Hmm... unlike other blog software that I have used, this blog does not give you the ability to send anonymous email via a form from the blog to me.
So, I will try to simulate such functionality by dedicating this blog entry's comment section towards allowing you to send anonymous email to me. I hope that the CAPTCHA requirement on comments will limit anonymous blog comment spam that I have seen in the past.
Yes... yours and my email addresses remain private, but the comment contents are no longer private. That should be ok for the most part because my answers to your questions will be publicly posted anyway...
Plus, you get to see all of what have been asked before... and maybe find that you no longer need to comment...
But, if you truly need to send a private email to me, that can be separately arranged. :-)
Cheers!
//David
12 comments:
David, I'm certainly not privy to the politics or (mis?)management over at MS, but I for one am glad to see that you're continuing to blog.
The funny thing is that I know I've given positive feedback specifically about the value of developer's blogs like yours, so its a bit disheartening to hear that the management seems to disagree, or at least censor what you guys feel inclined to share.
Hang in there, keep blogging, and good luck with whatever team you are on now.
A have a Windows 2003 SP1 R2 server running IIS6.0 and SQL Server 2005 SP1 with intranet application written on ASP some self-made DLL. Previously our site run on another server Win2003 sp1 IIS6.0 SQL 2000 sp3.
Intermittently the IIS server stops processing ASP requests (during this time
it continues to serve html pages). The CPU and memory useage appear normal.
The server will rectify itself after a period of 2 to 5 minutues, but some time hang forever.
What i tried:
1) Disable any extension except ASP and SSI, remove all isapi filters from "default web site" and "web sites".
2) PoolMon:
Memory: 8387432K Avail: 4278656K PageFlts: 14339 InRam Krnl: 2704K P:1
Commit:3945000K Limit:20475444K Peak:4189724K Pool N:23348K P:
System pool information
Tag Type Allocs Frees Diff Bytes Per A
File Nonp 4749988 ( 20) 4730194 ( 20) 19794 3031200 ( 0)
LSwi Nonp 1 ( 0) 0 ( 0) 1 2584576 ( 0) 25
Ntfr Nonp 118866 ( 0) 85308 ( 0) 33558 2148680 ( 0)
MmCa Nonp 144001 ( 0) 127475 ( 0) 16526 1844880 ( 0)
TCPt Nonp 700717 ( 22) 700684 ( 22) 33 1656992 ( 0) 5
3) Copy all IIS setting from old server - by visual compare IIS manager's screes.
4) IISState :)
5) perfmon
Now symptoms are:
At random server freeze ASP processing, browser simply go in a wait state. Perfmon show that "Web Server - Current ISAPI extension request" start to grow from 0/1 to 10-40. At one time "web server - current connection" (?10-20 at normal), "asp - request execution" (0-2), "asp - request queued" and "asp - request execution time" (0) grow up. Memory for w3wp.exe also growing from 50mb to 150mb and higher.
Then a number of Current ISAPI request stop to grow, and after a pause IIS self-recover. At that moment all counter drop back to zero, and in httperror appear entries "Connection_dropped DefaultAppPool".
IISState analyze log (dump is taken at hung time):
0:000} !analyze -v
FAULTING_IP:
?0
00000000 ? ?
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000007 (Wake debugger)
ExceptionFlags: 00000000
NumberParameters: 0
FAULTING_THREAD: 00000a9c
BUGCHECK_STR: 80000007
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0x80000007 - {Kernel Debugger Awakened} the system debugger was awakened by an interrupt.
LAST_CONTROL_TRANSFER: from 7c822124 to 7c82ed54
STACK_TEXT:
0006fc08 7c822124 77e6baa8 000001b0 00000000 ntdll!KiFastSystemCallRet
0006fc0c 77e6baa8 000001b0 00000000 00000000 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
0006fc7c 77e6ba12 000001b0 ffffffff 00000000 kernel32!WaitForSingleObjectEx?
0006fc90 5a36467a 000001b0 ffffffff 00000000 kernel32!WaitForSingleObject? 5a366e63 00255238 5a3af41d 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop? 5a3af41d 00000000 64711da9 00000000 w3dt!UlAtqStartListen? 0100187c 00000007 00253988 00000000 w3core!W3_FILE_INFO_CACHE::GetFileCache? w3wp?
0006fff0 00000000 010018f8 00000000 78746341 kernel32!IsProcessorFeaturePresent?_CONTEXT::RunMainThreadLoop?10
5a36467a 837e1400 cmp dword ptr [esi?_STACK_INDEX: 4
SYMBOL_NAME: w3dt!WP_CONTEXT::RunMainThreadLoop?10
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: w3dt
IMAGE_NAME: w3dt.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 424377d3
STACK_COMMAND: ?0s ; kb
FAILURE_BUCKET_ID: 80000007_w3dt!WP_CONTEXT::RunMainThreadLoop?10
BUCKET_ID: 80000007_w3dt!WP_CONTEXT::RunMainThreadLoop?10
Followup: MachineOwner
0:000} !analyze -v -hang
FAULTING_IP:
?0
00000000 ? ?
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000007 (Wake debugger)
ExceptionFlags: 00000000
NumberParameters: 0
FAULTING_THREAD: 00001268
BUGCHECK_STR: HANG
DEFAULT_BUCKET_ID: APPLICATION_HANG
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0xcfffffff - {Unable to get error code text}
DERIVED_WAIT_CHAIN:
Dl Eid Cid WaitType
-- --- ------- --------------------------
22 f60.d50 Critical Section --}
45 f60.1268 Unknown
WAIT_CHAIN_COMMAND: ?22s;k;;?45s;k;;
BLOCKING_THREAD: 00001268
PRIMARY_PROBLEM_CLASS: APPLICATION_HANG
LAST_CONTROL_TRANSFER: from 7c822114 to 7c82ed54
STACK_TEXT:
0792fdcc 7c822114 77e6711b 00000003 0792fe1c ntdll!KiFastSystemCallRet
0792fdd0 77e6711b 00000003 0792fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0792fe78 7739cd08 00000003 0792fea0 00000000 kernel32!ResetEvent?
0792fed4 7738e381 00000002 0792ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0792ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f60d28 00000000 00000000 comsvcs!CoCreateActivity?
0792ffec 00000000 77bcb4bc 0590dad8 00000000 kernel32!GetModuleFileNameA?!CoCreateActivity? eax,eax
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: comsvcs!CoCreateActivity?
