My Window system is abnormal Yesterday, I received an 164(ERROR_MAX_THRDS_REACHED) error when execute “sc query” for query a service status, Event log can’t open, but the xuetr can work, It comes to normal after reboot it.
Who can tell me what was reason?
Did you use task manager or some similar tool to investigate how many
threads were running? That’s the very first thing that should have
occurred to you. A program that is creating thousands of threads due to
an error would be my first suspect, but other than this error code you
have provided us with absolutely nothing useful that could help diagnose
the cause.
And, if there really were too many threads, OF COURSE a reboot would fix
this. Probably logging out would do the same thing. So, again, nothing
of any possible use in diagnosing the problem.
Some years ago, some nutcase wrote how he would never consider using
Windows “because you cannot create more than 64 threads”. I have no idea
how such a stupid conclusion could have been reached, except by confusing
the maximum number of thread-local (TlsAlloc) slots available, which only
showed that the OP could not read. Thirty minutes after I saw the post, I
posted the source code for a program that successfully created 10,000
threads, each of which blocked, then destroyed itself. So I know the
thread limit has to be in excess of 10,000.
HANDLE blocker; // global variable
void main()
{
blocker = ::CreateEvent(NULL, FALSE, FALSE, NULL);
…check for valid creation (omitted here)
for(int i = 0; i < 10000; i++)
{
HANDLE h = (HANDLE)_beginthreadex(…,threadfunc,…));
if(h==NULL)
{
…report error, including value of i
break;
}
::SetEvent(blocker);
}
UINT __stdcall threadfunc(PVOID)
{
::WaitForSingleObject(blocker);
return 0;
}
Note that the error may be accidental, a bug in a program, or deliberate,
a piece of malware creating a Denial Of Service (DOS) attack.
Also, you did not report that this bug recurred; it may have been a
once-only event caused by either of the above situations. As such,
diagnosing it in the total absence of useful information is impossible.
If you had provided actual information, and from that information it was
clear that the number of threads running was perfectly reasonable, then
there is interest in pursuing this further. But without useful
information, no chance at all. Note that you can start programs like task
manager, procmon, etc. just after the computer starts, so they will create
all the threads they may need and you can therefore simply consult with
them when this error recurs. If it does not recur, simply ignore this
one-and-only incident.
Of course, if it is a malware attack for DOS, it may have already taken
over enough control to report falsified information about the number of
threads, and even hide the existence of the malware process. If you
suspect malware, check with your antivirus vendor to see that you have the
latest and greatest version of the program and its databases.
joe
My Window system is abnormal Yesterday, I received an
164(ERROR_MAX_THRDS_REACHED) error when execute “sc query” for query a
service status, Event log can’t open, but the xuetr can work, It comes to
normal after reboot it.
Who can tell me what was reason?
NTDEV is sponsored by OSR
Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
OSR is HIRING!! See http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
Hi Joseph M. Newcomer
Thank you for your help,
I don’t use task manager or other tool to investigate how many threads were running? I use xuetr restore kernel hooks of the anti-virus software only.
I think it doesn’t too may threads, There are same error code after 7 or 8 processes killed, and I can running a new program such as xuetr, notepad, … .
I find the follow code in rpcerr.h
#define RPC_S_OUT_OF_THREADS ERROR_MAX_THRDS_REACHED
Maybe It is resource of the RPC depletion.
>I use xuetr restore kernel hooks of the anti-virus software only.
Dont’ use kernel hooks and you’ll be OK.
A product that uses kernel hooks in Windows Vista+ is a total piece of
garbage. My response for any failure on a system with crap like that
installed is remove the hooking software and see if you can reproduce the
problem.
Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@sina.com
Sent: Friday, January 03, 2014 8:29 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] About Win32 ErrorCode 164
Hi Joseph M. Newcomer
Thank you for your help,
I don’t use task manager or other tool to investigate how many threads were
running? I use xuetr restore kernel hooks of the anti-virus software only.
I think it doesn’t too may threads, There are same error code after 7 or 8
processes killed, and I can running a new program such as xuetr, notepad,
… .
I find the follow code in rpcerr.h
#define RPC_S_OUT_OF_THREADS ERROR_MAX_THRDS_REACHED
Maybe It is resource of the RPC depletion.
NTDEV is sponsored by OSR
Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
OSR is HIRING!! See http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
If you have kernel hooks in place, error code 164 is the least of your
problems. I would not interpret or even attempt to debug (or even care
about) any system that has kernel hooks. Such systems can be expected to
have pathological behavior.
joe
Hi Joseph M. Newcomer
Thank you for your help,I don’t use task manager or other tool to investigate how many threads
were running? I use xuetr restore kernel hooks of the anti-virus software
only.
I think it doesn’t too may threads, There are same error code after 7 or 8
processes killed, and I can running a new program such as xuetr, notepad,
… .I find the follow code in rpcerr.h
#define RPC_S_OUT_OF_THREADS ERROR_MAX_THRDS_REACHED
Maybe It is resource of the RPC depletion.
NTDEV is sponsored by OSR
Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
OSR is HIRING!! See http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer