4!ObjectStubless+f 0b96afc4 00000002 0cd0bf40
> > ole32!RemoteReleaseRifRefHelper+86 0b96afc4 08138d80
00000002
> > ole32!RemoteReleaseRifRef+74 0b96afc4 08138d80 00000002
> > ole32!CStdMarshal::DisconnectCliIPIDs+245 09140f24 09140f20
> > 00000000
> > ole32!CStdMarshal::Disconnect+193 00000002 09140fc8 09140f20
> > ole32!CStdIdentity::~CStdIdentity+89 09140f20 036cfc4c
> > 776ba675
> > ole32!CStdIdentity::`scalar deleting destructor'+d 00000001
> > 00c2c738
> > ffffffff
> > ole32!CStdIdentity::CInternalUnk::Release+6b 80000000 036cfc6c
> > 7769c1c7
> > ole32!ReleaseCallback+e 09140fc4 00c2c738 00c08e34
> > ole32!PerformCallback+17 00c2c738 7769c1d5 09140fc4
> > ole32!CObjectContext::InternalContextCallback+159 00c2c738
> > 7769c1d5
> > 09140fc4
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+2f3 77794298 0000c105
> > 00000000
> > ole32!CGIPTable::RevokeInterfaceFromGlobal+136 77794298 0000c105
> > 00000000
> > coadmin!COConnectionPoint::Terminate+ad 00000000 00000000
> > 00000000
> > coadmin!CADMCOMW::Terminate+40 00000000 0c824ee0 56f96b3e
> > coadmin!CADMCOMW::~CADMCOMW+12 0c824ee0 036cfe14 56f9791f
> > coadmin!CADMCOMW::`scalar deleting destructor'+d 00000001
0c824ee0
> > 0c824ee0
> > coadmin!CADMCOMW::Release+4f 0c824ee0 00000001 00000000
> > coadmin!CADMCOMW::RemoveObjectFromList+65 00000000 0c824ee0
> > 0c824ee0
> > coadmin!CADMCOMW::Release+3c 0c824ee0 00000001 00000000
> > coadmin!CADMCOMW::DisconnectOrphaned+cd 00000000 56f977ce
> > 00000000
> > coadmin!CADMCOMW::CallerWatchWaitOrTimerCallback+53 0c824ee0
> > 0baeef00 0baeefc0
> > ntdll!RtlpWaitOrTimerCallout+74 56f977ce 0c824ee0 0baeef00
> > ntdll!RtlpAsyncWaitCallbackCompletion+37 0baeefc0 7c889080
> > 040b7fe8
> > ntdll!RtlpWorkerCallout+71 7c83ca2b 0baeefc0 00000000
> > ntdll!RtlpExecuteWorkerRequest+4f 00000000 0baeefc0 040b7fe8
> > ntdll!RtlpApcCallout+11 7c83a9ca 00000000 0baeefc0
> > ntdll!RtlpWorkerThread+61 00000000 00000000 00000000
> > kernel32!BaseThreadStart+34 7c839efb 00000000 00000000
> >
> >
> > In inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
> > chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> > Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Module
> > Information
> > Image Name: C:\WINNT\system32\kernel32.dll Symbol Type: PDB
> > Base address: 0x77e40000 Time Stamp: Wed Apr 18 12:25:36 2007
> > Checksum: 0x001083fc Comments:
> > COM DLL: False Company Name: Microsoft Corporation
> > ISAPIExtension: False File Description: Windows NT BASE API Client
DLL
> > ISAPIFilter: False File Version: 5.2.3790.4062
> > (srv03_sp2_gdr.070417-0203)
> > Managed DLL: False Internal Name: kernel32
> > VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
> > reserved.
> > Loaded Image Name: kernel32.dll Legal Trademarks:
> > Mapped Image Name: Original filename: kernel32
> > Module name: kernel32 Private Build:
> > Single Threaded: False Product Name: Microsoft® Windows® Operating
> > System
> > Module Size: 1.01 MBytes Product Version: 5.2.3790.4062
> > Symbol File Name:
> > c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\k ernel32.pdb
> > Special Build: &
> >
> >
>
Re: IIS worker processer carsh
am 07.12.2007 07:30:45 von David Wang
This is heap corruption. You need to use Pageheap to try and catch the
initial culprit.
All you have right now are analysis of all the victims, which is not
going to be useful for finding the culprit.
Needless to say, even though DebugDiag is telling you "contact
Microsoft regarding this crash", it is very much a red-herring.
This type of memory corruption happens like this -- you have a culprit
DLL which has a bug and frees a piece of memory used by some other
DLL. And when that DLL later goes to use or free that memory, it
crashes.
ntdll.dll from Microsoft does the actual "freeing" of memory, so it is
always on the top of the crash stack, but it is almost never the
problem -- it is usually the user code telling ntdll to "free" memory
that is the problem. And in the case of memory corruption, it is
actually the rogue code which "freed" someone else's memory that is
the problem, not the code freeing the memory. Complicated, yes. Got
it? :-)
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
On Dec 6, 4:12 pm, "Masoud Bayan" wrote:
> Thanks for your reply.
> If you look at the debug log, it has two sections and second section is heap
> page log. I used the same IIS debug diagnostic tool and used advanced
> pageheap config and attach to inetinfo.exe.
> Do I need to use PageHeap tool instead?
>
> following I am pasting the advanced pageheap dump analyzes:
>
> Thanks
>
> Analysis Summary
> Type Description Recommendation
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First chance
> exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 25 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 23
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 23 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 26
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 26 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 44
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 44 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First
> chance exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 42
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 42 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 42
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 42 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 25 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First chance
> exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 43
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 43 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First chance
> exception 0X800706BA.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706ba) on thread 25
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 25 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Error In inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First
> chance exception 0X800706BF.dmp the assembly instruction at
> kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from Microsoft
> Corporation has caused an unknown exception (0x800706bf) on thread 24
>
> This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> faulting call stack for thread 24 to determine root cause for the exception.
>
> Please follow up with vendor Microsoft Corporation for problem resolution
> concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46_ _First chance
> exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765 __First chance
> exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31_ _First chance
> exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First chance
> exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable combined crash and hang analysis for crash
> dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> folder) and set the g_DoCombinedAnalysis constant to True.
> Information DebugDiag determined that this dump file
> (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875 __First chance
> exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> analysis. If you wish to enable ...
