Are you running IIS 6.0 in IIS 5.0 Isolation Mode? Or IIS 6.0 Worker Process Mode?
I don't think ISATQ.dll is corrupt, but more likely you have a component inside inetinfo.exe (e.g. ISAPI filter) that is not correctly coded for multithreaded access. ISATQ manages thread pools, and it seems to be prematurely unloading, causing an access violation inside inetinfo.exe. If you are running in IIS 5.0 Isolation mode, you could have COM .dlls loaded in there as well (if you are running a "low isolation" website). Typically these are VB components that do not have the "unattended execution" and "retain in memory" flags set. Cheers Ken From: Thomas Gonzalez [mailto:tgonza...@girlscouts-swtx.org] Sent: Tuesday, 16 December 2008 6:41 AM To: NT System Admin Issues Subject: IIS crashing So lately I have been seeing the inet process crashing and when I extract the cabs with the dump and run the crash dump under windbg ver 6.9 I see the following and from I make out of this, the ISATQ.dll is either corrupt or I don't know what I'm seeing. Anyone seen this issue or can make out the problem? Microsoft (R) Windows Debugger Version 6.9.0003.113 X86 Copyright (c) Microsoft Corporation. All rights reserved. Extracted C:\DOCUME~1\thomas\LOCALS~1\Temp\1\000015c00_inetinfo.exe.mdmp from C:\Documents and Settings\thomas\Desktop\12-2-08_crash\exchange_dmp\20474AB5.cab Loading Dump File [C:\DOCUME~1\thomas\LOCALS~1\Temp\1\000015c00_inetinfo.exe.mdmp] User Mini Dump File: Only registers, stack and portions of memory are available Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Server 2003 Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible Product: Server, suite: TerminalServer SingleUserTS Debug session time: Wed Dec 10 15:14:05.000 2008 (GMT-6) System Uptime: not available Process Uptime: 6 days 6:24:13.000 ................................................................................................................................................................................................ Loading unloaded module list ................ This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (300.108c): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=078aed94 ecx=00000327 edx=7c82ed54 esi=078aed98 edi=bd7dd000 eip=7c82ed54 esp=078aed48 ebp=078aedf0 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 7c82ed54 c3 ret 0:093> .ecxr eax=00000000 ebx=77e6b4af ecx=7779006c edx=00000001 esi=00e2bb90 edi=00000000 eip=63ec8952 esp=078afe48 ebp=078afe6c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 <Unloaded_ISATQ.dll>+0x8952: 63ec8952 ?? ??? TIA, Thomas Gonzalez Technology Manager Girl Scouts of Southwest Texas 210.349.2404 phone 210.403.1586 DID 210.349.2666 fax www.girlscouts-swtx.org<http://www.girlscouts-swtx.org/> tgonza...@girlscouts-swtx.org<mailto:tgonza...@girlscouts-swtx.org> Girl Scouts of Southwest Texas offices will be closed for the winter holiday beginning Monday, December 22 and will reopen on Monday, January 5, 2009. Thank you for your understanding. Wishing you and yours a wonderful holiday season. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
