Processes won't terminate

TheCrimsonStar

Tech Monkey
I've been having this issue for a while now...it's really starting to irritate me because the only option I have is to restart. Sometimes when I exit an application, the .exe for said application will still be running in the task manager hogging up my RAM. No CPU usage, just RAM. So far I've seen it happen with uTorrent, Call of Duty Black Ops, Battlefield 3 Beta, Firefox, and a couple others. When I try to end the process, it either says "Access is denied" or it just doesn't do anything. I started to think it was my motherboard...not sure. Could it have anything to do with my RAM not being fully Sandy Bridge compatible? I haven't had issues with the RAM though..I have it set to 1600MHz in the UEFI and haven't had boot issues. Any ideas? I've already tried pskill.exe through the command prompt. It either says "Access is denied" or "Process *process name* terminated" but it's still there. :confused:
 

marfig

No ROM battery
It's one of your drivers.

When a user space application can't be killed by sending it a kill signal, this is so because one of its execution threads is on waiting mode on a kernel mode driver. This caused by a bug in the driver itself in which one or more IO requests aren't being handled correctly.

When the kill signal is sent to a process, the kernel executes a process rundown that includes terminating all its threads. When there's any thread with pending IO requests, the kernel informs the driver holding those threads that the request should be cancelled (ntkrnlpa.exe executes the IopCancelAlertedRequest function). But if the driver is buggy or doesn't have code for canceling the request, the kernel can't do anything and must wait for the thread to be closed (ntkrnlpa.exe executes the KeWaitForSingleObject function). And this is where the process remains forever in the process list. The kernel will never kill the driver itself, because other processes could be using that driver and that would lead to a serious risk of system instability. So it will alternate between calls to IopCancelAlertedRequest and KeWaitForSingleObject everytime you try to kill the process.

The solution to this problem is identifying what driver is causing your processes to not properly close. For that you need to use a kernel debugger and inspect the pending call stack of any process experimenting this issue.

However, you can also try fully uninstalling certain types of applications that install device drivers on your system and are likely candidates (and the usual suspects). Being that your processes are so disparate, the most likely candidate is your anti-virus or security suite. With that out of the way, if the problem persists and you can't think of any other application you installed recently that installs drivers that could be being used by these processes, then this may be a corrupt windows driver you got from windows update or a corrupt (or buggy) video card driver. Uninstalling what you can and testing afterwards for a few hours is one way to deal with this problem until you identify the cause. But not very pleasant.

Otherwise we can have a sit together in the upcoming days, and I'll do my best to walk you through the use of windows debugging tools in order to identify your faulty driver.
 
Last edited:

TheCrimsonStar

Tech Monkey
I talked with Mario on the IRC chat and that's exactly what he told me. Turns out, it was my anti-spyware program, PCTools Spyware Doctor. I uninstalled it and haven't had that issue since.
 

marfig

No ROM battery
I talked with Mario on the IRC chat and that's exactly what he told me. Turns out, it was my anti-spyware program, PCTools Spyware Doctor. I uninstalled it and haven't had that issue since.

Never talk with that guy again! He's dangerous! :eek:
 

TheCrimsonStar

Tech Monkey
lol. I put Malwarebytes Anti-Malware and MSE in its place. Working with no issues now.

P.S. Yes, I know Mario is you :p
 
Last edited:
Top