>
> read more >>
Re: IIS worker processer carsh
am 07.12.2007 20:14:16 von patfilot
Looks like it could be a bug in COM+. I would start by installing the
hotfix from KB 934016 (COM+ rollup fix, has a number of fixes in it). If
that doesn't address the issue, you'll need to contact MS-Support for a
deeper debugging session.
Pat
"Masoud Bayan" wrote in message
news:OMZFxPQOIHA.2000@TK2MSFTNGP05.phx.gbl...
> Here is the pageheap dump (based on
> http://support.microsoft.com/?id=300966).
> Appreciate your feedback.
>
> Opened log file
> '\\?\C:\IISDebugTools\logs\20071207-094231\3780_inetinfo.log '
>
> 0:011> sxe -c ".echo 1st_Chance_AV;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_AV ;g" -c2 "!iisdbg.dump -ma 2nd_Chance_AV ;.echo
> 2nd_Chance_AV;.time;!version;!iisdbg.clientconns;!runaway;!l ocks;!handle 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" av
>
> 0:011> sxe -c ".echo Stack_OverFlow;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Stack_OverFlow ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Stack_Overflow ;.echo
> Stack_Over_Flow;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle
> 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" sov
>
> 0:011> sxe -c ".echo Divide_By_Zero;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Divide_By_Zero ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Divide_By_Zero ;.echo
> Divide_By_Zero;.time;!version;!iisdbg.clientconns;!runaway;! locks;!handle
> 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" dz
>
> 0:011> sxe -c "!iisdbg.dump -ma Debug_Break_Exception ;.echo
> BreakPoint;.time;!version;!iisdbg.clientconns;!runaway;!lock s;!handle 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" bpe
>
> 0:011> sxe -c ".echo Data_Misaligned;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Data_Misaligned ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Data_Misaligned ;.echo
> Data_Misaligned;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle
> 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" dm
>
> 0:011> sxe -c ".echo C++_EH_Exception;.time;kv50;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_C++_Exception ;.echo
> C++_EH_Exception;.time;!version;!iisdbg.clientconns;!runaway ;!locks;!handle
> 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" eh
>
> 0:011> sxe -c ".echo Guard_Page_Violation;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Guard_Page_Violation ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Guard_Page_Violation ;.echo
> Guard_Page_Violation;.time;!version;!iisdbg.clientconns;!run away;!locks;!han
> dle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" gp
>
> 0:011> sxe -c ".echo Illegal_Instruction;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Illegal_Instruction ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Illegal_Instruction ;.echo
> Illegal_Instruction;.time;!version;!iisdbg.clientconns;!runa way;!locks;!hand
> le 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ii
>
> 0:011> sxe -c ".echo
> Integer_Overflow_Exception;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Integer_Overflow_Exception ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Integer_Overflow_Exception ;.echo
> Integer_Overflow_Exception;.time;!version;!iisdbg.clientconn s;!runaway;!lock
> s;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" iov
>
> 0:011> sxe -c ".echo InPage_IO_Error;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Inpage_IO_Error ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Inpage_IO_Error ;.echo
> InPage_IO_Error;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle
> 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ip
>
> 0:011> sxe -c ".echo Invalid_System_Call;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Invalid_System_Call ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Invalid_System_Call ;.echo
> Invalid_System_Call;.time;!version;!iisdbg.clientconns;!runa way;!locks;!hand
> le 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" isc
>
> 0:011> sxe -c ".echo Invalid_Lock_Sequence;.time;kv50;!iisdbg.dump -mdip
> /u
> 1st_Chance_Invalid_Lock_Sequence ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Invalid_Lock_Sequence ;.echo
> Invalid_Lock_Sequence;.time;!version;!iisdbg.clientconns;!ru naway;!locks;!ha
> ndle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" lsq
>
> 0:011> sxe -c ".echo Stack_Buffer_Overflow;.time;kv50;!iisdbg.dump -mdip
> /u
> 1st_Chance_Stack_Buffer_Overflow ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Stack_Buffer_Overflow ;.echo
> Stack_Buffer_Overflow;.time;!version;!iisdbg.clientconns;!ru naway;!locks;!ha
> ndle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" sbo
>
> 0:011> sxe -c ".echo Application_Hang;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_Application_Hang ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Application_Hang ;.echo
> Application_Hang;.time;!version;!iisdbg.clientconns;!runaway ;!locks;!handle
> 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" aph
>
> 0:011> sxe -c "!iisdbg.dump -ma Wake_Debugger_Exception ;.echo
> Wake_Debugger;.time;!version;!iisdbg.clientconns;!runaway;!l ocks;!handle 0
> 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" wkd
>
> 0:011> sxe -c ".echo
> InValid_Handle_Exception;.time;kv50;!iisdbg.dump -mdip
> /u 1st_Chance_Invalid_Handle_Exception ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Invalid_Handle_Exception;.echo
> InValid_Handle_Exception;.time;!version;!iisdbg.clientconns; !runaway;!locks;
