The call stack showed presence of cnsminkp.sys which according to Microsoft is a file associated with spyware called VirTool:WinNT/Protmin.gen!A. According to Wikipedia cnsminkp.sys is part of Yahoo Assistant. Malware or not I needed to take it out given the state of the machine to see if it would make any difference. It did not.

After several hours of prying, it became evident that CreateWindowStation call was failing in winlogon startup. That is a pretty big call and coupled with GDI transitioning back to user mode and going back again, windbg was finding it hard to do it right as far as session breakpoints are concerned. Eventually I found that win32k!HeavyAllocPool was failing to allocate paged pool.

A !vm confirmed the issue -

********** Excessive Paged Pool Usage *****
PagedPool Usage:       40718 (    162872 Kb)
PagedPool Maximum:     40960 (    163840 Kb)
********** 71 pool allocations have failed **********

Session Commit:          266 (      1064 Kb)
Shared Commit:           388 (      1552 Kb)

After turning on pool tagging2 by setting HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\GlobalFlag to 0×400, and a reboot – it was clear who was the top pool consumer when paged pool was depleted enough to fail graphics operations.

kd> !poolused 4
   Sorting by  Paged Pool Consumed

  Pool Used:
            NonPaged            Paged
 Tag    Allocs     Used    Allocs     Used
 SavE        4      224       645 125603704
 CM31        0        0      5918 25481216

Once Symantec anti-virus pool allocations were out of the picture, the machine started booting again3. When winlogon failed to create a window station, it exited and since it is a critical process, the system bugchecked.

Tagged with →  
Share →

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop us a note so we can take care of it!


Which WDK macro to assert is better ?

Loading ... Loading ...
Set your Twitter account name in your settings to use the TwitterBar Section.