Iisadmin service is stopping every 2-5 minutes on Exchange 2000 running on Windows 2000 server. When this occurs smtp service and routing service is stopped also. I have been searching the internet and come up with the code red worm and code red worm 2 problems which I have downloaded the removal tool and run. Also renamed the VSI folder to rule out any mail in the queues causing a problem. Cleared badmail. I have now run iisstate which produced a log but I have no idea how to inteprate this, looking for some help on this. Opened log file 'C:\iisstate\output\IISState-2252.log' *********************** Starting new log output IISState version 3.3.1 Mon Apr 21 09:20:07 2008 OS = Windows 2000 Executable: inetinfo.exe PID = 2252 Note: Thread times are formatted as HH:MM:SS.ms *********************** Thread ID: 0 System Thread ID: 448 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0006f89c 7c586381 ntdll!ZwReadFile+0xb 01 0006f910 7c2dd578 KERNEL32!ReadFile+0x181 02 0006f93c 7c2dd61e ADVAPI32!ObjectCloseAuditAlarmA+0x2f 03 0006f9b8 7c2d1e18 ADVAPI32!ObjectDeleteAuditAlarmW+0x4 04 0006fbf4 01002884 ADVAPI32!`string' 05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1 06 0006ff70 01002fbf inetinfo!main+0x654 07 0006ffc0 7c5989d5 inetinfo!mainCRTStartup+0xff 08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d Thread ID: 1 System Thread ID: fc0 Kernel Time: 0:0:0.109 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 0061fd1c 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0061fd44 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0061fd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf 03 0061fd70 01002440 iisadmin!ServiceEntry+0x156 04 0061ffa4 7c2dcf43 inetinfo!InetinfoStartService+0x2bd 05 0061ffec 00000000 ADVAPI32!AccessCheckByTypeResultListAndAuditAlarmByHandleW+0x2f Thread ID: 2 System Thread ID: 14b8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0075fe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0075feac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0075ff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0075ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0075ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0075ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 3 System Thread ID: 3d0 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0079fe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0079feac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0079ff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0079ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0079ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0079ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0079ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 4 System Thread ID: c1c Kernel Time: 0:0:0.31 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 007dfe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 007dfeac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 007dff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 007dff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 007dff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 007dffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 007dffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 5 System Thread ID: 1468 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0081fe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0081feac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0081ff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0081ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d 04 0081ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7 05 0081ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0081ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 6 System Thread ID: e58 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 00c6fe24 77d595d9 ntdll!ZwReplyWaitReceivePortEx+0xb 01 00c6ff74 77d58e4a RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 00c6ff78 77d3aeed RPCRT4!RecvLotsaCallsWrapper+0x9 03 00c6ffa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 04 00c6ffb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 05 00c6ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 7 System Thread ID: 9f0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 00caff60 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 00caff88 7ce85bc5 KERNEL32!WaitForSingleObjectEx+0x71 02 00caffa8 7ce85aff ole32!CRpcThread::WorkerLoop+0x40 03 00caffb4 7c57b3bc ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 04 00caffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 8 System Thread ID: 164 Kernel Time: 0:0:0.156 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 00effc10 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 00effc60 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 00effcbc 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 00effcd8 685a366e USER32!MsgWaitForMultipleObjects+0x1d 04 00effd24 1000acb8 LNFOCOMM!IIS_SERVICE::StartServiceOperation+0x1d9 05 00effd70 01002440 resvc!ServiceEntry+0x25d 06 00efffa4 7c2dcf43 inetinfo!InetinfoStartService+0x2bd 07 00efffec 00000000 ADVAPI32!AccessCheckByTypeResultListAndAuditAlarmByHandleW+0x2f Thread ID: 9 System Thread ID: c7c Kernel Time: 0:0:0.250 User Time: 0:0:0.140 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 00f3fc1c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 00f3fc6c 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 00f3fcc8 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 00f3fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d 04 00f3fd30 6b561a78 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209 05 00f3fd70 01002440 SMTPSVC!ServiceEntry+0x136 06 00f3ffa4 7c2dcf43 inetinfo!InetinfoStartService+0x2bd 07 00f3ffec 00000000 ADVAPI32!AccessCheckByTypeResultListAndAuditAlarmByHandleW+0x2f Thread ID: 10 System Thread ID: 11d4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Exchsrvr\bin\PTTRACE.DLL - Thread Type: Other # ChildEBP RetAddr 00 0d48ff20 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d48ff70 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d48ff88 62dd22ff KERNEL32!WaitForMultipleObjects+0x17 WARNING: Stack unwind information not available. Following frames may be wrong. 03 0d48ffb4 7c57b3bc PTTRACE!TermAsyncTrace+0x51b 04 0d48ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 11 System Thread ID: 1150 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d4cff24 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d4cff74 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d4cff8c 62dd189b KERNEL32!WaitForMultipleObjects+0x17 WARNING: Stack unwind information not available. Following frames may be wrong. 03 0d4cffb4 7c57b3bc PTTRACE!DebugAssert+0x4f3 04 0d4cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 12 System Thread ID: c18 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d5cfe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d5cfeac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d5cff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0d5cff24 679cbbc6 USER32!MsgWaitForMultipleObjects+0x1d 04 0d5cff7c 780085bc LisRTL!SchedulerWorkerThread+0xa7 05 0d5cffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0d5cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 13 System Thread ID: 630 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d64fe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d64feac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d64ff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0d64ff24 679cbbc6 USER32!MsgWaitForMultipleObjects+0x1d 04 0d64ff7c 780085bc LisRTL!SchedulerWorkerThread+0xa7 05 0d64ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0d64ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 14 System Thread ID: 940 Kernel Time: 0:0:0.31 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d68fe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d68feac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d68ff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0d68ff24 679cbbc6 USER32!MsgWaitForMultipleObjects+0x1d 04 0d68ff7c 780085bc LisRTL!SchedulerWorkerThread+0xa7 05 0d68ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0d68ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 15 System Thread ID: 15a0 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d6cfe5c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d6cfeac 77e1e9db KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d6cff08 77e1ea28 USER32!MsgWaitForMultipleObjectsEx+0x153 03 0d6cff24 679cbbc6 USER32!MsgWaitForMultipleObjects+0x1d 04 0d6cff7c 780085bc LisRTL!SchedulerWorkerThread+0xa7 05 0d6cffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 06 0d6cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 16 System Thread ID: 1590 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0d80ff5c 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0d80ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27 02 0d80ffb4 7c57b3bc ISATQ!I_AtqOplockThreadFunc+0x32 03 0d80ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 17 System Thread ID: 1594 Kernel Time: 0:0:0.203 User Time: 0:0:0.187 Thread Type: Other # ChildEBP RetAddr 00 0d84ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0d84ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0d84ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0d84ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 18 System Thread ID: 139c Kernel Time: 0:0:0.31 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d88ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0d88ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0d88ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0d88ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 19 System Thread ID: e68 Kernel Time: 0:0:0.109 User Time: 0:0:0.31 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0d8cff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0d8cff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0d8cffb4 7c57b3bc ISATQ!AtqPoolThread+0x40 03 0d8cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 20 System Thread ID: c5c Kernel Time: 0:0:0.171 User Time: 0:0:0.109 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0d94ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0d94ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 0d94ffb4 7c57b3bc ISATQ!AtqPoolThread+0x40 03 0d94ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 21 System Thread ID: dac Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0dacfeb8 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0dacfee4 77d818ff KERNEL32!GetQueuedCompletionStatus+0x27 02 0dacff20 77d51484 RPCRT4!COMMON_ProcessCalls+0x9e 03 0dacff74 77d512bd RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99 04 0dacff78 77d3aeed RPCRT4!ProcessIOEventsWrapper+0x9 05 0dacffa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 06 0dacffb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 07 0dacffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 22 System Thread ID: 200 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0ddcfe24 77d595d9 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0ddcff74 77d58e4a RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0ddcff78 77d3aeed RPCRT4!RecvLotsaCallsWrapper+0x9 03 0ddcffa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0ddcffb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 05 0ddcffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 23 System Thread ID: 1244 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0df9fe24 77d595d9 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0df9ff74 77d58e4a RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0df9ff78 77d3aeed RPCRT4!RecvLotsaCallsWrapper+0x9 03 0df9ffa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0df9ffb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 05 0df9ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 24 System Thread ID: 138c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e02fd20 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e02fd70 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e02fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17 03 0e02ffb4 7c57b3bc RTUTILS!TraceServerThread+0xde 04 0e02ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 25 System Thread ID: 159c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e06ff20 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e06ff70 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e06ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17 03 0e06ffb4 7c57b3bc exstrace!RegNotifyThread+0x6f 04 0e06ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 26 System Thread ID: 1160 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e0aff24 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e0aff74 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e0aff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17 03 0e0affb4 7c57b3bc exstrace!WriteTraceThread+0x2f 04 0e0affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 27 System Thread ID: 14d8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e2aff64 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0e2aff8c 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0e2aff9c 6ff2841e KERNEL32!WaitForSingleObject+0xf 03 0e2affb4 7c57b3bc FCACHDLL!CScheduleThread::ScheduleThread+0x22 04 0e2affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 28 System Thread ID: 688 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 0e3eff18 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e3eff68 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e3eff80 6b57b031 KERNEL32!WaitForMultipleObjects+0x17 03 0e3effb4 7c57b3bc SMTPSVC!TcpRegNotifyThread+0x136 04 0e3effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 29 System Thread ID: 1048 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 0e42ff68 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0e42ff90 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0e42ffa0 6b57ae65 KERNEL32!WaitForSingleObject+0xf 03 0e42ffb4 7c57b3bc SMTPSVC!FreeLibThread+0x1d 04 0e42ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 30 System Thread ID: 1454 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e4eff2c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e4eff7c 00f51e87 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e4effb0 00f51fa3 TRANMSG!CEventLogWrapper::Monitor+0x8f 03 0e4effb4 7c57b3bc TRANMSG!EvntlogMonitorThread+0x9 04 0e4effc0 00146c58 KERNEL32!BaseThreadStart+0x52 WARNING: Frame IP not in any known module. Following frames may be wrong. 05 00000000 00000000 0x146c58 Thread ID: 31 System Thread ID: 1510 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e52fce0 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 0e52fd1c 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 0e52fe08 750312f5 msafd!WSPSelect+0x24e 03 0e52fe6c 6e2b3b6e WS2_32!select+0xe7 04 0e52ffb4 7c57b3bc inetsloc!SocketListenThread+0x51 05 0e52ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 32 System Thread ID: 1578 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0e56fe24 77d595d9 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0e56ff74 77d58e4a RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0e56ff78 77d3aeed RPCRT4!RecvLotsaCallsWrapper+0x9 03 0e56ffa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0e56ffb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 05 0e56ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 33 System Thread ID: 1588 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Possible ASP page. Possible DCOM activity Executing Page: ASP.dll symbols not found. Unable to locate ASP page. Continuing with other analysis. No remote call being made # ChildEBP RetAddr 00 0e5afe24 77d595d9 ntdll!ZwReplyWaitReceivePortEx+0xb 01 0e5aff74 77d58e4a RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74 02 0e5aff78 77d3aeed RPCRT4!RecvLotsaCallsWrapper+0x9 03 0e5affa8 77d37de8 RPCRT4!BaseCachedThreadRoutine+0x4f 04 0e5affb4 7c57b3bc RPCRT4!ThreadStartRoutine+0x18 05 0e5affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 34 System Thread ID: 1058 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e5efdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 0e5efe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 0e5eff24 750312f5 msafd!WSPSelect+0x24e 03 0e5eff88 686261a8 WS2_32!select+0xe7 04 0e5effb0 686264f9 LSATQ!ATQ_BMON_SET::BmonThreadFunc+0x22 05 0e5effb4 7c57b3bc LSATQ!BmonThreadFunc+0x9 06 0e5effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 35 System Thread ID: 260 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e73ff54 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0e73ff7c 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0e73ff8c 60fae241 KERNEL32!WaitForSingleObject+0xf 03 0e73ffb4 7c57b3bc phatq!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce 04 0e73ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 36 System Thread ID: 157c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e7bfed8 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e7bff28 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e7bff40 6102a1d9 KERNEL32!WaitForMultipleObjects+0x17 03 0e7bffb0 6105e7af REAPI!CReIntf::RunPeriodicThread+0x2fd 04 0e7bffb4 7c57b3bc REAPI!PeriodicThread+0x9 05 0e7bffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 37 System Thread ID: 1488 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e7fff2c 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e7fff7c 62e50623 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e7fffb0 62e5073f DSACCESS!CEventLogWrapper::Monitor+0x8f 03 0e7fffb4 7c57b3bc DSACCESS!EvntlogMonitorThread+0x9 04 0e7fffc0 00157980 KERNEL32!BaseThreadStart+0x52 WARNING: Frame IP not in any known module. Following frames may be wrong. 05 00000000 00000000 0x157980 Thread ID: 38 System Thread ID: fb8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e83fdf8 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e83fe48 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e83fe60 62e14d17 KERNEL32!WaitForMultipleObjects+0x17 03 0e83ffb0 62e2d699 DSACCESS!CDscUtilityThread::ThreadBody+0xce 04 0e83ffb4 7c57b3bc DSACCESS!CDscUtilityThread::ThreadFunc+0x9 05 0e83ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 39 System Thread ID: 1144 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: SMTP Service Worker Thread # ChildEBP RetAddr 00 0e8cfed8 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0e8cff28 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0e8cff40 60f73170 KERNEL32!WaitForMultipleObjects+0x17 03 0e8cff9c 6b56dccd phatq!CConnMgr::GetNextConnection+0x1e1 04 0e8cffb4 7c57b3bc SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x23 05 0e8cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 40 System Thread ID: 1158 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0d98ff18 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0d98ff68 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0d98ff80 62f2304e KERNEL32!WaitForMultipleObjects+0x17 03 0d98ffb0 62f2538c EPOXY!CSharedMemoryHeap::MemSyncThread+0x31 04 0d98ffb4 7c57b3bc EPOXY!CSharedMemoryHeap::MemSyncThreadStub+0x9 05 0d98ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 41 System Thread ID: dd0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0e9bff4c 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0e9bff74 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0e9bff84 62e14af1 KERNEL32!WaitForSingleObject+0xf 03 0e9bffb4 7c57b3bc DSACCESS!DschExpiryThread+0x7b 04 0e9bffc0 0e77fb74 KERNEL32!BaseThreadStart+0x52 WARNING: Frame IP not in any known module. Following frames may be wrong. 05 00000000 00000000 0xe77fb74 Thread ID: 42 System Thread ID: edc Kernel Time: 0:0:0.0 User Time: 0:0:0.0 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Exchsrvr\bin\ifsproxy.dll - Thread Type: Other # ChildEBP RetAddr 00 0ea1ff34 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0ea1ff60 6112216b KERNEL32!GetQueuedCompletionStatus+0x27 WARNING: Stack unwind information not available. Following frames may be wrong. 02 0ea1ffb4 7c57b3bc ifsproxy!CIfsGlobals::operator=+0x9b 03 0ea1ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 43 System Thread ID: 14c0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ea5ff58 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0ea5ff84 0d8d44a4 KERNEL32!GetQueuedCompletionStatus+0x27 02 0ea5ffb4 7c57b3bc drviis!CThreadPool::ThreadDispatcher+0x35 03 0ea5ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 44 System Thread ID: 132c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ea9ff58 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0ea9ff84 0d8d44a4 KERNEL32!GetQueuedCompletionStatus+0x27 02 0ea9ffb4 7c57b3bc drviis!CThreadPool::ThreadDispatcher+0x35 03 0ea9ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 45 System Thread ID: 1474 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0eadff58 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0eadff84 0d8d44a4 KERNEL32!GetQueuedCompletionStatus+0x27 02 0eadffb4 7c57b3bc drviis!CThreadPool::ThreadDispatcher+0x35 03 0eadffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 46 System Thread ID: c84 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0eb1ff58 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0eb1ff84 0d8d44a4 KERNEL32!GetQueuedCompletionStatus+0x27 02 0eb1ffb4 7c57b3bc drviis!CThreadPool::ThreadDispatcher+0x35 03 0eb1ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 47 System Thread ID: 14a0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0eb5ff80 74fd6363 ntdll!NtRemoveIoCompletion+0xb 01 0eb5ffb4 7c57b3bc msafd!SockAsyncThread+0x52 02 0eb5ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 48 System Thread ID: 9ec Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0eccd240 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0eccd268 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0eccd278 62e14780 KERNEL32!WaitForSingleObject+0xf 03 0eccff7c 780085bc DSACCESS!CDSContext::ListPollThread+0x11f 04 0eccffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 05 0eccffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 49 System Thread ID: 14f4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ed0ff54 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0ed0ff7c 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0ed0ff8c 61071fc2 KERNEL32!WaitForSingleObject+0xf 03 0ed0ffb0 61072151 REAPI!CCategorizerLdapConfig::ListChangeNotify+0x1a 04 0ed0ffb4 7c57b3bc REAPI!ListChangeNotify+0x9 05 0ed0ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 50 System Thread ID: 38c Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ed4ff10 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0ed4ff60 61023113 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0ed4ff98 6102a0de REAPI!CLsaClient::AttachedBlock+0x98 03 0ed4ffb0 61050dcf REAPI!CLsaClient::Communicate+0xd0 04 0ed4ffb4 7c57b3bc REAPI!ThreadRoutingNode+0x22 05 0ed4ffc0 77fb7e64 KERNEL32!BaseThreadStart+0x52 06 0e77fc50 00000000 ntdll!_except_handler3 Thread ID: 51 System Thread ID: 1190 Kernel Time: 0:0:0.46 User Time: 0:0:0.46 Thread Type: Other # ChildEBP RetAddr 00 0ed8ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0ed8ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0ed8ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0ed8ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 52 System Thread ID: 144c Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0edcfef8 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0edcff48 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0edcff60 10006c1a KERNEL32!WaitForMultipleObjects+0x17 03 0edcffb0 10017dc9 resvc!CDsMaster::Monitor+0x183 04 0edcffb4 7c57b3bc resvc!ThreadRoutingNode+0x15 05 0edcffc0 00eb0808 KERNEL32!BaseThreadStart+0x52 WARNING: Frame IP not in any known module. Following frames may be wrong. 