> !handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ch
>
> 0:011> sxe -c ".echo
> Floating_Divide_Exception;.time;kv50;!iisdbg.dump -mdip
> /u 1st_Chance_Floating_Divide_Exception ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Floating_Divide_Exception ;.echo
> Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
> ;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" c000008e
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\ntdll.dll -
>
> 0:011> sxn ud
>
> 0:011> sxn ld
>
> 0:011> sxe -c "!iisdbg.dump -ma Process_Shut_Down ;.echo
> Process_Shut_Down_Exception;.time;!version;!iisdbg.clientcon ns;!runaway;!loc
> ks;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" epr
>
> 0:011> sxe -c ".echo CTRL_C_Console_App;.time;kv50;!iisdbg.dump -mdip /u
> 1st_Chance_CTRL_C_Console_APP_Exception ;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_CTRL_C_Console_APP_Exception ;.echo
> Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
> ;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" cce
>
> 0:011> sxe -c ".echo NET_CLR_Exception;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_NET_CLR_Exception ;.echo
> Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
> ;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" e0434f4d
>
> 0:011> sxe -c ".echo UnKnown_Exception;.time;kv50;g" -c2 "!iisdbg.dump -ma
> 2nd_Chance_Unknown_Exception ;.echo
> Unknown_Exception;.time;!version;!iisdbg.clientconns;!runawa y;!locks;!handle
> 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" *
>
> 0:011> g
>
> (ec4.ecc): Unknown exception - code 800706bf (first chance)
>
> UnKnown_Exception
>
> Debug session time: Fri Dec 07 10:01:56 2007
>
> System Uptime: 0 days 2:21:42.542
>
> Process Uptime: 0 days 0:20:58.500
>
> Kernel time: 0 days 0:00:04.045
>
> User time: 0 days 0:00:06.339
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\kernel32.dll -
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\RPCRT4.dll -
>
> ChildEBP RetAddr Args to Child
>
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
>
> 036cf6ec 77c61e37 800706bf 00000001 00000000 kernel32!RaiseException+0x3c
>
> 036cf704 77ce3d5a 800706bf 0840cfc4 036cfafc RPCRT4!RpcRaiseException+0x34
>
> 036cf714 77ce252f 0840cfc4 800706bf 0600016e
> RPCRT4!NdrProxyErrorHandler+0x7c
>
> 036cfafc 77ce25a6 776762b8 776792b0 036cfb34
> RPCRT4!NdrProxyFreeBuffer+0x80
>
> 036cfb1c 77c64f87 00000010 00000005 036cfb44
> RPCRT4!NdrProxyFreeBuffer+0xf7
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\ole32.dll -
>
> 036cfb2c 776a326c 0840cfc4 00000002 084dcf40
> RPCRT4!RpcBindingInqAuthClientExW+0x15a
>
> 036cfb44 776a321f 0840cfc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
>
> 036cfb6c 776badfb 0840cfc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
>
> 036cfbe8 776babc5 08402f24 08402f20 00000000
> ole32!CoSetProxyBlanket+0x39c3
>
> 036cfc10 776ba583 00000002 08402fc8 08402f20
> ole32!CoSetProxyBlanket+0x378d
>
> 036cfc2c 776ba4f0 08402f20 036cfc4c 776ba675
> ole32!CoSetProxyBlanket+0x314b
>
> 036cfc38 776ba675 00000001 035d6738 ffffffff
> ole32!CoSetProxyBlanket+0x30b8
>
> 036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7
> ole32!CoSetProxyBlanket+0x323d
>
> 036cfc58 7769c1c7 08402fc4 035d6738 035dde34
> ole32!CreateStreamOnHGlobal+0x1bcb
>
> 036cfc6c 7769c194 035d6738 7769c1d5 08402fc4
> ole32!CreateStreamOnHGlobal+0x1baf
>
> 036cfd04 7769c2ab 035d6738 7769c1d5 08402fc4
> ole32!CreateStreamOnHGlobal+0x1b7c
>
> 036cfd5c 776f25aa 77794298 0000c101 00000000
> ole32!CreateStreamOnHGlobal+0x1c93
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\system32\inetsrv\COADMIN.dll -
>
> 036cfda4 56f9ae81 77794298 0000c101 00000000
> ole32!CoGetContextToken+0xf627
>
> 036cfdc8 56f95515 00000000 00000000 00000000
> COADMIN!TerminateComAdmindata+0x2562
>
> 036cfde8 56f96aac 00000000 06f9aee0 56f96b3e COADMIN+0x5515
>
> 036cfe00 56f9791f 00000001 06f9aee0 06f9aee0 COADMIN+0x6aac
>
> 036cfe14 56f9b38a 06f9aee0 00000001 00000000 COADMIN+0x791f
>
> 036cfe28 56f9790c 00000000 06f9aee0 06f9aee0
> COADMIN!TerminateComAdmindata+0x2a6b
>
> 036cfe3c 56f977af 06f9aee0 00000001 00000000 COADMIN+0x790c
>
> 036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
>
> 036cfe6c 7c83ac3c 06f9aee0 08522f00 08522fc0 COADMIN+0x7821
>
> 036cfec8 7c83ca62 56f977ce 06f9aee0 08522f00 ntdll!RtlQueueWorkItem+0x3c9
>
> 036cfeec 7c83a827 08522fc0 7c889080 08570fe8 ntdll!RtlRegisterWait+0x247
>
> 036cff44 7c83aa0b 7c83ca2b 08522fc0 00000000
> ntdll!RtlDestroyEnvironment+0x139
>
> 036cff64 7c83aa82 00000000 08522fc0 08570fe8 ntdll!RtlQueueWorkItem+0x198
>
> 036cff78 7c839f60 7c83a9ca 00000000 08522fc0 ntdll!RtlQueueWorkItem+0x20f
>
> 036cffb8 77e64829 00000000 00000000 00000000
> ntdll!RtlOpenCurrentUser+0x2da
>
> 036cffec 00000000 7c839efb 00000000 00000000
> kernel32!GetModuleHandleA+0xdf
>
> (ec4.ecc): Unknown exception - code 800706ba (first chance)
>
> UnKnown_Exception
>
> Debug session time: Fri Dec 07 10:01:57 2007
>
> System Uptime: 0 days 2:21:43.012
>
> Process Uptime: 0 days 0:20:58.971
>
> Kernel time: 0 days 0:00:04.055
>
> User time: 0 days 0:00:06.339
>
> ChildEBP RetAddr Args to Child
>
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
>
> 036cf6e8 77c61e37 800706ba 00000001 00000000 kernel32!RaiseException+0x3c
>
> 036cf700 77ce371e 800706ba 776762b8 08475fc4 RPCRT4!RpcRaiseException+0x34
>
> 036cf714 77ce2649 08475fc4 036cf75c 0600016e
> RPCRT4!NdrUnmarshallBasetypeInline+0xae
>
> 036cfafc 77ce25a6 776762b8 776792b0 036cfb34