MODULE_NAME: comsvcs
IMAGE_NAME: comsvcs.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 424377f7
STACK_COMMAND: ?45s ; kb
FAILURE_BUCKET_ID: HANG_comsvcs!CoCreateActivity?_ID: HANG_comsvcs!CoCreateActivity?} ?*kb
. 0 Id: f60.a9c Suspend: 1 Teb: 7ffdd000 Unfrozen
ChildEBP RetAddr Args to Child
0006fc08 7c822124 77e6baa8 000001b0 00000000 ntdll!KiFastSystemCallRet
0006fc0c 77e6baa8 000001b0 00000000 00000000 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
0006fc7c 77e6ba12 000001b0 ffffffff 00000000 kernel32!WaitForSingleObjectEx?
0006fc90 5a36467a 000001b0 ffffffff 00000000 kernel32!WaitForSingleObject? 5a366e63 00255238 5a3af41d 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop? 5a3af41d 00000000 64711da9 00000000 w3dt!UlAtqStartListen? 0100187c 00000007 00253988 00000000 w3core!W3_FILE_INFO_CACHE::GetFileCache? w3wp?
0006fff0 00000000 010018f8 00000000 78746341 kernel32!IsProcessorFeaturePresent? Suspend: 1 Teb: 7ffdb000 Unfrozen
ChildEBP RetAddr Args to Child
009eff9c 7c821364 7c81fe26 00000001 009effb0 ntdll!KiFastSystemCallRet
009effa0 7c81fe26 00000001 009effb0 00000000 ntdll!NtDelayExecution?
009effb8 77e66063 00000000 00000000 00000000 ntdll!RtlpTimerThread?
WARNING: Stack unwind information not available. Following frames may be wrong.
009effec 00000000 7c81fddf 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd9000 Unfrozen
ChildEBP RetAddr Args to Child
00aafe18 7c821c54 77c7538c 00000164 00aaff74 ntdll!KiFastSystemCallRet
00aafe1c 77c7538c 00000164 00aaff74 00000000 ntdll!ZwReplyWaitReceivePortEx?
WARNING: Stack unwind information not available. Following frames may be wrong.
00aaff84 77c5778f 00aaffac 77c5f7dd 00097510 RPCRT4!I_RpcBindingIsClientLocal? 77c5f7dd 00097510 00000000 00000000 RPCRT4!NdrOleFree? 77c5de88 0008e050 00aaffec 77e66063 RPCRT4!I_RpcTransGetThreadEvent? 77e66063 00097738 00000000 00000000 RPCRT4!I_RpcLogEvent? 00000000 77c5de6d 00097738 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd7000 Unfrozen
ChildEBP RetAddr Args to Child
00caff24 7c821bf4 77e6611a 000001a0 00caff80 ntdll!KiFastSystemCallRet
00caff28 77e6611a 000001a0 00caff80 00caff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00caff54 5a30249e 000001a0 00caff7c 00caff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258750 5a300000 W3TP!THREAD_POOL::PostCompletion?
00caffa0 5a301db9 00000102 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258750 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd6000 Unfrozen
ChildEBP RetAddr Args to Child
00ceff24 7c821bf4 77e6611a 000001a0 00ceff80 ntdll!KiFastSystemCallRet
00ceff28 77e6611a 000001a0 00ceff80 00ceff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00ceff54 5a30249e 000001a0 00ceff7c 00ceff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258770 5a300000 W3TP!THREAD_POOL::PostCompletion?
00ceffa0 5a301db9 00000102 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258770 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd5000 Unfrozen
ChildEBP RetAddr Args to Child
00d2ff24 7c821bf4 77e6611a 000001a0 00d2ff80 ntdll!KiFastSystemCallRet
00d2ff28 77e6611a 000001a0 00d2ff80 00d2ff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00d2ff54 5a30249e 000001a0 00d2ff7c 00d2ff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258828 5a300000 W3TP!THREAD_POOL::PostCompletion?
00d2ffa0 5a301db9 00000102 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258828 00000000 00000000 W3TP? 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd4000 Unfrozen
ChildEBP RetAddr Args to Child
00d6ff24 7c821bf4 77e6611a 000001a0 00d6ff80 ntdll!KiFastSystemCallRet
00d6ff28 77e6611a 000001a0 00d6ff80 00d6ff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00d6ff54 5a30249e 000001a0 00d6ff7c 00d6ff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 002588e0 5a300000 W3TP!THREAD_POOL::PostCompletion?
00d6ffa0 5a301db9 00000102 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 002588e0 00000000 00000000 W3TP? 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffaf000 Unfrozen
ChildEBP RetAddr Args to Child
00daff24 7c821bf4 77e6611a 000001a0 00daff80 ntdll!KiFastSystemCallRet
00daff28 77e6611a 000001a0 00daff80 00daff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00daff54 5a30249e 000001a0 00daff7c 00daff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258900 5a300000 W3TP!THREAD_POOL::PostCompletion?
00daffa0 5a301db9 00000102 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258900 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffae000 Unfrozen
ChildEBP RetAddr Args to Child
00deff24 7c821bf4 77e6611a 000001a0 00deff80 ntdll!KiFastSystemCallRet
00deff28 77e6611a 000001a0 00deff80 00deff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00deff54 5a30249e 000001a0 00deff7c 00deff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 002589b8 5a300000 W3TP!THREAD_POOL::PostCompletion?
00deffa0 5a301db9 002586d8 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 002589b8 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffad000 Unfrozen
ChildEBP RetAddr Args to Child
00e2ff24 7c821bf4 77e6611a 000001a0 00e2ff80 ntdll!KiFastSystemCallRet
00e2ff28 77e6611a 000001a0 00e2ff80 00e2ff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00e2ff54 5a30249e 000001a0 00e2ff7c 00e2ff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258a70 5a300000 W3TP!THREAD_POOL::PostCompletion?
00e2ffa0 5a301db9 002586d8 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258a70 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffac000 Unfrozen
ChildEBP RetAddr Args to Child
00e6ff24 7c821bf4 77e6611a 000001a0 00e6ff80 ntdll!KiFastSystemCallRet
00e6ff28 77e6611a 000001a0 00e6ff80 00e6ff6c ntdll!NtRemoveIoCompletion?
WARNING: Stack unwind information not available. Following frames may be wrong.
00e6ff54 5a30249e 000001a0 00e6ff7c 00e6ff80 kernel32!GetQueuedCompletionStatus? 5a3026bc 00000000 00258a90 5a300000 W3TP!THREAD_POOL::PostCompletion?
00e6ffa0 5a301db9 002586d8 00000000 00000000 W3TP!THREAD_POOL::?THREAD_POOL? 77e66063 00258a90 00000000 00000000 W3TP? kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffab000 Unfrozen
ChildEBP RetAddr Args to Child
00f2fcec 7c822114 7c83acfd 00000003 00f2fd34 ntdll!KiFastSystemCallRet
00f2fcf0 7c83acfd 00000003 00f2fd34 00000001 ntdll!NtWaitForMultipleObjects?
00f2ffb8 77e66063 00000000 00000000 00000000 ntdll!RtlpWaitThread?: Stack unwind information not available. Following frames may be wrong.
00f2ffec 00000000 7c83abb0 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffaa000 Unfrozen
ChildEBP RetAddr Args to Child
01aafa84 7c822124 77e6baa8 000001f8 00000000 ntdll!KiFastSystemCallRet
01aafa88 77e6baa8 000001f8 00000000 00000000 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
01aafaf8 77e6ba12 000001f8 ffffffff 00000000 kernel32!WaitForSingleObjectEx?
01aafb0c 5a3b8147 000001f8 ffffffff 00000000 kernel32!WaitForSingleObject? 77e66063 00000000 00000000 00000000 w3core!W3_FILE_INFO_CACHE::GetFileCache? Suspend: 1 Teb: 7ffa8000 Unfrozen
ChildEBP RetAddr Args to Child
01b2ff8c 7c821364 7c815267 00000001 01b2ffac ntdll!KiFastSystemCallRet
01b2ff90 7c815267 00000001 01b2ffac 00000000 ntdll!NtDelayExecution?
01b2ffb8 77e66063 000afd00 00000000 00000000 ntdll!RtlpIOWorkerThread?: Stack unwind information not available. Following frames may be wrong.
01b2ffec 00000000 7c815228 000afd00 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa7000 Unfrozen
ChildEBP RetAddr Args to Child
0281ff0c 7c822124 77e6baa8 0000027c 00000000 ntdll!KiFastSystemCallRet
0281ff10 77e6baa8 0000027c 00000000 00000000 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
0281ff80 77e6ba12 0000027c ffffffff 00000000 kernel32!WaitForSingleObjectEx?
0281ff94 709fc91b 0000027c ffffffff 00000000 kernel32!WaitForSingleObject? 709fc8f3 77e66063 00000000 00000000 asp!CApplnCleanupMgr::ApplnCleanupDoWork? 77e66063 00000000 00000000 00000000 asp!CApplnCleanupMgr::ApplnCleanupThread? 00000000 709fc8e9 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa6000 Unfrozen
ChildEBP RetAddr Args to Child
028dfe1c 7c822114 77e6711b 00000002 028dfe6c ntdll!KiFastSystemCallRet
028dfe20 77e6711b 00000002 028dfe6c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
028dfec8 7739cd08 00000002 028dfef0 00000000 kernel32!ResetEvent?
028dff24 7738e381 00000001 70a337f0 ffffffff USER32!PeekMessageW? 709fbcbe 00000001 70a337f0 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 70a337d4 00000000 00000000 asp!CMTACallbackThread::Thread?
028dffb8 77e66063 018c11a8 00000000 00000000 msvcrt!endthreadex? 00000000 77bcb4bc 018c11a8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa5000 Unfrozen
ChildEBP RetAddr Args to Child
0291fe1c 7c822114 77e6711b 00000002 0291fe6c ntdll!KiFastSystemCallRet
0291fe20 77e6711b 00000002 0291fe6c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0291fec8 7739cd08 00000002 0291fef0 00000000 kernel32!ResetEvent?
0291ff24 7738e381 00000001 70a32ddc ffffffff USER32!PeekMessageW? 70a018a9 00000001 70a32ddc 00000000 USER32!MsgWaitForMultipleObjects? 77bcb3ca 00e2f4b4 00000000 00000000 asp!Debugger? 77e66063 018c11a8 00000000 00000000 msvcrt!endthread? 00000000 77bcb35a 018c11a8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa4000 Unfrozen
ChildEBP RetAddr Args to Child
0296fd80 7c822114 77e6711b 00000003 0296fdd0 ntdll!KiFastSystemCallRet
0296fd84 77e6711b 00000003 0296fdd0 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0296fe2c 7739cd08 00000003 0296fe54 00000000 kernel32!ResetEvent?
0296fe88 7738e381 00000002 0296fecc 000001f4 USER32!PeekMessageW? 54b21868 00000002 0296fecc 00000000 USER32!MsgWaitForMultipleObjects? 776af5be 0296ff7c 00000000 77790054 pdm? Suspend: 1 Teb: 7ffa3000 Unfrozen
ChildEBP RetAddr Args to Child
02a4fef4 7c822124 77e6baa8 00000304 00000000 ntdll!KiFastSystemCallRet
02a4fef8 77e6baa8 00000304 00000000 00000000 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
02a4ff68 77e6ba12 00000304 ffffffff 00000000 kernel32!WaitForSingleObjectEx?
02a4ff7c 709fe9b7 00000304 ffffffff 00000000 kernel32!WaitForSingleObject? 77e66063 00000000 00000000 00000000 asp!CViperReqManager::WatchThread? 00000000 709fe94f 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa2000 Unfrozen
ChildEBP RetAddr Args to Child
02bafee8 7c822124 77e6baa8 0000035c 00000000 ntdll!KiFastSystemCallRet
02bafeec 77e6baa8 0000035c 00000000 02baff30 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
02baff5c 77e6ba12 0000035c 00002710 00000000 kernel32!WaitForSingleObjectEx?
02baff70 75bd4dc8 0000035c 00002710 018c4c70 kernel32!WaitForSingleObject? 77bcb530 75c5f8d8 00000000 00000000 comsvcs!CoCreateActivity?
02baffec 00000000 77bcb4bc 018c4b40 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa1000 Unfrozen
ChildEBP RetAddr Args to Child
02befee0 7c822124 77e6baa8 0000035c 00000000 ntdll!KiFastSystemCallRet
02befee4 77e6baa8 0000035c 00000000 02beff28 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
02beff54 77e6ba12 0000035c 00003a98 00000000 kernel32!WaitForSingleObjectEx?
02beff68 75bd4843 0000035c 00003a98 00000000 kernel32!WaitForSingleObject? 77bcb530 75c5f8d8 00000000 00000000 comsvcs!CoCreateActivity?
02beffec 00000000 77bcb4bc 018c4bd8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa0000 Unfrozen
ChildEBP RetAddr Args to Child
02c2fdcc 7c822114 77e6711b 00000003 02c2fe1c ntdll!KiFastSystemCallRet
02c2fdd0 77e6711b 00000003 02c2fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02c2fe78 7739cd08 00000003 02c2fea0 00000000 kernel32!ResetEvent?
02c2fed4 7738e381 00000002 02c2ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02c2ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000db630 00000000 00000000 comsvcs!CoCreateActivity?
02c2ffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff9f000 Unfrozen
ChildEBP RetAddr Args to Child
02c6f190 7c822124 7c83970f 000004a4 00000000 ntdll!KiFastSystemCallRet
02c6f194 7c83970f 000004a4 00000000 00000000 ntdll!NtWaitForSingleObject?
02c6f1d0 7c839620 00000000 00000004 00000d50 ntdll!RtlpWaitOnCriticalSection? 709eca60 01d81f10 00000000 709e1c04 ntdll!RtlEnterCriticalSection? 77d06de9 01d81e90 02c6f254 02ef77e8 asp!CAppln::Lock?
WARNING: Stack unwind information not available. Following frames may be wrong.
02c6f220 77d06c80 01d81e90 00000028 00000004 OLEAUT32!DispCallFunc?
02c6f2b0 709ed2c6 000e3c1c 01d81e90 00000000 OLEAUT32!VarBstrFromI4? 73469f71 01d81e90 60020003 73464c18 asp!CDispatchImpl{IApplicationObject}::Invoke? 73468f37 085b9f18 01d81e90 60020003 vbscript? 73469000 088c8248 01d81e90 60020003 vbscript? 01d81e90 60020003 vbscript? 73464940 00000000 00000000 088c8248 vbscript? 73472d3b 085ba3a8 00000000 00000000 vbscript? 00000000 02c6fb0c asp!CActiveScriptEngine::TryCall? 709e2e50 709f4474 00000000 02c6fb0c asp!CActiveScriptEngine::Call? Suspend: 1 Teb: 7ff9e000 Unfrozen
ChildEBP RetAddr Args to Child
02cafdcc 7c822114 77e6711b 00000003 02cafe1c ntdll!KiFastSystemCallRet
02cafdd0 77e6711b 00000003 02cafe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02cafe78 7739cd08 00000003 02cafea0 00000000 kernel32!ResetEvent?
02cafed4 7738e381 00000002 02caff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02caff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000d2a78 00000000 00000000 comsvcs!CoCreateActivity?
02caffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff9d000 Unfrozen
ChildEBP RetAddr Args to Child
02cefdcc 7c822114 77e6711b 00000003 02cefe1c ntdll!KiFastSystemCallRet
02cefdd0 77e6711b 00000003 02cefe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02cefe78 7739cd08 00000003 02cefea0 00000000 kernel32!ResetEvent?
02cefed4 7738e381 00000002 02ceff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02ceff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000d32d8 00000000 00000000 comsvcs!CoCreateActivity?
02ceffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff9c000 Unfrozen
ChildEBP RetAddr Args to Child
02d2fdcc 7c822114 77e6711b 00000003 02d2fe1c ntdll!KiFastSystemCallRet
02d2fdd0 77e6711b 00000003 02d2fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02d2fe78 7739cd08 00000003 02d2fea0 00000000 kernel32!ResetEvent?
02d2fed4 7738e381 00000002 02d2ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02d2ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000d3b20 00000000 00000000 comsvcs!CoCreateActivity?
02d2ffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff9b000 Unfrozen
ChildEBP RetAddr Args to Child
02d6ee50 7c822124 7c83970f 000004a4 00000000 ntdll!KiFastSystemCallRet
02d6ee54 7c83970f 000004a4 00000000 00000000 ntdll!NtWaitForSingleObject?
02d6ee90 7c839620 00000000 00000004 00001764 ntdll!RtlpWaitOnCriticalSection? 709eca60 01d81f10 00000000 709e1c04 ntdll!RtlEnterCriticalSection? 77d06de9 01d81e90 02d6ef14 02ef77e8 asp!CAppln::Lock?
WARNING: Stack unwind information not available. Following frames may be wrong.
02d6eee0 77d06c80 01d81e90 00000028 00000004 OLEAUT32!DispCallFunc?
02d6ef70 709ed2c6 000e3c1c 01d81e90 00000000 OLEAUT32!VarBstrFromI4? 73469f71 01d81e90 60020003 73464c18 asp!CDispatchImpl{IApplicationObject}::Invoke? 73468f37 05968c68 01d81e90 60020003 vbscript? 73469000 018c5518 01d81e90 60020003 vbscript? 01d81e90 60020003 vbscript? 73464940 02d6f800 00000000 018c5518 vbscript? 73464940 00000000 00000000 018c5518 vbscript? 73465522 03bfe598 00000000 00000000 vbscript? 709e2f5a 02442940 02442940 01d45f40 vbscript? Id: f60.f1c Suspend: 1 Teb: 7ff9a000 Unfrozen
ChildEBP RetAddr Args to Child
02dafdcc 7c822114 77e6711b 00000003 02dafe1c ntdll!KiFastSystemCallRet
02dafdd0 77e6711b 00000003 02dafe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02dafe78 7739cd08 00000003 02dafea0 00000000 kernel32!ResetEvent?
02dafed4 7738e381 00000002 02daff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02daff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000d50e8 00000000 00000000 comsvcs!CoCreateActivity?
02daffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff99000 Unfrozen
ChildEBP RetAddr Args to Child
02defdcc 7c822114 77e6711b 00000003 02defe1c ntdll!KiFastSystemCallRet
02defdd0 77e6711b 00000003 02defe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
02defe78 7739cd08 00000003 02defea0 00000000 kernel32!ResetEvent?
02defed4 7738e381 00000002 02deff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 02deff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000d5940 00000000 00000000 comsvcs!CoCreateActivity?
02deffec 00000000 77bcb4bc 018c4d08 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff98000 Unfrozen
ChildEBP RetAddr Args to Child
035dff88 7c822114 71c6df01 00000002 035dffb0 ntdll!KiFastSystemCallRet
035dff8c 71c6df01 00000002 035dffb0 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
035dffb8 77e66063 00000000 00000000 00000000 NETAPI32!NetpwPathCompare? Suspend: 1 Teb: 7ff97000 Unfrozen
ChildEBP RetAddr Args to Child
0361fd00 7c822124 77e6baa8 0000048c 00000000 ntdll!KiFastSystemCallRet
0361fd04 77e6baa8 0000048c 00000000 0361fd48 ntdll!NtWaitForSingleObject?
WARNING: Stack unwind information not available. Following frames may be wrong.
0361fd74 77e6ba12 0000048c 00002710 00000000 kernel32!WaitForSingleObjectEx?
