Forum posts for ntkrnlpa.exe

Windows service and continuous memory alloc

I have a windows service that launches a Thread. The service starts with SYSTEM ACCOUNT.

Inside the thread I use CoInitialize, because I have a XML object managed by an COM Object.

In some windows (7, 2008 std, not all) my service becomes to allocate memory continuous without any reason (12mb -> 50mb -> 100mb -> 500mb....) .

If I change the logon user of the service to a administrator user the problem stops. I cannot understand what is happening!

Using the Process Explorer (Microsoft sysinternals), I was able to see that some threads are freezed at WaitForMultipleObjects due a call of DecodePointer (kernel).

Here is the stack:

Start address: ntdll.dll!RtlDecodePointer+0x32a

ntkrnlpa.exe!KeWaitForMultipleObjects+0xab7
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!PsGetCurrentThreadTeb+0x377
ntkrnlpa.exe!KiCheckForKernelApcDelivery+0x24
ntkrnlpa.exe!IofCallDriver+0x64
ntkrnlpa.exe!NtQueryInformationProcess+0x1c63
ntkrnlpa.exe!NtQueryDirectoryFile+0x5b
ntkrnlpa.exe!ZwQueryLicenseValue+0xbc6
ntkrnlpa.exe!ZwQueryDirectoryFile+0x11
fltmgr.sys!FltGetVolumeName+0xd9
fltmgr.sys!FltCheckAndGrowNameControl+0x36a
fltmgr.sys!FltGetTunneledName+0xb81
fltmgr.sys!FltGetDestinationFileNameInformation+0x245
fltmgr.sys!FltReleaseFileNameInformation+0x871
fltmgr.sys!FltIsDirectory+0x58b
fltmgr.sys!FltGetFileNameInformation+0x120
fltmgr.sys!FltRequestOperationStatusCallback+0x635
fltmgr.sys!FltGetIrpName+0x80c
fltmgr.sys!FltGetIrpName+0xd42
fltmgr.sys!FltGetIrpName+0x13b3
fltmgr.sys!FltDeletePushLock+0x1db7
ntkrnlpa.exe!IofCallDriver+0x64
ntkrnlpa.exe!RtlUpcaseUnicodeChar+0x17e7
ntkrnlpa.exe!ObReferenceObjectByHandle+0x976
ntkrnlpa.exe!ObOpenObjectByName+0x13c
ntkrnlpa.exe!RtlUpcaseUnicodeChar+0x6c9
ntkrnlpa.exe!NtCreateFile+0x34
ntkrnlpa.exe!ZwQueryLicenseValue+0xbc6
ntdll.dll!KiFastSystemCallRet
shell32.dll!SHLoadInProc+0x7f3de
shell32.dll!SHLoadInProc+0x7f42c
shell32.dll!SHLoadInProc+0x7f7b5
shell32.dll!SHLoadInProc+0x7f8a5
shell32.dll!SHLoadInProc+0x37487
ntdll.dll!TpSetWait+0x149
ntdll.dll!RtlDecodePointer+0x32a
kernel32.dll!BaseThreadInitThunk+0x12
ntdll.dll!RtlInitializeExceptionChain+0x63
ntdll.dll!RtlInitializeExceptionChain+0x36

View complete forum thread with replies

Other posts related to ntkrnlpa.exe

See Related Forum Messages: Follow the Links Below to View Complete Thread

NTOSKRNL.EXE vs NTKRNLMP.EXE vs NTKRNLPA.EXE vs NTKRPAMP.EXE [closed]
Windows service and continuous memory alloc
Strange results while trying to inject a dll into a process via windll.kernel32.CreateRemote…
Unusual high cpu utilization in ntkrnlpa:FsRtlAreNamesEqual and ntkrnlpa:RtlUpcaseUnicodeString
IE hanging with 100% CPU / Got stack trace
WinDbg lmv command not working
Windbg “Processes and Threads” window doesn't change context when kernel debugging
VB.Net 2008 IDE hanging - MSVB7.dll eating 100% CPU when editing code
.NET AppDomain.Unload triggers runaway threads
VB.NET Program Locks Up with Internet Explorer Opened