> RPCRT4!NdrProxyInitialize+0x5c
>
> 036cfb1c 77c64f87 00000010 00000005 036cfb44
> RPCRT4!NdrProxyFreeBuffer+0xf7
>
> 036cfb2c 776a326c 08475fc4 00000002 085ccf40
> RPCRT4!RpcBindingInqAuthClientExW+0x15a
>
> 036cfb44 776a321f 08475fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
>
> 036cfb6c 776badfb 08475fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
>
> 036cfbe8 776babc5 086baf24 086baf20 00000000
> ole32!CoSetProxyBlanket+0x39c3
>
> 036cfc10 776ba583 00000002 086bafc8 086baf20
> ole32!CoSetProxyBlanket+0x378d
>
> 036cfc2c 776ba4f0 086baf20 036cfc4c 776ba675
> ole32!CoSetProxyBlanket+0x314b
>
> 036cfc38 776ba675 00000001 035d6738 ffffffff
> ole32!CoSetProxyBlanket+0x30b8
>
> 036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7
> ole32!CoSetProxyBlanket+0x323d
>
> 036cfc58 7769c1c7 086bafc4 035d6738 035dde34
> ole32!CreateStreamOnHGlobal+0x1bcb
>
> 036cfc6c 7769c194 035d6738 7769c1d5 086bafc4
> ole32!CreateStreamOnHGlobal+0x1baf
>
> 036cfd04 7769c2ab 035d6738 7769c1d5 086bafc4
> ole32!CreateStreamOnHGlobal+0x1b7c
>
> 036cfd5c 776f25aa 77794298 0000c102 00000000
> ole32!CreateStreamOnHGlobal+0x1c93
>
> 036cfda4 56f9ae81 77794298 0000c102 00000000
> ole32!CoGetContextToken+0xf627
>
> 036cfdc8 56f95515 00000000 00000000 00000000
> COADMIN!TerminateComAdmindata+0x2562
>
> 036cfde8 56f96aac 00000000 086eeee0 56f96b3e COADMIN+0x5515
>
> 036cfe00 56f9791f 00000001 086eeee0 086eeee0 COADMIN+0x6aac
>
> 036cfe14 56f9b38a 086eeee0 00000001 00000000 COADMIN+0x791f
>
> 036cfe28 56f9790c 00000000 086eeee0 086eeee0
> COADMIN!TerminateComAdmindata+0x2a6b
>
> 036cfe3c 56f977af 086eeee0 00000001 00000000 COADMIN+0x790c
>
> 036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
>
> 036cfe6c 7c83ac3c 086eeee0 08692f00 08692fc0 COADMIN+0x7821
>
> 036cfec8 7c83ca62 56f977ce 086eeee0 08692f00 ntdll!RtlQueueWorkItem+0x3c9
>
> 036cfeec 7c83a827 08692fc0 7c889080 07fc8fe8 ntdll!RtlRegisterWait+0x247
>
> 036cff44 7c83aa0b 7c83ca2b 08692fc0 00000000
> ntdll!RtlDestroyEnvironment+0x139
>
> 036cff64 7c83aa82 00000000 08692fc0 07fc8fe8 ntdll!RtlQueueWorkItem+0x198
>
> 036cff78 7c839f60 7c83a9ca 00000000 08692fc0 ntdll!RtlQueueWorkItem+0x20f
>
> 036cffb8 77e64829 00000000 00000000 00000000
> ntdll!RtlOpenCurrentUser+0x2da
>
> 036cffec 00000000 7c839efb 00000000 00000000
> kernel32!GetModuleHandleA+0xdf
>
> (ec4.ecc): Unknown exception - code 800706ba (first chance)
>
> UnKnown_Exception
>
> Debug session time: Fri Dec 07 10:01:57 2007
>
> System Uptime: 0 days 2:21:43.112
>
> Process Uptime: 0 days 0:20:59.072
>
> Kernel time: 0 days 0:00:04.065
>
> User time: 0 days 0:00:06.339
>
> ChildEBP RetAddr Args to Child
>
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
>
> 036cf6e8 77c61e37 800706ba 00000001 00000000 kernel32!RaiseException+0x3c
>
> 036cf700 77ce371e 800706ba 776762b8 08498fc4 RPCRT4!RpcRaiseException+0x34
>
> 036cf714 77ce2649 08498fc4 036cf75c 0600016e
> RPCRT4!NdrUnmarshallBasetypeInline+0xae
>
> 036cfafc 77ce25a6 776762b8 776792b0 036cfb34
> RPCRT4!NdrProxyInitialize+0x5c
>
> 036cfb1c 77c64f87 00000010 00000005 036cfb44
> RPCRT4!NdrProxyFreeBuffer+0xf7
>
> 036cfb2c 776a326c 08498fc4 00000002 085c0f40
> RPCRT4!RpcBindingInqAuthClientExW+0x15a
>
> 036cfb44 776a321f 08498fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
>
> 036cfb6c 776badfb 08498fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
>
> 036cfbe8 776babc5 08341f24 08341f20 00000000
> ole32!CoSetProxyBlanket+0x39c3
>
> 036cfc10 776ba583 00000002 08341fc8 08341f20
> ole32!CoSetProxyBlanket+0x378d
>
> 036cfc2c 776ba4f0 08341f20 036cfc4c 776ba675
> ole32!CoSetProxyBlanket+0x314b
>
> 036cfc38 776ba675 00000001 035d6738 ffffffff
> ole32!CoSetProxyBlanket+0x30b8
>
> 036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7
> ole32!CoSetProxyBlanket+0x323d
>
> 036cfc58 7769c1c7 08341fc4 035d6738 035dde34
> ole32!CreateStreamOnHGlobal+0x1bcb
>
> 036cfc6c 7769c194 035d6738 7769c1d5 08341fc4
> ole32!CreateStreamOnHGlobal+0x1baf
>
> 036cfd04 7769c2ab 035d6738 7769c1d5 08341fc4
> ole32!CreateStreamOnHGlobal+0x1b7c
>
> 036cfd5c 776f25aa 77794298 0000c103 00000000
> ole32!CreateStreamOnHGlobal+0x1c93
>
> 036cfda4 56f9ae81 77794298 0000c103 00000000
> ole32!CoGetContextToken+0xf627
>
> 036cfdc8 56f95515 00000000 00000000 00000000
> COADMIN!TerminateComAdmindata+0x2562
>
> 036cfde8 56f96aac 00000000 08752ee0 56f96b3e COADMIN+0x5515
>
> 036cfe00 56f9791f 00000001 08752ee0 08752ee0 COADMIN+0x6aac
>
> 036cfe14 56f9b38a 08752ee0 00000001 00000000 COADMIN+0x791f
>
> 036cfe28 56f9790c 00000000 08752ee0 08752ee0
> COADMIN!TerminateComAdmindata+0x2a6b
>
> 036cfe3c 56f977af 08752ee0 00000001 00000000 COADMIN+0x790c
>
> 036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
>
> 036cfe6c 7c83ac3c 08752ee0 07fb4f00 07fb4fc0 COADMIN+0x7821
>
> 036cfec8 7c83ca62 56f977ce 08752ee0 07fb4f00 ntdll!RtlQueueWorkItem+0x3c9
>
> 036cfeec 7c83a827 07fb4fc0 7c889080 07fcafe8 ntdll!RtlRegisterWait+0x247
>
> 036cff44 7c83aa0b 7c83ca2b 07fb4fc0 00000000
> ntdll!RtlDestroyEnvironment+0x139
>
> 036cff64 7c83aa82 00000000 07fb4fc0 07fcafe8 ntdll!RtlQueueWorkItem+0x198
>
> 036cff78 7c839f60 7c83a9ca 00000000 07fb4fc0 ntdll!RtlQueueWorkItem+0x20f
>
> 036cffb8 77e64829 00000000 00000000 00000000
> ntdll!RtlOpenCurrentUser+0x2da
>
> 036cffec 00000000 7c839efb 00000000 00000000
> kernel32!GetModuleHandleA+0xdf
>
> ModLoad: 5a110000 5a116000 C:\WINDOWS\system32\WAMREGPS.DLL
>
>
>
>
> "David Wang" wrote in message
> news:669d437a-392f-4c00-a252-2a7fd630fddc@s12g2000prg.google groups.com...
>> This is heap corruption. You need to use Pageheap to try and catch the
>> initial culprit.
>>
>> All you have right now are analysis of all the victims, which is not
>> going to be useful for finding the culprit.
>>
>> Needless to say, even though DebugDiag is telling you "contact
>> Microsoft regarding this crash", it is very much a red-herring.
>>
>> This type of memory corruption happens like this -- you have a culprit
>> DLL which has a bug and frees a piece of memory used by some other
>> DLL. And when that DLL later goes to use or free that memory, it
>> crashes.
>>
>> ntdll.dll from Microsoft does the actual "freeing" of memory, so it is
>> always on the top of the crash stack, but it is almost never the
>> problem -- it is usually the user code telling ntdll to "free" memory
>> that is the problem. And in the case of memory corruption, it is
>> actually the rogue code which "freed" someone else's memory that is
>> the problem, not the code freeing the memory. Complicated, yes. Got
>> it? :-)
>>
>>
>> //David
>> http://w3-4u.blogspot.com
>> http://blogs.msdn.com/David.Wang
>> //
>>
>>
>>
>>
>> On Dec 6, 4:12 pm, "Masoud Bayan" wrote:
>> > Thanks for your reply.
>> > If you look at the debug log, it has two sections and second section is
> heap
>> > page log. I used the same IIS debug diagnostic tool and used advanced
>> > pageheap config and attach to inetinfo.exe.
>> > Do I need to use PageHeap tool instead?
>> >
>> > following I am pasting the advanced pageheap dump analyzes:
>> >
>> > Thanks
>> >
>> > Analysis Summary
>> > Type Description Recommendation
>> > Error In
>> > inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
> chance
>> > exception 0X800706BF.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706bf) on thread 25
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 25 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 23
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 23 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 26
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 26 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 44
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 44 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
> inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First
>> > chance exception 0X800706BF.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706bf) on thread 42
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 42 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 42
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 42 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 25
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 25 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First
> chance
>> > exception 0X800706BF.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706bf) on thread 43
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 43 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
>> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
> chance
>> > exception 0X800706BA.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706ba) on thread 25
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 25 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Error In
> inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First
>> > chance exception 0X800706BF.dmp the assembly instruction at
>> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
> Microsoft
>> > Corporation has caused an unknown exception (0x800706bf) on thread 24
>> >
>> > This exception originated from rpcrt4!RpcpRaiseException+24. Review
>> > the
>> > faulting call stack for thread 24 to determine root cause for the
> exception.
>> >
>> > Please follow up with vendor Microsoft Corporation for problem
> resolution
>> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46_ _First
> chance
>> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765 __First
> chance
>> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31_ _First
> chance
>> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First
> chance
>> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable combined crash and hang analysis for
> crash
>> > dumps, edit the IISAnalysis.asp script (located in the
>> > DebugDiag\Scripts
>> > folder) and set the g_DoCombinedAnalysis constant to True.
>> > Information DebugDiag determined that this dump file
>> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875 __First
> chance
>> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
>> > analysis. If you wish to enable ...
>> >
>> > read more >>
>>
>
>
Re: IIS worker processer carsh
am 07.12.2007 23:03:23 von masoud bayan
Here is the pageheap dump (based on
http://support.microsoft.com/?id=300966).
Appreciate your feedback.
Opened log file
'\\?\C:\IISDebugTools\logs\20071207-094231\3780_inetinfo.log '
0:011> sxe -c ".echo 1st_Chance_AV;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_AV ;g" -c2 "!iisdbg.dump -ma 2nd_Chance_AV ;.echo
2nd_Chance_AV;.time;!version;!iisdbg.clientconns;!runaway;!l ocks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" av
0:011> sxe -c ".echo Stack_OverFlow;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Stack_OverFlow ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Stack_Overflow ;.echo
Stack_Over_Flow;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" sov
0:011> sxe -c ".echo Divide_By_Zero;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Divide_By_Zero ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Divide_By_Zero ;.echo
Divide_By_Zero;.time;!version;!iisdbg.clientconns;!runaway;! locks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" dz
0:011> sxe -c "!iisdbg.dump -ma Debug_Break_Exception ;.echo
BreakPoint;.time;!version;!iisdbg.clientconns;!runaway;!lock s;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" bpe
0:011> sxe -c ".echo Data_Misaligned;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Data_Misaligned ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Data_Misaligned ;.echo
