i have this windbg instance which i cant seem to kill or attach to
and it is ticking away in kernel time
any ideas to find out what it is doing or analyze it apart from
rebooting and getting rid of it ?
lkd> !PROCESS 85ce1da0
PROCESS 85ce1da0 SessionId: 0 Cid: 0f28 Peb: 7ffd6000 ParentCid: 0c58
DirBase: 0fb80420 ObjectTable: e1708650 HandleCount: 0.
Image: windbg.exe
VadRoot 85b59590 Vads 37 Clone 0 Private 92. Modified 0. Locked 0.
DeviceMap e26514d8
Token e1d7ea60
ElapsedTime 01:19:29.187
UserTime 00:00:00.015
KernelTime 00:00:00.031
QuotaPoolUsage[PagedPool] 50268
QuotaPoolUsage[NonPagedPool] 1480
Working Set Sizes (now,min,max) (324, 50, 345) (1296KB, 200KB, 1380KB)
PeakWorkingSetSize 324
VirtualSize 23 Mb
PeakVirtualSize 23 Mb
PageFaultCount 319
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 292
DebugPort 86390278
THREAD 85b9b260 Cid 0f28.0f2c Teb: 7ffdf000 Win32Thread:
00000000 WAIT: (Executive) KernelMode Non-Alertable
a86997d4 SynchronizationEvent
Not impersonating
DeviceMap e26514d8
Owning Process 0 Image:
Attached Process 85ce1da0 Image: windbg.exe
Wait Start TickCount 547889 Ticks: 302971 (0:01:18:53.921)
Context Switch Count 108
UserTime 00:00:00.000
KernelTime 00:00:00.031
Win32 Start Address windbg!wmainCRTStartup (0x01058c77)
Start Address kernel32!BaseProcessStartThunk (0x7c810705)
Stack Init a869a000 Current a8699758 Base a869a000 Limit a8697000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr
a8699770 80500cf0 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
a869977c 804f9d72 nt!KiSwapThread+0x46 (FPO: [0,0,0])
a86997a4 80638fc4 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
a8699884 8063a099 nt!DbgkpQueueMessage+0x17c (FPO: [Non-Fpo])
a86998a8 8063a1cb nt!DbgkpSendApiMessage+0x45 (FPO: [Non-Fpo])
a8699934 804fcb42 nt!DbgkForwardException+0x8f (FPO: [Non-Fpo])
a8699cf4 8053e0a1 nt!KiDispatchException+0x1f4 (FPO: [Non-Fpo])
a8699d5c 8053e7b1 nt!CommonDispatchException+0x4d (FPO: [0,20,0])
a8699d5c 7c90120f nt!KiTrap03+0xad (FPO: [0,0] TrapFrame @ a8699d64)
0007fb1c 7c940442 ntdll!DbgBreakPoint+0x1 (FPO: [0,0,0])
0007fc94 7c9210af ntdll!LdrpInitializeProcess+0xffa (FPO: [Non-Fpo])
0007fd1c 7c90e457 ntdll!_LdrpInitialize+0x183 (FPO: [Non-Fpo])
00000000 00000000 ntdll!KiUserApcDispatcher+0x7
lkd> !PROCESS 85ce1da0
PROCESS 85ce1da0 SessionId: 0 Cid: 0f28 Peb: 7ffd6000 ParentCid: 0c58
DirBase: 0fb80420 ObjectTable: e1708650 HandleCount: 0.
Image: windbg.exe
VadRoot 85b59590 Vads 37 Clone 0 Private 92. Modified 0. Locked 0.
DeviceMap e26514d8
Token e1d7ea60
ElapsedTime 01:19:30.593
UserTime 00:00:00.015
KernelTime 00:00:00.031
QuotaPoolUsage[PagedPool] 50268
QuotaPoolUsage[NonPagedPool] 1480
Working Set Sizes (now,min,max) (324, 50, 345) (1296KB, 200KB, 1380KB)
PeakWorkingSetSize 324
VirtualSize 23 Mb
PeakVirtualSize 23 Mb
PageFaultCount 319
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 292
DebugPort 86390278
THREAD 85b9b260 Cid 0f28.0f2c Teb: 7ffdf000 Win32Thread:
00000000 WAIT: (Executive) KernelMode Non-Alertable
a86997d4 SynchronizationEvent
Not impersonating
DeviceMap e26514d8
Owning Process 0 Image:
Attached Process 85ce1da0 Image: windbg.exe
Wait Start TickCount 547889 Ticks: 303061 (0:01:18:55.328)
Context Switch Count 108
UserTime 00:00:00.000
KernelTime 00:00:00.031
Win32 Start Address windbg!wmainCRTStartup (0x01058c77)
Start Address kernel32!BaseProcessStartThunk (0x7c810705)
Stack Init a869a000 Current a8699758 Base a869a000 Limit a8697000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr
a8699770 80500cf0 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
a869977c 804f9d72 nt!KiSwapThread+0x46 (FPO: [0,0,0])
a86997a4 80638fc4 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
a8699884 8063a099 nt!DbgkpQueueMessage+0x17c (FPO: [Non-Fpo])
a86998a8 8063a1cb nt!DbgkpSendApiMessage+0x45 (FPO: [Non-Fpo])
a8699934 804fcb42 nt!DbgkForwardException+0x8f (FPO: [Non-Fpo])
a8699cf4 8053e0a1 nt!KiDispatchException+0x1f4 (FPO: [Non-Fpo])
a8699d5c 8053e7b1 nt!CommonDispatchException+0x4d (FPO: [0,20,0])
a8699d5c 7c90120f nt!KiTrap03+0xad (FPO: [0,0] TrapFrame @ a8699d64)
0007fb1c 7c940442 ntdll!DbgBreakPoint+0x1 (FPO: [0,0,0])
0007fc94 7c9210af ntdll!LdrpInitializeProcess+0xffa (FPO: [Non-Fpo])
0007fd1c 7c90e457 ntdll!_LdrpInitialize+0x183 (FPO: [Non-Fpo])
00000000 00000000 ntdll!KiUserApcDispatcher+0x7