0361fd88 75bb250b 0000048c 00002710 00000000 kernel32!WaitForSingleObject? 77e66063 000ef568 00000000 00000000 comsvcs!DispManGetContext? 00000000 75bb2443 000ef568 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff94000 Unfrozen
ChildEBP RetAddr Args to Child
0467fdcc 7c822114 77e6711b 00000003 0467fe1c ntdll!KiFastSystemCallRet
0467fdd0 77e6711b 00000003 0467fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0467fe78 7739cd08 00000003 0467fea0 00000000 kernel32!ResetEvent?
0467fed4 7738e381 00000002 0467ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0467ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 00138470 00000000 00000000 comsvcs!CoCreateActivity?
0467ffec 00000000 77bcb4bc 018d3df0 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff8f000 Unfrozen
ChildEBP RetAddr Args to Child
049ffdcc 7c822114 77e6711b 00000003 049ffe1c ntdll!KiFastSystemCallRet
049ffdd0 77e6711b 00000003 049ffe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
049ffe78 7739cd08 00000003 049ffea0 00000000 kernel32!ResetEvent?
049ffed4 7738e381 00000002 049fff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 049fff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 0017fe30 00000000 00000000 comsvcs!CoCreateActivity?
049fffec 00000000 77bcb4bc 018ef190 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff8e000 Unfrozen
ChildEBP RetAddr Args to Child
04a3fdcc 7c822114 77e6711b 00000003 04a3fe1c ntdll!KiFastSystemCallRet
04a3fdd0 77e6711b 00000003 04a3fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
04a3fe78 7739cd08 00000003 04a3fea0 00000000 kernel32!ResetEvent?
04a3fed4 7738e381 00000002 04a3ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 04a3ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04454760 00000000 00000000 comsvcs!CoCreateActivity?
04a3ffec 00000000 77bcb4bc 018ef190 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff93000 Unfrozen
ChildEBP RetAddr Args to Child
0580fdcc 7c822114 77e6711b 00000003 0580fe1c ntdll!KiFastSystemCallRet
0580fdd0 77e6711b 00000003 0580fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0580fe78 7739cd08 00000003 0580fea0 00000000 kernel32!ResetEvent?
0580fed4 7738e381 00000002 0580ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0580ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04452008 00000000 00000000 comsvcs!CoCreateActivity?
0580ffec 00000000 77bcb4bc 018d4d50 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff91000 Unfrozen
ChildEBP RetAddr Args to Child
0584fdcc 7c822114 77e6711b 00000003 0584fe1c ntdll!KiFastSystemCallRet
0584fdd0 77e6711b 00000003 0584fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0584fe78 7739cd08 00000003 0584fea0 00000000 kernel32!ResetEvent?
0584fed4 7738e381 00000002 0584ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0584ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 044bc658 00000000 00000000 comsvcs!CoCreateActivity?
0584ffec 00000000 77bcb4bc 018d4d50 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff90000 Unfrozen
ChildEBP RetAddr Args to Child
0664fdcc 7c822114 77e6711b 00000003 0664fe1c ntdll!KiFastSystemCallRet
0664fdd0 77e6711b 00000003 0664fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0664fe78 7739cd08 00000003 0664fea0 00000000 kernel32!ResetEvent?
0664fed4 7738e381 00000002 0664ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0664ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f60510 00000000 00000000 comsvcs!CoCreateActivity?
0664ffec 00000000 77bcb4bc 018d4d50 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff8a000 Unfrozen
ChildEBP RetAddr Args to Child
0701ee50 7c822124 7c83970f 000004a4 00000000 ntdll!KiFastSystemCallRet
0701ee54 7c83970f 000004a4 00000000 00000000 ntdll!NtWaitForSingleObject?
0701ee90 7c839620 00000000 00000004 00000c8c ntdll!RtlpWaitOnCriticalSection? 709eca60 01d81f10 00000000 709e1c04 ntdll!RtlEnterCriticalSection? 77d06de9 01d81e90 0701ef14 02ef77e8 asp!CAppln::Lock?
WARNING: Stack unwind information not available. Following frames may be wrong.
0701eee0 77d06c80 01d81e90 00000028 00000004 OLEAUT32!DispCallFunc?
0701ef70 709ed2c6 000e3c1c 01d81e90 00000000 OLEAUT32!VarBstrFromI4? 73469f71 01d81e90 60020003 73464c18 asp!CDispatchImpl{IApplicationObject}::Invoke? 73468f37 018c5d90 01d81e90 60020003 vbscript? 73469000 018c6bc0 01d81e90 60020003 vbscript? 01d81e90 60020003 vbscript? 73464940 0701f800 00000000 018c6bc0 vbscript? 73464940 00000000 00000000 018c6bc0 vbscript? 73465522 058c2560 00000000 00000000 vbscript? 709e2f5a 02443d38 02443d38 01d42160 vbscript? Id: f60.1518 Suspend: 1 Teb: 7ff89000 Unfrozen
ChildEBP RetAddr Args to Child
0710fdcc 7c822114 77e6711b 00000003 0710fe1c ntdll!KiFastSystemCallRet
0710fdd0 77e6711b 00000003 0710fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0710fe78 7739cd08 00000003 0710fea0 00000000 kernel32!ResetEvent?
0710fed4 7738e381 00000002 0710ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0710ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f70080 00000000 00000000 comsvcs!CoCreateActivity?
0710ffec 00000000 77bcb4bc 018e4d78 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff95000 Unfrozen
ChildEBP RetAddr Args to Child
057cfdcc 7c822114 77e6711b 00000003 057cfe1c ntdll!KiFastSystemCallRet
057cfdd0 77e6711b 00000003 057cfe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
057cfe78 7739cd08 00000003 057cfea0 00000000 kernel32!ResetEvent?
057cfed4 7738e381 00000002 057cff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 057cff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 044d1ec0 00000000 00000000 comsvcs!CoCreateActivity?
057cffec 00000000 77bcb4bc 03c724c8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff92000 Unfrozen
ChildEBP RetAddr Args to Child
0786fdcc 7c822114 77e6711b 00000003 0786fe1c ntdll!KiFastSystemCallRet
0786fdd0 77e6711b 00000003 0786fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0786fe78 7739cd08 00000003 0786fea0 00000000 kernel32!ResetEvent?
0786fed4 7738e381 00000002 0786ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0786ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04fc2db0 00000000 00000000 comsvcs!CoCreateActivity?
0786ffec 00000000 77bcb4bc 03c724c8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffdc000 Unfrozen
ChildEBP RetAddr Args to Child
009afdcc 7c822114 77e6711b 00000003 009afe1c ntdll!KiFastSystemCallRet
009afdd0 77e6711b 00000003 009afe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
009afe78 7739cd08 00000003 009afea0 00000000 kernel32!ResetEvent?