Data_Misaligned;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" dm
0:011> sxe -c ".echo C++_EH_Exception;.time;kv50;g" -c2 "!iisdbg.dump -ma
2nd_Chance_C++_Exception ;.echo
C++_EH_Exception;.time;!version;!iisdbg.clientconns;!runaway ;!locks;!handle
0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" eh
0:011> sxe -c ".echo Guard_Page_Violation;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Guard_Page_Violation ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Guard_Page_Violation ;.echo
Guard_Page_Violation;.time;!version;!iisdbg.clientconns;!run away;!locks;!han
dle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" gp
0:011> sxe -c ".echo Illegal_Instruction;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Illegal_Instruction ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Illegal_Instruction ;.echo
Illegal_Instruction;.time;!version;!iisdbg.clientconns;!runa way;!locks;!hand
le 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ii
0:011> sxe -c ".echo
Integer_Overflow_Exception;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Integer_Overflow_Exception ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Integer_Overflow_Exception ;.echo
Integer_Overflow_Exception;.time;!version;!iisdbg.clientconn s;!runaway;!lock
s;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" iov
0:011> sxe -c ".echo InPage_IO_Error;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Inpage_IO_Error ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Inpage_IO_Error ;.echo
InPage_IO_Error;.time;!version;!iisdbg.clientconns;!runaway; !locks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ip
0:011> sxe -c ".echo Invalid_System_Call;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Invalid_System_Call ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Invalid_System_Call ;.echo
Invalid_System_Call;.time;!version;!iisdbg.clientconns;!runa way;!locks;!hand
le 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" isc
0:011> sxe -c ".echo Invalid_Lock_Sequence;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Invalid_Lock_Sequence ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Invalid_Lock_Sequence ;.echo
Invalid_Lock_Sequence;.time;!version;!iisdbg.clientconns;!ru naway;!locks;!ha
ndle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" lsq
0:011> sxe -c ".echo Stack_Buffer_Overflow;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Stack_Buffer_Overflow ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Stack_Buffer_Overflow ;.echo
Stack_Buffer_Overflow;.time;!version;!iisdbg.clientconns;!ru naway;!locks;!ha
ndle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" sbo
0:011> sxe -c ".echo Application_Hang;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_Application_Hang ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Application_Hang ;.echo
Application_Hang;.time;!version;!iisdbg.clientconns;!runaway ;!locks;!handle
0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" aph
0:011> sxe -c "!iisdbg.dump -ma Wake_Debugger_Exception ;.echo
Wake_Debugger;.time;!version;!iisdbg.clientconns;!runaway;!l ocks;!handle 0
0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" wkd
0:011> sxe -c ".echo InValid_Handle_Exception;.time;kv50;!iisdbg.dump -mdip
/u 1st_Chance_Invalid_Handle_Exception ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Invalid_Handle_Exception;.echo
InValid_Handle_Exception;.time;!version;!iisdbg.clientconns; !runaway;!locks;
!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" ch
0:011> sxe -c ".echo Floating_Divide_Exception;.time;kv50;!iisdbg.dump -mdip
/u 1st_Chance_Floating_Divide_Exception ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Floating_Divide_Exception ;.echo
Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" c000008e
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
0:011> sxn ud
0:011> sxn ld
0:011> sxe -c "!iisdbg.dump -ma Process_Shut_Down ;.echo
Process_Shut_Down_Exception;.time;!version;!iisdbg.clientcon ns;!runaway;!loc
ks;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" epr
0:011> sxe -c ".echo CTRL_C_Console_App;.time;kv50;!iisdbg.dump -mdip /u
1st_Chance_CTRL_C_Console_APP_Exception ;g" -c2 "!iisdbg.dump -ma
2nd_Chance_CTRL_C_Console_APP_Exception ;.echo
Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" cce
0:011> sxe -c ".echo NET_CLR_Exception;g" -c2 "!iisdbg.dump -ma
2nd_Chance_NET_CLR_Exception ;.echo
Floating_Divide_Exception;.time;!version;!iisdbg.clientconns ;!runaway;!locks
;!handle 0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" e0434f4d
0:011> sxe -c ".echo UnKnown_Exception;.time;kv50;g" -c2 "!iisdbg.dump -ma
2nd_Chance_Unknown_Exception ;.echo
Unknown_Exception;.time;!version;!iisdbg.clientconns;!runawa y;!locks;!handle
0 0;lmv;~*kv50;!iisdbg.ifclr managed.def;q" *
0:011> g
(ec4.ecc): Unknown exception - code 800706bf (first chance)
UnKnown_Exception
Debug session time: Fri Dec 07 10:01:56 2007
System Uptime: 0 days 2:21:42.542
Process Uptime: 0 days 0:20:58.500
Kernel time: 0 days 0:00:04.045
User time: 0 days 0:00:06.339
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\RPCRT4.dll -
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
036cf6ec 77c61e37 800706bf 00000001 00000000 kernel32!RaiseException+0x3c
036cf704 77ce3d5a 800706bf 0840cfc4 036cfafc RPCRT4!RpcRaiseException+0x34
036cf714 77ce252f 0840cfc4 800706bf 0600016e
RPCRT4!NdrProxyErrorHandler+0x7c
036cfafc 77ce25a6 776762b8 776792b0 036cfb34 RPCRT4!NdrProxyFreeBuffer+0x80
036cfb1c 77c64f87 00000010 00000005 036cfb44 RPCRT4!NdrProxyFreeBuffer+0xf7
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\ole32.dll -
036cfb2c 776a326c 0840cfc4 00000002 084dcf40
RPCRT4!RpcBindingInqAuthClientExW+0x15a
036cfb44 776a321f 0840cfc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
036cfb6c 776badfb 0840cfc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
036cfbe8 776babc5 08402f24 08402f20 00000000 ole32!CoSetProxyBlanket+0x39c3
036cfc10 776ba583 00000002 08402fc8 08402f20 ole32!CoSetProxyBlanket+0x378d
036cfc2c 776ba4f0 08402f20 036cfc4c 776ba675 ole32!CoSetProxyBlanket+0x314b
