Hi, below is the output from a full memory dump of w3wp.exe that i took with debug diag. any help on this would be great!
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\banasr.PAXIX\Desktop\New Folder\w3wp.exe__DefaultAppPool__PID__3684__Date__06_22_2010__Time_12_52_33PM__398__IIS_COM+ Hang Dump.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: 'Dump created by Debug Diagnostic Service. IIS_COM+ Hang Dump'
WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symfiles*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Machine Name:
Debug session time: Tue Jun 22 12:52:34.000 2010 (GMT-4)
System Uptime: 11 days 14:24:24.453
Process Uptime: 0 days 16:52:54.000
................................................................
.............................
Loading unloaded module list
................
eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c82860c c3 ret
0:000> !analyze -v
*******************************************************************************
*
*
* Exception Analysis
*
*
*
*******************************************************************************
*** ERROR: Module load completed but symbols could not be loaded for xpsp2res.dll
*** ERROR: Module load completed but symbols could not be loaded for ws03res.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for normaliz.dll -
*** ERROR: Module load completed but symbols could not be loaded for odbcint.dll
*** ERROR: Module load completed but symbols could not be loaded for msadcer.dll
*** WARNING: Unable to verify checksum for FdfAcX.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for FdfAcX.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for LeakTrack.dll -
*** WARNING: Unable to verify checksum for fms2ksec.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for fms2ksec.dll -
*** WARNING: Unable to verify checksum for FdfTk.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for FdfTk.dll -
*** ERROR: Module load completed but symbols could not be loaded for iisres.dll
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols ***
***
***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
***
***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo ***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols ***
***
***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
***
***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo ***
***
***
*************************************************************************
FAULTING_IP:
+5839952f029ddf04
00000000 ?? ???
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0
FAULTING_THREAD: 00000c84
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 7c827d29 to 7c82860c
STACK_TEXT:
0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet
0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac
0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12
0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d
0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd
0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e
0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a
0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f
0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23
STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP:
w3dt!WP_CONTEXT::RunMainThreadLoop+10
5a364692 837e1400 cmp dword ptr [esi+14h],0
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: w3dt!WP_CONTEXT::RunMainThreadLoop+10
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: w3dt
IMAGE_NAME: w3dt.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4b7cd0b4
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_w3dt.dll!WP_CONTEXT::RunMainThreadLoop
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_w3dt!WP_CONTEXT::RunMainThreadLoop+10
WATSON_IBUCKET: 395708677
WATSON_IBUCKETTABLE: 1
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOne/w3wp_exe/6_0_3790_3959/45d6968e/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1
Followup: MachineOwner
---------
0:000> lmvm w3dt
start end module name
5a360000 5a36d000 w3dt (pdb symbols) c:\symfiles\w3dt.pdb\52E7B28CDEDE40238CCDA18714A02BA12\w3dt.pdb
Loaded symbol image file: w3dt.dll
Image path: c:\WINDOWS\system32\inetsrv\w3dt.dll
Image name: w3dt.dll
Timestamp: Thu Feb 18 00:31:32 2010 (4B7CD0B4)
CheckSum: 00010411
ImageSize: 0000D000
File version: 6.0.3790.4667
Product version: 6.0.3790.4667
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Information Services
InternalName: w3dt.dll
OriginalFilename: w3dt.dll
ProductVersion: 6.0.3790.4667
FileVersion: 6.0.3790.4667 (srv03_sp2_gdr.100217-1800)
FileDescription: IIS Worker Process/Http.sys Interface
LegalCopyright: © Microsoft Corporation. All rights reserved.
0:000> !clrstack
No export clrstack found
0:000> kvn100
# ChildEBP RetAddr Args to Child
00 0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc (FPO: [3,0,0])
02 0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac (FPO: [SEH])
03 0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12 (FPO: [2,0,0])
04 0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10 (FPO: [0,0,0])
05 0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d (FPO: [0,0,0])
06 0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd (FPO: [0,0,0])
07 0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e (FPO: [3,144,4])
08 0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a (FPO: [2,6,4])
09 0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f (FPO: [SEH])
0a 0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23 (FPO: [SEH])
0:000> ~0s;
eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c82860c c3 ret
0:000> .ecxr
Minidump doesn't have an exception context
Unable to get exception context, HRESULT 0x80004002
0:000> ; kb
ChildEBP RetAddr Args to Child
0006fc08 7c827d29 77e61d1e 00000194 00000000 ntdll!KiFastSystemCallRet
0006fc0c 77e61d1e 00000194 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
0006fc7c 77e61c8d 00000194 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xac
0006fc90 5a364692 00000194 ffffffff 00000000 kernel32!WaitForSingleObject+0x12
0006fca0 5a366f27 00295270 5a3af3dd 00000000 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
0006fca8 5a3af3dd 00000000 64711dcf 00000000 w3dt!UlAtqStartListen+0x2d
0006fcb8 5a3bc315 01001418 010013e4 010012d0 w3core!W3_SERVER::StartListen+0xbd
0006ff0c 0100187c 00000007 00293ba8 00000000 w3core!UlW3Start+0x26e
0006ff44 01001a27 00000007 00293ba8 00294670 w3wp!wmain+0x22a
0006ffc0 77e6f23b 00000000 00000000 7ffdf000 w3wp!wmainCRTStartup+0x12f
0006fff0 00000000 010018f8 00000000 78746341 kernel32!BaseProcessStart+0x23
0:000> !dumpstack -EE
No export dumpstack found
0:000> r
eax=7c88b668 ebx=00000000 ecx=00000000 edx=7c88b080 esi=00000194 edi=00000000
eip=7c82860c esp=0006fc0c ebp=0006fc7c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c82860c c3 ret
0:000> !address eip
7c800000 : 7c801000 - 00088000
Type 01000000 MEM_IMAGE
Protect 00000020 PAGE_EXECUTE_READ
State 00001000 MEM_COMMIT
Usage RegionUsageImage
FullPath C:\WINDOWS\system32\ntdll.dll
0:000> ub eip
ntdll!KiRaiseUserExceptionDispatcher+0x37:
7c8285f3 8b0424 mov eax,dword ptr [esp]
7c8285f6 8be5 mov esp,ebp
7c8285f8 5d pop ebp
7c8285f9 c3 ret
7c8285fa 8da42400000000 lea esp,[esp]
7c828601 8da42400000000 lea esp,[esp]
ntdll!KiFastSystemCall:
7c828608 8bd4 mov edx,esp
7c82860a 0f34 sysenter
