Unkillable process, returns "Access Denied"

Question

Hello,

I'm having an issue on Windows 8 with some processes, so far it concerns Skype and Battlefield 3. These process sometimes freeze and go into a state where I cannot kill them at all. Taskkill /F doesn't work, not even in an admin shell, not even as LOCAL_SERVICE or SYSTEM, even in kernel mode with process hacker, the only way I've found to get rid of them was rebooting. Every taskkill returns "Access Denied" and Process Hacker returns "An attempt was made to access an exiting process".

For Skype it happens randomly when it's running. I had no problem with it a month ago but then it started doing it, it stops receiving messages and I can't restart it because I can't kill it. The first times it could happen after running for hours but it became more and more frequent, now it freeze as soon as I start it so I can't use it at all.

For Battlefield 3 it happens whenever I stop the game. The game freezes and goes into that state so I have to reboot if I want to play again, which is very annoying.

I tried to reinstall both, it sometimes fixed the bug for a day or two but it was coming back after.

Given that the termination fails in kernel mode I suppose it's a bug of the OS. Is there any known fix ?

Thank you

Answer 1

The issue, as far as I have discovered, is when the ICS service is running (Internet connection sharing)

Spotify also had this same problem back when Windows 8 was released, but after some month with complaints and testing on the Spotify forums they finally fixed it (It was the community that actullay found out that the problem was ICS, Spotify was just saying "It's a problem with Windows 8", though Windows 7 also had it, though not that often)

I do not have that problem with Skype anymore, and also it was quite rare.

But most of the times when I exited BF3, it freezes an gives me "Access denied" when I try to kill the process (Have also tried with Process Explorer and Process Hacker 2)

This only happens when I have ICS on.

I have my desktop connected with wire and then sharing the connection over WiFi (I am only alloved to use on IP so I must do it this way).

Answer 2

Hello,

I set the Driver Verifier to check all my installed drivers (Create standard settings -> Automatically select all drivers installed on this computer). Also I thought it was the bluetooth driver and that removing it fixed the issue because Skype was working, but I discovered it was merely a coincidence (sometimes Skype works sometimes not). So I've run the verifier again and found that my network card's driver (a USB wireless adapter - Netgear WNA3100) was faulty too, which makes much more sense for Skype and BF3 than the bluetooth driver.

So for now I am still having the issue, I found how to start Skype correctly (basically, I'm using a VPN and I have to start Skype before it connects) and am planning to change my wifi adapter.

Answer 3

I finally found a solution on a forum, which was to use the Driver Verifier to find the faulty driver. Turns out the issue was from a file named bthav.sys which I identified as a driver for my BlueTooth dongle. So I unplugged the dongle and that fixed Skype. I haven't tried with BF3 though.

Answer 4

I especially like this part:

 

"I would like to inform you that there are few programs or applications which are not compatible with Windows 8. You need to install them in Compatibility mode with previous version of Windows. As per mow we do not have enough information about the compatibility of Battlefield 3 with Windows 8."

Doesn't Skype belong to Microsoft? Hehe. Skype was flawless until Microsoft bought it. I remember how I was pissed off few years ago when Visual Studio shell for my Fortran compiler stopped working due to compatibility issues with new Microsoft operating system.

Anyway, Pranav Mishra's advice is as useful as the ones given by Tamim (or something like this) on Skype's forum and look like pulled out from Windows help - basically useless. It's not single case that Skype and other programs don't work. Almost everyone complains about compatibility with Windows 8 and each update to Skype is getting worse. Jeremine and other users ask only for the way how to kill this stubborn process!!! Nothing else.  No one expects you to fix Skype, Battlefield, or Windows compatibility issues since this is not gonna happen. It's 2 months now and nothing was fixed but if one can kill the process it would be something.

BTW, I was asked by the president if we need to switch to Windows 8 on corporation's computers. I told him to switch to everything but Windows LOL.

Answer 5

Hello,

Update on the subject : I've found this article http://blogs.technet.com/b/markrussinovich/archive/2005/08/17/unkillable-processes.aspx that seemed to describe my problem. So I followed the instructions, I rebooted with debug activated and inspected the IRPs in a kernel debugger. I couldn't test Skype because, when debug is activated, starting it will freeze my entire computer and I don't have another machine to do remote debugging. I've found this for BF3:

"Irp is active with 4 stacks 4 is current (= 0xfffffa8014b369e8)

No Mdl: No System Buffer: Thread fffffa801bea5080:  Irp stack trace.

cmd  flg cl Device   File     Completion-Context

[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[  0, 0]   0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

>[ 12, 0]   0  0 fffffa8015311630 fffffa801b99ff20 00000000-00000000

\Driver\AFD

Args: 00000000 00000000 00000000 00000000"

So the system seem to be from the AFD driver ? I've inspected the thread call stack in Process Hacker and it's in there too

"0, ntoskrnl.exe!SeAccessCheck+0x1ef

1, ntoskrnl.exe!KeDelayExecutionThread+0xc32

2, ntoskrnl.exe!KeWaitForSingleObject+0x1cf

3, afd.sys+0x44b50

4, afd.sys+0x44284

5, ntoskrnl.exe!NtDeviceIoControlFile+0x1b6

6, ntoskrnl.exe!ObCreateObject+0xd9a

7, ntoskrnl.exe!NtClose+0x206

8, ntoskrnl.exe!KeSaveStateForHibernate+0x2a33

9, ntdll.dll!NtClose+0xa

10, wow64.dll!Wow64EmulateAtlThunk+0x2639

11, wow64.dll!Wow64SystemServiceEx+0xd7

12, wow64cpu.dll!TurboDispatchJumpAddressEnd+0xb

13, wow64.dll!Wow64SystemServiceEx+0x26a

14, wow64.dll!Wow64LdrpInitialize+0x435

15, ntdll.dll!RtlWow64CallFunction64+0x3b

16, ntdll.dll!LdrInitializeThunk+0xe

17, ntdll.dll!ZwClose+0xc

18, mswsock.dll!Tcpip6_WSHGetSockaddrType+0x840

19, ws2_32.dll!closesocket+0xd5

20, bf3.exe+0xad5855"

Does that help in any way ?