06 77fcb7c2 39e901b0 0xeb0808 07 0774c084 00000000 0x39e901b0 Thread ID: 53 System Thread ID: 12c8 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ee0ff04 7c59a301 ntdll!ZwDelayExecution+0xb 01 0ee0ff24 7c59a2cc KERNEL32!SleepEx+0x32 02 0ee0ff30 62df2561 KERNEL32!Sleep+0xb 03 0ee0ff60 62df235e DSACCESS!CLdapConnection::WaitForResult+0x114 04 0ee0ff8c 62e154d4 DSACCESS!CLdapConnection::HrWaitAndParseResult+0x40 05 0ee0ffb4 7c57b3bc DSACCESS!LdapCompletionThread+0x1af 06 0ee0ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 54 System Thread ID: 2bc Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0ee4febc 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0ee4ff0c 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0ee4ff24 62f28fa0 KERNEL32!WaitForMultipleObjects+0x17 03 0ee4ff70 0d8dd181 EPOXY!CEpoxyQ::HrBind+0x1fe 04 0ee4ff9c 0d8d8b38 drviis!CEpoxyClient::HrBindQueue+0x35 05 0ee4ffb4 7c57b3bc drviis!CExchangeStoreDriver::EpoxyRetryThreadRoutine+0x6c 06 0ee4ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 55 System Thread ID: 143c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 0eeefdfc 74fd1394 ntdll!ZwWaitForSingleObject+0xb 01 0eeefe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8 02 0eeeff24 750312f5 msafd!WSPSelect+0x24e 03 0eeeff88 6d7075bd WS2_32!select+0xe7 04 0eeeffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22 05 0eeeffb4 7c57b3bc ISATQ!BmonThreadFunc+0x9 06 0eeeffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 56 System Thread ID: 1074 Kernel Time: 0:0:0.78 User Time: 0:0:0.62 Thread Type: Other # ChildEBP RetAddr 00 0f02ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f02ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f02ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f02ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 57 System Thread ID: 130 Kernel Time: 0:0:0.31 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f06ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f06ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f06ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f06ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 58 System Thread ID: 1e0 Kernel Time: 0:0:0.15 User Time: 0:0:0.62 Thread Type: Other # ChildEBP RetAddr 00 0f0aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f0aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f0affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f0affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 59 System Thread ID: 834 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f0eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f0eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f0effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f0effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 60 System Thread ID: 1534 Kernel Time: 0:0:0.78 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f12ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f12ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f12ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f12ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 61 System Thread ID: bfc Kernel Time: 0:0:0.31 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f16ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f16ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f16ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f16ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 62 System Thread ID: 14f8 Kernel Time: 0:0:0.46 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f1aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f1aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f1affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f1affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 63 System Thread ID: 254 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f1eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f1eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f1effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f1effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 64 System Thread ID: ec4 Kernel Time: 0:0:0.46 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f22ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f22ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f22ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f22ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 65 System Thread ID: 63c Kernel Time: 0:0:0.31 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f26ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f26ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f26ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f26ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 66 System Thread ID: c58 Kernel Time: 0:0:0.359 User Time: 0:0:0.328 Thread Type: Other # ChildEBP RetAddr 00 0f2aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f2aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f2affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f2affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 67 System Thread ID: 5a8 Kernel Time: 0:0:0.109 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 0f2eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f2eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f2effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f2effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 68 System Thread ID: 1568 Kernel Time: 0:0:0.78 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f32ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f32ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f32ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f32ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 69 System Thread ID: 7d8 Kernel Time: 0:0:0.93 User Time: 0:0:0.78 Thread Type: Other # ChildEBP RetAddr 00 0f36ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f36ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f36ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f36ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 70 System Thread ID: 14d4 Kernel Time: 0:0:0.15 User Time: 0:0:0.78 