009afed4 7738e381 00000002 009aff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 009aff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 00139380 00000000 00000000 comsvcs!CoCreateActivity?
009affec 00000000 77bcb4bc 0590dee8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff8d000 Unfrozen
ChildEBP RetAddr Args to Child
0668fdcc 7c822114 77e6711b 00000003 0668fe1c ntdll!KiFastSystemCallRet
0668fdd0 77e6711b 00000003 0668fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0668fe78 7739cd08 00000003 0668fea0 00000000 kernel32!ResetEvent?
0668fed4 7738e381 00000002 0668ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0668ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f70c30 00000000 00000000 comsvcs!CoCreateActivity?
0668ffec 00000000 77bcb4bc 03ce9b78 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff85000 Unfrozen
ChildEBP RetAddr Args to Child
07f8fdcc 7c822114 77e6711b 00000003 07f8fe1c ntdll!KiFastSystemCallRet
07f8fdd0 77e6711b 00000003 07f8fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
07f8fe78 7739cd08 00000003 07f8fea0 00000000 kernel32!ResetEvent?
07f8fed4 7738e381 00000002 07f8ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 07f8ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04fcfd10 00000000 00000000 comsvcs!CoCreateActivity?
07f8ffec 00000000 77bcb4bc 05968718 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff84000 Unfrozen
ChildEBP RetAddr Args to Child
07fcfdcc 7c822114 77e6711b 00000003 07fcfe1c ntdll!KiFastSystemCallRet
07fcfdd0 77e6711b 00000003 07fcfe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
07fcfe78 7739cd08 00000003 07fcfea0 00000000 kernel32!ResetEvent?
07fcfed4 7738e381 00000002 07fcff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 07fcff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04512478 00000000 00000000 comsvcs!CoCreateActivity?
07fcffec 00000000 77bcb4bc 05968718 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff88000 Unfrozen
ChildEBP RetAddr Args to Child
0792fdcc 7c822114 77e6711b 00000003 0792fe1c ntdll!KiFastSystemCallRet
0792fdd0 77e6711b 00000003 0792fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0792fe78 7739cd08 00000003 0792fea0 00000000 kernel32!ResetEvent?
0792fed4 7738e381 00000002 0792ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0792ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f60d28 00000000 00000000 comsvcs!CoCreateActivity?
0792ffec 00000000 77bcb4bc 0590dad8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff87000 Unfrozen
ChildEBP RetAddr Args to Child
0796fdcc 7c822114 77e6711b 00000003 0796fe1c ntdll!KiFastSystemCallRet
0796fdd0 77e6711b 00000003 0796fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0796fe78 7739cd08 00000003 0796fea0 00000000 kernel32!ResetEvent?
0796fed4 7738e381 00000002 0796ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0796ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f59850 00000000 00000000 comsvcs!CoCreateActivity?
0796ffec 00000000 77bcb4bc 0590dad8 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff7f000 Unfrozen
ChildEBP RetAddr Args to Child
046bfdcc 7c822114 77e6711b 00000003 046bfe1c ntdll!KiFastSystemCallRet
046bfdd0 77e6711b 00000003 046bfe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
046bfe78 7739cd08 00000003 046bfea0 00000000 kernel32!ResetEvent?
046bfed4 7738e381 00000002 046bff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 046bff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000ce5f0 00000000 00000000 comsvcs!CoCreateActivity?
046bffec 00000000 77bcb4bc 0844c5d0 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff7d000 Unfrozen
ChildEBP RetAddr Args to Child
0489fdcc 7c822114 77e6711b 00000003 0489fe1c ntdll!KiFastSystemCallRet
0489fdd0 77e6711b 00000003 0489fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0489fe78 7739cd08 00000003 0489fea0 00000000 kernel32!ResetEvent?
0489fed4 7738e381 00000002 0489ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0489ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 00142098 00000000 00000000 comsvcs!CoCreateActivity?
0489ffec 00000000 77bcb4bc 05a8d2b0 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff8c000 Unfrozen
ChildEBP RetAddr Args to Child
04e6fdcc 7c822114 77e6711b 00000003 04e6fe1c ntdll!KiFastSystemCallRet
04e6fdd0 77e6711b 00000003 04e6fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
04e6fe78 7739cd08 00000003 04e6fea0 00000000 kernel32!ResetEvent?
04e6fed4 7738e381 00000002 04e6ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 04e6ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 0452de80 00000000 00000000 comsvcs!CoCreateActivity?
04e6ffec 00000000 77bcb4bc 05994f20 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff81000 Unfrozen
ChildEBP RetAddr Args to Child
0564ee50 7c822124 7c83970f 000004a4 00000000 ntdll!KiFastSystemCallRet
0564ee54 7c83970f 000004a4 00000000 00000000 ntdll!NtWaitForSingleObject?
0564ee90 7c839620 00000000 00000004 00000ab8 ntdll!RtlpWaitOnCriticalSection? 709eca60 01d81f10 00000000 709e1c04 ntdll!RtlEnterCriticalSection? 77d06de9 01d81e90 0564ef14 02ef77e8 asp!CAppln::Lock?
WARNING: Stack unwind information not available. Following frames may be wrong.
0564eee0 77d06c80 01d81e90 00000028 00000004 OLEAUT32!DispCallFunc?
0564ef70 709ed2c6 000e3c1c 01d81e90 00000000 OLEAUT32!VarBstrFromI4? 73469f71 01d81e90 60020003 73464c18 asp!CDispatchImpl{IApplicationObject}::Invoke? 73468f37 03cea348 01d81e90 60020003 vbscript? 73469000 08729f88 01d81e90 60020003 vbscript? 01d81e90 60020003 vbscript? 73464940 0564f800 00000000 08729f88 vbscript? 73464940 00000000 00000000 08729f88 vbscript? 73465522 05911e40 00000000 00000000 vbscript? 709e2f5a 02443b00 02443b00 01d449b0 vbscript? Id: f60.1070 Suspend: 1 Teb: 7ff86000 Unfrozen
ChildEBP RetAddr Args to Child
0adbfdcc 7c822114 77e6711b 00000003 0adbfe1c ntdll!KiFastSystemCallRet
0adbfdd0 77e6711b 00000003 0adbfe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0adbfe78 7739cd08 00000003 0adbfea0 00000000 kernel32!ResetEvent?
0adbfed4 7738e381 00000002 0adbff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0adbff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 00175ec8 00000000 00000000 comsvcs!CoCreateActivity?