036cfc38 776ba675 00000001 035d6738 ffffffff ole32!CoSetProxyBlanket+0x30b8
036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7 ole32!CoSetProxyBlanket+0x323d
036cfc58 7769c1c7 08402fc4 035d6738 035dde34
ole32!CreateStreamOnHGlobal+0x1bcb
036cfc6c 7769c194 035d6738 7769c1d5 08402fc4
ole32!CreateStreamOnHGlobal+0x1baf
036cfd04 7769c2ab 035d6738 7769c1d5 08402fc4
ole32!CreateStreamOnHGlobal+0x1b7c
036cfd5c 776f25aa 77794298 0000c101 00000000
ole32!CreateStreamOnHGlobal+0x1c93
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\inetsrv\COADMIN.dll -
036cfda4 56f9ae81 77794298 0000c101 00000000 ole32!CoGetContextToken+0xf627
036cfdc8 56f95515 00000000 00000000 00000000
COADMIN!TerminateComAdmindata+0x2562
036cfde8 56f96aac 00000000 06f9aee0 56f96b3e COADMIN+0x5515
036cfe00 56f9791f 00000001 06f9aee0 06f9aee0 COADMIN+0x6aac
036cfe14 56f9b38a 06f9aee0 00000001 00000000 COADMIN+0x791f
036cfe28 56f9790c 00000000 06f9aee0 06f9aee0
COADMIN!TerminateComAdmindata+0x2a6b
036cfe3c 56f977af 06f9aee0 00000001 00000000 COADMIN+0x790c
036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
036cfe6c 7c83ac3c 06f9aee0 08522f00 08522fc0 COADMIN+0x7821
036cfec8 7c83ca62 56f977ce 06f9aee0 08522f00 ntdll!RtlQueueWorkItem+0x3c9
036cfeec 7c83a827 08522fc0 7c889080 08570fe8 ntdll!RtlRegisterWait+0x247
036cff44 7c83aa0b 7c83ca2b 08522fc0 00000000
ntdll!RtlDestroyEnvironment+0x139
036cff64 7c83aa82 00000000 08522fc0 08570fe8 ntdll!RtlQueueWorkItem+0x198
036cff78 7c839f60 7c83a9ca 00000000 08522fc0 ntdll!RtlQueueWorkItem+0x20f
036cffb8 77e64829 00000000 00000000 00000000 ntdll!RtlOpenCurrentUser+0x2da
036cffec 00000000 7c839efb 00000000 00000000 kernel32!GetModuleHandleA+0xdf
(ec4.ecc): Unknown exception - code 800706ba (first chance)
UnKnown_Exception
Debug session time: Fri Dec 07 10:01:57 2007
System Uptime: 0 days 2:21:43.012
Process Uptime: 0 days 0:20:58.971
Kernel time: 0 days 0:00:04.055
User time: 0 days 0:00:06.339
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
036cf6e8 77c61e37 800706ba 00000001 00000000 kernel32!RaiseException+0x3c
036cf700 77ce371e 800706ba 776762b8 08475fc4 RPCRT4!RpcRaiseException+0x34
036cf714 77ce2649 08475fc4 036cf75c 0600016e
RPCRT4!NdrUnmarshallBasetypeInline+0xae
036cfafc 77ce25a6 776762b8 776792b0 036cfb34 RPCRT4!NdrProxyInitialize+0x5c
036cfb1c 77c64f87 00000010 00000005 036cfb44 RPCRT4!NdrProxyFreeBuffer+0xf7
036cfb2c 776a326c 08475fc4 00000002 085ccf40
RPCRT4!RpcBindingInqAuthClientExW+0x15a
036cfb44 776a321f 08475fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
036cfb6c 776badfb 08475fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
036cfbe8 776babc5 086baf24 086baf20 00000000 ole32!CoSetProxyBlanket+0x39c3
036cfc10 776ba583 00000002 086bafc8 086baf20 ole32!CoSetProxyBlanket+0x378d
036cfc2c 776ba4f0 086baf20 036cfc4c 776ba675 ole32!CoSetProxyBlanket+0x314b
036cfc38 776ba675 00000001 035d6738 ffffffff ole32!CoSetProxyBlanket+0x30b8
036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7 ole32!CoSetProxyBlanket+0x323d
036cfc58 7769c1c7 086bafc4 035d6738 035dde34
ole32!CreateStreamOnHGlobal+0x1bcb
036cfc6c 7769c194 035d6738 7769c1d5 086bafc4
ole32!CreateStreamOnHGlobal+0x1baf
036cfd04 7769c2ab 035d6738 7769c1d5 086bafc4
ole32!CreateStreamOnHGlobal+0x1b7c
036cfd5c 776f25aa 77794298 0000c102 00000000
ole32!CreateStreamOnHGlobal+0x1c93
036cfda4 56f9ae81 77794298 0000c102 00000000 ole32!CoGetContextToken+0xf627
036cfdc8 56f95515 00000000 00000000 00000000
COADMIN!TerminateComAdmindata+0x2562
036cfde8 56f96aac 00000000 086eeee0 56f96b3e COADMIN+0x5515
036cfe00 56f9791f 00000001 086eeee0 086eeee0 COADMIN+0x6aac
036cfe14 56f9b38a 086eeee0 00000001 00000000 COADMIN+0x791f
036cfe28 56f9790c 00000000 086eeee0 086eeee0
COADMIN!TerminateComAdmindata+0x2a6b
036cfe3c 56f977af 086eeee0 00000001 00000000 COADMIN+0x790c
036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
036cfe6c 7c83ac3c 086eeee0 08692f00 08692fc0 COADMIN+0x7821
036cfec8 7c83ca62 56f977ce 086eeee0 08692f00 ntdll!RtlQueueWorkItem+0x3c9
036cfeec 7c83a827 08692fc0 7c889080 07fc8fe8 ntdll!RtlRegisterWait+0x247
036cff44 7c83aa0b 7c83ca2b 08692fc0 00000000
ntdll!RtlDestroyEnvironment+0x139
036cff64 7c83aa82 00000000 08692fc0 07fc8fe8 ntdll!RtlQueueWorkItem+0x198
036cff78 7c839f60 7c83a9ca 00000000 08692fc0 ntdll!RtlQueueWorkItem+0x20f
036cffb8 77e64829 00000000 00000000 00000000 ntdll!RtlOpenCurrentUser+0x2da
036cffec 00000000 7c839efb 00000000 00000000 kernel32!GetModuleHandleA+0xdf
(ec4.ecc): Unknown exception - code 800706ba (first chance)
UnKnown_Exception
Debug session time: Fri Dec 07 10:01:57 2007
System Uptime: 0 days 2:21:43.112
Process Uptime: 0 days 0:20:59.072
Kernel time: 0 days 0:00:04.065
User time: 0 days 0:00:06.339
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
036cf6e8 77c61e37 800706ba 00000001 00000000 kernel32!RaiseException+0x3c
036cf700 77ce371e 800706ba 776762b8 08498fc4 RPCRT4!RpcRaiseException+0x34
036cf714 77ce2649 08498fc4 036cf75c 0600016e
RPCRT4!NdrUnmarshallBasetypeInline+0xae
036cfafc 77ce25a6 776762b8 776792b0 036cfb34 RPCRT4!NdrProxyInitialize+0x5c
036cfb1c 77c64f87 00000010 00000005 036cfb44 RPCRT4!NdrProxyFreeBuffer+0xf7
036cfb2c 776a326c 08498fc4 00000002 085c0f40
RPCRT4!RpcBindingInqAuthClientExW+0x15a
036cfb44 776a321f 08498fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5ef
036cfb6c 776badfb 08498fc4 07be2c00 00000002 ole32!PropVariantCopy+0x5a2
036cfbe8 776babc5 08341f24 08341f20 00000000 ole32!CoSetProxyBlanket+0x39c3
036cfc10 776ba583 00000002 08341fc8 08341f20 ole32!CoSetProxyBlanket+0x378d
036cfc2c 776ba4f0 08341f20 036cfc4c 776ba675 ole32!CoSetProxyBlanket+0x314b
036cfc38 776ba675 00000001 035d6738 ffffffff ole32!CoSetProxyBlanket+0x30b8
036cfc4c 7769c1e3 80000000 036cfc6c 7769c1c7 ole32!CoSetProxyBlanket+0x323d
036cfc58 7769c1c7 08341fc4 035d6738 035dde34
ole32!CreateStreamOnHGlobal+0x1bcb
036cfc6c 7769c194 035d6738 7769c1d5 08341fc4
ole32!CreateStreamOnHGlobal+0x1baf
036cfd04 7769c2ab 035d6738 7769c1d5 08341fc4
ole32!CreateStreamOnHGlobal+0x1b7c
036cfd5c 776f25aa 77794298 0000c103 00000000