Thread Type: Other # ChildEBP RetAddr 00 0f3aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f3aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f3affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f3affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 71 System Thread ID: a54 Kernel Time: 0:0:0.62 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f3eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f3eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f3effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f3effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 72 System Thread ID: 113c Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f42ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f42ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f42ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f42ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 73 System Thread ID: 1328 Kernel Time: 0:0:0.312 User Time: 0:0:0.234 Thread Type: Other # ChildEBP RetAddr 00 0f46ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f46ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f46ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f46ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 74 System Thread ID: 1560 Kernel Time: 0:0:0.109 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f4aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f4aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f4affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f4affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 75 System Thread ID: ca0 Kernel Time: 0:0:0.46 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f4eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f4eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f4effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f4effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 76 System Thread ID: 155c Kernel Time: 0:0:0.343 User Time: 0:0:0.390 Thread Type: Other # ChildEBP RetAddr 00 0f52ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f52ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f52ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f52ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 77 System Thread ID: 1564 Kernel Time: 0:0:0.468 User Time: 0:0:0.203 Thread Type: Other # ChildEBP RetAddr 00 0f56ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f56ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f56ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f56ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 78 System Thread ID: 1548 Kernel Time: 0:0:0.62 User Time: 0:0:0.46 Thread Type: Other # ChildEBP RetAddr 00 0f5aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f5aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f5affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f5affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 79 System Thread ID: 14bc Kernel Time: 0:0:0.31 User Time: 0:0:0.62 Thread Type: Other # ChildEBP RetAddr 00 0f5eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f5eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f5effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f5effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 80 System Thread ID: 1140 Kernel Time: 0:0:0.78 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f62ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f62ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f62ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f62ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 81 System Thread ID: 14e4 Kernel Time: 0:0:0.46 User Time: 0:0:0.46 Thread Type: Other # ChildEBP RetAddr 00 0f66ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f66ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f66ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f66ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 82 System Thread ID: 1518 Kernel Time: 0:0:0.31 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 0f6aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f6aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f6affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f6affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 83 System Thread ID: 13a0 Kernel Time: 0:0:0.31 User Time: 0:0:0.109 Thread Type: Other # ChildEBP RetAddr 00 0f6eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f6eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f6effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f6effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 84 System Thread ID: 61c Kernel Time: 0:0:0.46 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 0f72ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f72ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f72ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f72ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 85 System Thread ID: c68 Kernel Time: 0:0:0.171 User Time: 0:0:0.46 Thread Type: Other # ChildEBP RetAddr 00 0f76ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f76ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f76ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f76ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 86 System Thread ID: dd4 Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 0f7aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f7aff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f7affb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f7affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 87 System Thread ID: 1364 Kernel Time: 0:0:0.140 User Time: 0:0:0.171 Thread Type: Other # ChildEBP RetAddr 00 0f7eff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f7eff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f7effb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f7effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 88 System Thread ID: 1580 Kernel Time: 0:0:0.31 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 