0adbffec 00000000 77bcb4bc 059d9c20 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff7e000 Unfrozen
ChildEBP RetAddr Args to Child
04c6fdcc 7c822114 77e6711b 00000003 04c6fe1c ntdll!KiFastSystemCallRet
04c6fdd0 77e6711b 00000003 04c6fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
04c6fe78 7739cd08 00000003 04c6fea0 00000000 kernel32!ResetEvent?
04c6fed4 7738e381 00000002 04c6ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 04c6ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 044cfe50 00000000 00000000 comsvcs!CoCreateActivity?
04c6ffec 00000000 77bcb4bc 0199f600 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff96000 Unfrozen
ChildEBP RetAddr Args to Child
0485fe18 7c821c54 77c7538c 00000164 0485ff74 ntdll!KiFastSystemCallRet
0485fe1c 77c7538c 00000164 0485ff74 00000000 ntdll!ZwReplyWaitReceivePortEx?
WARNING: Stack unwind information not available. Following frames may be wrong.
0485ff84 77c5778f 0485ffac 77c5f7dd 00097510 RPCRT4!I_RpcBindingIsClientLocal? 77c5f7dd 00097510 00000000 00000000 RPCRT4!NdrOleFree? 77c5de88 0008e050 0485ffec 77e66063 RPCRT4!I_RpcTransGetThreadEvent? 77e66063 00145438 00000000 00000000 RPCRT4!I_RpcLogEvent? 00000000 77c5de6d 00145438 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff77000 Unfrozen
ChildEBP RetAddr Args to Child
0b40fdcc 7c822114 77e6711b 00000003 0b40fe1c ntdll!KiFastSystemCallRet
0b40fdd0 77e6711b 00000003 0b40fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0b40fe78 7739cd08 00000003 0b40fea0 00000000 kernel32!ResetEvent?
0b40fed4 7738e381 00000002 0b40ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0b40ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 050d63e8 00000000 00000000 comsvcs!CoCreateActivity?
0b40ffec 00000000 77bcb4bc 018ca7e0 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff7b000 Unfrozen
ChildEBP RetAddr Args to Child
0c79fdcc 7c822114 77e6711b 00000003 0c79fe1c ntdll!KiFastSystemCallRet
0c79fdd0 77e6711b 00000003 0c79fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0c79fe78 7739cd08 00000003 0c79fea0 00000000 kernel32!ResetEvent?
0c79fed4 7738e381 00000002 0c79ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0c79ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 0a1e0318 00000000 00000000 comsvcs!CoCreateActivity?
0c79ffec 00000000 77bcb4bc 03cec870 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff7a000 Unfrozen
ChildEBP RetAddr Args to Child
0c7dfdcc 7c822114 77e6711b 00000003 0c7dfe1c ntdll!KiFastSystemCallRet
0c7dfdd0 77e6711b 00000003 0c7dfe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
0c7dfe78 7739cd08 00000003 0c7dfea0 00000000 kernel32!ResetEvent?
0c7dfed4 7738e381 00000002 0c7dff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 0c7dff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000dd4e8 00000000 00000000 comsvcs!CoCreateActivity?
0c7dffec 00000000 77bcb4bc 059d9c20 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff83000 Unfrozen
ChildEBP RetAddr Args to Child
079eff70 7c821bf4 7c83ad75 00000118 079effb0 ntdll!KiFastSystemCallRet
079eff74 7c83ad75 00000118 079effb0 079effb4 ntdll!NtRemoveIoCompletion?
079effb8 77e66063 00000000 00000000 00000000 ntdll!RtlpWorkerThread?: Stack unwind information not available. Following frames may be wrong.
079effec 00000000 7c83ad38 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffa9000 Unfrozen
ChildEBP RetAddr Args to Child
079afdcc 7c822114 77e6711b 00000003 079afe1c ntdll!KiFastSystemCallRet
079afdd0 77e6711b 00000003 079afe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
079afe78 7739cd08 00000003 079afea0 00000000 kernel32!ResetEvent?
079afed4 7738e381 00000002 079aff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 079aff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 000cb4d8 00000000 00000000 comsvcs!CoCreateActivity?
079affec 00000000 77bcb4bc 0863ce50 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff78000 Unfrozen
ChildEBP RetAddr Args to Child
07c9fdcc 7c822114 77e6711b 00000003 07c9fe1c ntdll!KiFastSystemCallRet
07c9fdd0 77e6711b 00000003 07c9fe1c 00000001 ntdll!NtWaitForMultipleObjects?
WARNING: Stack unwind information not available. Following frames may be wrong.
07c9fe78 7739cd08 00000003 07c9fea0 00000000 kernel32!ResetEvent?
07c9fed4 7738e381 00000002 07c9ff74 ffffffff USER32!PeekMessageW? 75bd88b6 00000002 07c9ff74 00000000 USER32!MsgWaitForMultipleObjects? 77bcb530 04f84f48 00000000 00000000 comsvcs!CoCreateActivity?
07c9ffec 00000000 77bcb4bc 0b652048 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffda000 Unfrozen
ChildEBP RetAddr Args to Child
00aeff70 7c821bf4 7c83ad75 00000118 00aeffb0 ntdll!KiFastSystemCallRet
00aeff74 7c83ad75 00000118 00aeffb0 00aeffb4 ntdll!NtRemoveIoCompletion?
00aeffb8 77e66063 00000000 00000000 00000000 ntdll!RtlpWorkerThread?: Stack unwind information not available. Following frames may be wrong.
00aeffec 00000000 7c83ad38 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ff82000 Unfrozen
ChildEBP RetAddr Args to Child
07a6ff70 7c821bf4 7c83ad75 00000118 07a6ffb0 ntdll!KiFastSystemCallRet
07a6ff74 7c83ad75 00000118 07a6ffb0 07a6ffb4 ntdll!NtRemoveIoCompletion?
07a6ffb8 77e66063 00000000 00000000 00000000 ntdll!RtlpWorkerThread?: Stack unwind information not available. Following frames may be wrong.
07a6ffec 00000000 7c83ad38 00000000 00000000 kernel32!GetModuleFileNameA? Suspend: 1 Teb: 7ffd8000 Unfrozen
ChildEBP RetAddr Args to Child
06f3ff70 7c821bf4 7c83ad75 00000118 06f3ffb0 ntdll!KiFastSystemCallRet
06f3ff74 7c83ad75 00000118 06f3ffb0 06f3ffb4 ntdll!NtRemoveIoCompletion?
06f3ffb8 77e66063 00000000 00000000 00000000 ntdll!RtlpWorkerThread?: Stack unwind information not available. Following frames may be wrong.
06f3ffec 00000000 7c83ad38 00000000 00000000 kernel32!GetModuleFileNameA?