ole32!CreateStreamOnHGlobal+0x1c93
036cfda4 56f9ae81 77794298 0000c103 00000000 ole32!CoGetContextToken+0xf627
036cfdc8 56f95515 00000000 00000000 00000000
COADMIN!TerminateComAdmindata+0x2562
036cfde8 56f96aac 00000000 08752ee0 56f96b3e COADMIN+0x5515
036cfe00 56f9791f 00000001 08752ee0 08752ee0 COADMIN+0x6aac
036cfe14 56f9b38a 08752ee0 00000001 00000000 COADMIN+0x791f
036cfe28 56f9790c 00000000 08752ee0 08752ee0
COADMIN!TerminateComAdmindata+0x2a6b
036cfe3c 56f977af 08752ee0 00000001 00000000 COADMIN+0x790c
036cfe58 56f97821 00000000 56f977ce 00000000 COADMIN+0x77af
036cfe6c 7c83ac3c 08752ee0 07fb4f00 07fb4fc0 COADMIN+0x7821
036cfec8 7c83ca62 56f977ce 08752ee0 07fb4f00 ntdll!RtlQueueWorkItem+0x3c9
036cfeec 7c83a827 07fb4fc0 7c889080 07fcafe8 ntdll!RtlRegisterWait+0x247
036cff44 7c83aa0b 7c83ca2b 07fb4fc0 00000000
ntdll!RtlDestroyEnvironment+0x139
036cff64 7c83aa82 00000000 07fb4fc0 07fcafe8 ntdll!RtlQueueWorkItem+0x198
036cff78 7c839f60 7c83a9ca 00000000 07fb4fc0 ntdll!RtlQueueWorkItem+0x20f
036cffb8 77e64829 00000000 00000000 00000000 ntdll!RtlOpenCurrentUser+0x2da
036cffec 00000000 7c839efb 00000000 00000000 kernel32!GetModuleHandleA+0xdf
ModLoad: 5a110000 5a116000 C:\WINDOWS\system32\WAMREGPS.DLL
"David Wang" wrote in message
news:669d437a-392f-4c00-a252-2a7fd630fddc@s12g2000prg.google groups.com...
> This is heap corruption. You need to use Pageheap to try and catch the
> initial culprit.
>
> All you have right now are analysis of all the victims, which is not
> going to be useful for finding the culprit.
>
> Needless to say, even though DebugDiag is telling you "contact
> Microsoft regarding this crash", it is very much a red-herring.
>
> This type of memory corruption happens like this -- you have a culprit
> DLL which has a bug and frees a piece of memory used by some other
> DLL. And when that DLL later goes to use or free that memory, it
> crashes.
>
> ntdll.dll from Microsoft does the actual "freeing" of memory, so it is
> always on the top of the crash stack, but it is almost never the
> problem -- it is usually the user code telling ntdll to "free" memory
> that is the problem. And in the case of memory corruption, it is
> actually the rogue code which "freed" someone else's memory that is
> the problem, not the code freeing the memory. Complicated, yes. Got
> it? :-)
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //
>
>
>
>
> On Dec 6, 4:12 pm, "Masoud Bayan" wrote:
> > Thanks for your reply.
> > If you look at the debug log, it has two sections and second section is
heap
> > page log. I used the same IIS debug diagnostic tool and used advanced
> > pageheap config and attach to inetinfo.exe.
> > Do I need to use PageHeap tool instead?
> >
> > following I am pasting the advanced pageheap dump analyzes:
> >
> > Thanks
> >
> > Analysis Summary
> > Type Description Recommendation
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437_ _First
chance
> > exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 25 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 23
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 23 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 26
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 26 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 44
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 44 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31__ First
> > chance exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 42
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 42 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 42
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 42 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 25 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765_ _First
chance
> > exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 43
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 43 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
> > inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250_ _First
chance
> > exception 0X800706BA.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706ba) on thread 25
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 25 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Error In
inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46__ First
> > chance exception 0X800706BF.dmp the assembly instruction at
> > kernel32!RaiseException+53 in C:\WINNT\system32\kernel32.dll from
Microsoft
> > Corporation has caused an unknown exception (0x800706bf) on thread 24
> >
> > This exception originated from rpcrt4!RpcpRaiseException+24. Review the
> > faulting call stack for thread 24 to determine root cause for the
exception.
> >
> > Please follow up with vendor Microsoft Corporation for problem
resolution
> > concerning the following file: C:\WINNT\system32\rpcrt4.dll.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_08AM__250 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_21PM__46_ _First
chance
> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_28PM__468 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_23_51PM__765 __First
chance
> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_34_31PM__31_ _First
chance
> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_03PM__359 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_20_11AM__687 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__4680__Date__12_06_2007__Time_02_24_00PM__125 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_11_19_58AM__437 __First
chance
> > exception 0X800706BF.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable combined crash and hang analysis for
crash
> > dumps, edit the IISAnalysis.asp script (located in the DebugDiag\Scripts
> > folder) and set the g_DoCombinedAnalysis constant to True.
> > Information DebugDiag determined that this dump file
> > (inetinfo__PID__3340__Date__12_06_2007__Time_12_42_24PM__875 __First
chance
> > exception 0X800706BA.dmp) is a crash dump and did not perform any hang
> > analysis. If you wish to enable ...
> >
> > read more >>
>