0f82ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f82ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f82ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f82ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 89 System Thread ID: 15a4 Kernel Time: 0:0:0.31 User Time: 0:0:0.109 Thread Type: Other # ChildEBP RetAddr 00 0f86ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0f86ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0f86ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0f86ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 90 System Thread ID: c44 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 *** WARNING: Unable to verify checksum for *** ERROR: Symbol file could not be found. Defaulted to export symbols for - Thread Type: Other # ChildEBP RetAddr 00 0f8afe68 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0f8afe90 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0f8afea0 0efa51d5 KERNEL32!WaitForSingleObject+0xf WARNING: Stack unwind information not available. Following frames may be wrong. 03 0f8aff7c 78008454 RPCSys!PipeServer::Initialize+0x2bb 04 0f8affb4 7c57b3bc MSVCRT!_endthread+0xc6 05 0f8affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 91 System Thread ID: 708 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f8efe94 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0f8efee4 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0f8efefc 0efa2fcc KERNEL32!WaitForMultipleObjects+0x17 WARNING: Stack unwind information not available. Following frames may be wrong. 03 0f8eff20 0efa52ae RPCSys!McRPCStream::Write+0x2ae 04 0f8eff38 0efa5381 RPCSys!PipeServer::Initialize+0x394 05 0f8eff7c 78008454 RPCSys!PipeServer::ThreadProc_Pool+0x85 06 0f8effb4 7c57b3bc MSVCRT!_endthread+0xc6 07 0f8effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 92 System Thread ID: 14a4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f92fe94 7c59a26d ntdll!ZwWaitForMultipleObjects+0xb 01 0f92fee4 7c59a180 KERNEL32!WaitForMultipleObjectsEx+0xea 02 0f92fefc 0efa2fcc KERNEL32!WaitForMultipleObjects+0x17 WARNING: Stack unwind information not available. Following frames may be wrong. 03 0f92ff20 0efa52ae RPCSys!McRPCStream::Write+0x2ae 04 0f92ff38 0efa5381 RPCSys!PipeServer::Initialize+0x394 05 0f92ff7c 78008454 RPCSys!PipeServer::ThreadProc_Pool+0x85 06 0f92ffb4 7c57b3bc MSVCRT!_endthread+0xc6 07 0f92ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 93 System Thread ID: 1440 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 *** WARNING: Unable to verify checksum for *** ERROR: Symbol file could not be found. Defaulted to export symbols for - Thread Type: Other # ChildEBP RetAddr 00 0f96ff00 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0f96ff28 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0f96ff38 0ef21478 KERNEL32!WaitForSingleObject+0xf WARNING: Stack unwind information not available. Following frames may be wrong. 03 0f96ff7c 780085bc TransportScan+0x1478 04 0f96ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 05 0f96ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 94 System Thread ID: 15a8 Kernel Time: 0:0:0.375 User Time: 0:0:0.234 Thread Type: Other # ChildEBP RetAddr 00 0fc6ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0fc6ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0fc6ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0fc6ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 95 System Thread ID: c48 Kernel Time: 0:0:0.515 User Time: 0:0:0.484 Thread Type: Other # ChildEBP RetAddr 00 0fe3ff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0fe3ff7c 68628940 KERNEL32!GetQueuedCompletionStatus+0x27 02 0fe3ffb4 7c57b3bc LSATQ!AtqPoolThread+0x40 03 0fe3ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 96 System Thread ID: 6a4 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f9ad240 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0f9ad268 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0f9ad278 62e14780 KERNEL32!WaitForSingleObject+0xf 03 0f9aff7c 780085bc DSACCESS!CDSContext::ListPollThread+0x11f 04 0f9affb4 7c57b3bc MSVCRT!_endthreadex+0xc1 05 0f9affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 97 System Thread ID: 1294 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0f9eff54 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0f9eff7c 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0f9eff8c 0fdabdf2 KERNEL32!WaitForSingleObject+0xf 03 0f9effb0 0fdabf81 phatcat!CCategorizerLdapConfig::ListChangeNotify+0x1a 04 0f9effb4 7c57b3bc phatcat!ListChangeNotify+0x9 05 0f9effec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 98 System Thread ID: 1118 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0fa2d240 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0fa2d268 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0fa2d278 62e14780 KERNEL32!WaitForSingleObject+0xf 03 0fa2ff7c 780085bc DSACCESS!CDSContext::ListPollThread+0x11f 04 0fa2ffb4 7c57b3bc MSVCRT!_endthreadex+0xc1 05 0fa2ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 99 System Thread ID: 1470 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0fe7ff54 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 0fe7ff7c 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 0fe7ff8c 0fdabdf2 KERNEL32!WaitForSingleObject+0xf 03 0fe7ffb0 0fdabf81 phatcat!CCategorizerLdapConfig::ListChangeNotify+0x1a 04 0fe7ffb4 7c57b3bc phatcat!ListChangeNotify+0x9 05 0fe7ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 100 System Thread ID: 2c8 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 0febebe0 77fa0ff5 ntdll!ZwWaitForMultipleObjects+0xb 01 0febffb4 7c57b3bc ntdll!RtlpWaitThread+0x1b9 02 0febffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 101 System Thread ID: 105c Kernel Time: 0:0:0.0 User Time: 0:0:0.0 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\PROGRA~1\Exchsrvr\bin\emconvev.dll - Thread Type: Other # ChildEBP RetAddr 00 0ffdff54 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 0ffdff80 0fedd903 KERNEL32!GetQueuedCompletionStatus+0x27 WARNING: Stack unwind information not available. Following frames may be wrong. 