Hi David,
Great to see you are still blogging in a Q&A style, I know it is greatly appreciated by anyone who has entered the murky world of ISAPI. On to my question:
I realize this is a little application specific but I also know the FPRPC code is owned by the IIS team even though they hardly ever admit it.
I have an ISAPI filter and I am trying to replace the document data returned in an FPRPC Get Document method (DoSendRawData). I am leaving the headers and the FP metadata html block untouched.
When I trace the client receipt it all looks correct however the FPRPC client (Microsoft Word 2007 in this case) does not seem to like the response and kicks out to some OPTIONS calls and then a straight GET on the doc url (which I don't want).
Is there any cross-check between the headers, metadata and content of the response? Is there any integrity check across methods (for example the docs_meta_info method)? Lastly, do you know of any documentation on what the rsponse of a Get Document call should return?
Also, any (and I mean any) nugget of wisdom on FPRPC would be gratefully appreciated.
Many Thanks,
Brian
David ... I needing all the assistance I can get on the following problem ...
abridged version:
we use ISA server 2004 as a proxy. In conjunction, on same server we have SurfControl...which is a "plug-in" for ISA. Surfcontrol scans all user web traffic, and blocks traffic to inappropriate web sites.
ISA server seems to have a single radio button which specifies "require authentication"...it is seemingly an all-or-none proposition.
If I do not check "require authentication"...then the audit logs within ISA and Surfcontrol do not contain client machine name, nor client username. The audit records will only contain client IP address...which is virtually useless looking at historical logs (when you want to know what web sites Billy-Bob hit over the last 6 months). Regularly, the HR department will request such info....what sites has Billy-Bob been browsing for the last 6 months. These are usually employee discipline, preparing to "fire" Billy-Bob situations.
If I check "require authentication"...then the audit logs tell me username. KEWL!
Whoops....half of our client base are off site sales folks who never logs on to the network, but rather use cached credentials to the local machine and then use VPN to get on the network. Double-whoops -- if I have checked "require authentication"....ISA server says to these users -- "I don't know who you are...here is your username/password prompt...so you can browse the internet". Double-damn.
Do not want username/password prompt for users to surf internet -- so I remove "require authentication" requirement...and my audit logs are worthless.
So I checked out a sample webfilter program for ISA called MyAuth http://msdn2.microsoft.com/en-us/library/aa503245.aspx
It is a C++ .net application. I am able to install the program using .net on the ISA server ... register the myauthfilter.dll. It prompts the user for a user name (no password) and then uses that username as "authentication". It appends the username (name=username) to the end of the URL which messes up some web pages.
I would like to pick up a piece of info from the PC like computername and feed it as authentication (since the myauth, really does not autheniticate it only takes info and uses it) to MyAuth to give it useful info for the ISA log file and not prompt the user for anything... sound reasonable?
But I am lost with C++ and all the APIs available.
Maybe I am taking a bad path ... if the user's where truely authenticated to the network I would not have this problem. Is there a way to force authentication after the user has authenticated locally using cached creditials?
Any leads / thoughts? Please I am despirate.
Packets in DoSendRawData:
I would like to redirect in an ISAPI filter by replacing the first packet with a 302 status. However I can only decide upon whether to redirect or not based on subsequent response packets. I can save off the first packet and the let it through or replace after I have got the next packet but I would prefer not to get into that because I could potentially mess up requests I'm not concerned with.
Is there any built-in ISAPI support for "holding back" packets?
Sean
Hi David, we traded some posts in microsoft.public.inetserver.iis -- I hope it's ok to try you here.
(fwiw, I'm scott AT turnstyle.com)
I have a new/clean Vista install with just:
1) a few hardware drivers
2) IIS (with ISAPI & CGI enabled)
3) Windows Update patches
4) PHP 5.2.5 -- I unzip PHP into inetpub and map *.php to PHP5isapi.dll
I can open a PHP page, but if I then go to IIS Manager and refresh the default application pool, I get a "Worker Process has stopped working" alert and a crash in Event Viewer.
I don't know what more to try -- I wonder whether others are having the same problem? (ie, can this even be fixed, or is it something to "get used to"?)
Many Thanks for any suggestions! -Scott
David, could you look into posting an article outlining how to run nested ASP.NET applications? Specifically, there is a lot of confusion on how you can merge multiple web.config files that are used by various applications. For example, I use BlogEngine.Net and would like to have ScrewTurn wiki running in a subfolder. I have yet to find good documentation on how best to work through the problems of merging the two web.config files in order to make everything work correctly. You seem like the right person to help resolve this issue.
Chris
www.dscoduc.com
In a blog on ISAPI extensions lifetimes, you mention this:
'As for safety - it is safe to spawn your own threads from within an ISAPI Extension - for example, ISAPI Extension using a Thread Pool to queue/process requests asynchronously does this, by design. What you need to ensure is that if those threads touch the ECB (or any other memory, for that matter), that the ECB is valid. For synchronous request, the ECB will not be valid in between HttpExtensionProc calls (its lifetime is tied to the HttpExtensionProc lifetime for that particular request). For asynchronous requests, ECB will stay valid until HSE_REQ_DONE_WITH_SESSION is called on that ECB.'
I'm confused here about the 'or any other memory' phrase. Do you mean that the thread may never touch any memory when out of the HttpExtensionProc context? That would render any background thread a bit useless (unless it's ok to alays return a pending status). I don't really see why memory allocated by the DLL itself can't be touched.
Regards,
Ton
You need to stop allowing anon comments ;o)
http://w3-4u.blogspot.com/2006/10/qa-problems-running-wscriptshell-on.html?showComment=1239583701219#c3341231588833124109
Hi, David,
I have a different question -
it would be great if you could elaborate on the following (your post):
THANKS!!
You will not be able to use Client Certificates with a Load balancer
that serves as the SSL termination point.
You will have to choose whether Load balancing or Client Certificates
based security is more important because by their very natures, they
are incompatible. Client Certificate cannot be re-transmitted once it
has been terminated, which is necessary for their security (if Client
Certificate could be retransmitted, then how can the recipient be sure
that the sender is the actual sender and not an imposter who
retransmits a forgery? This uncertainly undermines the point of Client
Certificate proving identification). Load balancing is going to
terminate the request so that it can balancing amongst its internal
pool of servers. The two won't mix.
It seems like you are saying that Client Certificates are more
important since you are willing to allow traffic to bypass Load
balancer, in which case the individual server must have a certificate
whose name matches what the external user typed (either exact or via
wildcard certificate). i.e. treat it like any other SSL server you
directly expose.
I really like your ideas. I truly appreciate your effort in publishing this article. Keep it up and God bless.
Jax
www.imarksweb.org
Post a Comment