02 0ff20238 755c3a79 emconvev!DllUnregisterServer+0x4317 03 0ff20238 755c3a79 0x755c3a79 04 004c4c41 fe000000 0x755c3a79 05 00000200 00000000 0xfe000000 Thread ID: 102 System Thread ID: bec Kernel Time: 0:0:0.0 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 1008ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1008ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1008ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1008ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1008ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 103 System Thread ID: 144 Kernel Time: 0:0:0.0 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 100cff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 100cff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 100cff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 100cffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 100cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 104 System Thread ID: e14 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1014ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1014ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1014ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1014ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1014ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 105 System Thread ID: 5e0 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1018ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1018ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1018ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1018ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1018ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 106 System Thread ID: 1224 Kernel Time: 0:0:0.15 User Time: 0:0:0.15 Thread Type: Other # ChildEBP RetAddr 00 101cff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 101cff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 101cff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 101cffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 101cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 107 System Thread ID: e70 Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1021ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1021ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1021ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1021ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1021ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 108 System Thread ID: 1248 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1027ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1027ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1027ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1027ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1027ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 109 System Thread ID: 93c Kernel Time: 0:0:0.15 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 102cff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 102cff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 102cff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 102cffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 102cffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 110 System Thread ID: 1084 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1031ff50 7c59a0a2 ntdll!ZwWaitForSingleObject+0xb 01 1031ff78 7c57b40f KERNEL32!WaitForSingleObjectEx+0x71 02 1031ff88 60f7321b KERNEL32!WaitForSingleObject+0xf 03 1031ffb4 7c57b3bc phatq!LdapCompletionThread+0x53 04 1031ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 111 System Thread ID: 1064 Kernel Time: 0:0:0.15 User Time: 0:0:0.31 Thread Type: Other # ChildEBP RetAddr 00 1035ff04 7c59a301 ntdll!ZwDelayExecution+0xb 01 1035ff24 7c59a2cc KERNEL32!SleepEx+0x32 02 1035ff30 62df2561 KERNEL32!Sleep+0xb 03 1035ff60 62df235e DSACCESS!CLdapConnection::WaitForResult+0x114 04 1035ff8c 62e154d4 DSACCESS!CLdapConnection::HrWaitAndParseResult+0x40 05 1035ffb4 7c57b3bc DSACCESS!LdapCompletionThread+0x1af 06 1035ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 112 System Thread ID: dbc Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 103fff04 7c59a301 ntdll!ZwDelayExecution+0xb 01 103fff24 7c59a2cc KERNEL32!SleepEx+0x32 02 103fff30 62df2561 KERNEL32!Sleep+0xb 03 103fff60 62df235e DSACCESS!CLdapConnection::WaitForResult+0x114 04 103fff8c 62e154d4 DSACCESS!CLdapConnection::HrWaitAndParseResult+0x40 05 103fffb4 7c57b3bc DSACCESS!LdapCompletionThread+0x1af 06 103fffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 113 System Thread ID: 1490 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: Other # ChildEBP RetAddr 00 1063ff04 7c59a301 ntdll!ZwDelayExecution+0xb 01 1063ff24 7c59a2cc KERNEL32!SleepEx+0x32 02 1063ff30 62df2561 KERNEL32!Sleep+0xb 03 1063ff60 62df235e DSACCESS!CLdapConnection::WaitForResult+0x114 04 1063ff8c 62e154d4 DSACCESS!CLdapConnection::HrWaitAndParseResult+0x40 05 1063ffb4 7c57b3bc DSACCESS!LdapCompletionThread+0x1af 06 1063ffec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 114 System Thread ID: 184 Kernel Time: 0:0:0.15 User Time: 0:0:0.15 Thread Type: HTTP Listener # ChildEBP RetAddr 00 106aff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 106aff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 106affb4 7c57b3bc ISATQ!AtqPoolThread+0x40 03 106affec 00000000 KERNEL32!BaseThreadStart+0x52 Thread ID: 115 System Thread ID: 730 Kernel Time: 0:0:0.0 User Time: 0:0:0.0 Thread Type: HTTP Listener # ChildEBP RetAddr 00 106fff50 7c585463 ntdll!NtRemoveIoCompletion+0xb 01 106fff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27 02 106fffb4 7c57b3bc ISATQ!AtqPoolThread+0x40 03 106fffec 00000000 KERNEL32!BaseThreadStart+0x52 ***** Dump name is formatted as: PID-Timestamp.dmp Creating C:\iisstate\output\2252-1208766213.dmp - mini user dump ***** Closing open log file C:\iisstate\output\IISState-2252.log Any help much appreciated. Jason.
