Problem killing errant Dolphin exe

Hello all,

I purged gremlins (described below) from a second win2k box in a week, and
I'm getting concerned.  The first time I saw it was last week during some
testing of code that has yet to go into production use.  At one point, I
managed to all but lock up a win2k machine, but I figured it was simply due
to the changes I had made.

A differerent machine did the same thing today, and with presumably stable
code.  My D5.1 rollout was on 4 Aug 2003, with some small revisions on 8 Sep
2003.  The timing of the latter is unfortunate, because I'm about to
question whether the September security updates from MS have resurrected
what turns out to be an old bug.  I'll have to dig through my change log,
but it seems very unlikely that the system in question suffered change that
would lead to an OS-level problem.  Even if it had, why the problem with
killing an errant process?  I've never had that problem before.

Ok, so what's the problem?  A program appears to hang (some messages below
indicate that it probably in fact crashed), and an attempt to close it using
the task list leads to the following:

>This program cannot be closed. If it is being debugged,
> please resume it or close the debugger first. [Ok]
>
>If I click the "Processes" tab, select the process,
> and then click "End Task" I get
>this error:
>
>The operation could not be completed. Access denied. [Ok]

Below are references to very long reboot time; I see that as well.  The only
way I've found to kill the process is to reboot the machine, though
alternatives are mentioned below.  I've seen some reports of this kind of
problem going back as far as 2001!

Blair, the top entry below lists some things about OS processes (values of
fdwCreate) and the error message.  Is there anything new to D5.1 that might
have caused it to be vulnerable where 5.0 was not?  I doubt it, but it never
hurts to rule out possibilities.  I fear that this is in fact a change that
came with the one of the recent security updates, causing a long-standing
problem to resurface or be more likley to occur.

Anybody else seen this?  It's not good when the cash cow stops giving milk
:(

Have a good one,

Bill


===================================
re: Cannot End Task with task manager.
Thursday, October 17, 2002 at 1:19 am
Windows 2000 Annoyances Discussion Forum
Posted by Dominic Benedict   [find other messages by Dominic Benedict]


Sometimes, when the Internet Explorer or any other application encounters an
error,
the following error pops up and the application hangs. You cannot even end
the task.

    'This program cannot be closed. If it is being debugged, please resume
it or
close the debugger first.'

The  CreateProcess Windows API function is used to run a new program. It
creates
a new process and its primary thread. The new process executes the specified
executable
file.

BOOL CreateProcess(
  LPCWSTR lpszImageName,
  LPCWSTR lpszCmdLine,
  LPSECURITY_ATTRIBUTES lpsaProcess,
  LPSECURITY_ATTRIBUTES lpsaThread,
  BOOL fInheritHandles,
  DWORD fdwCreate,
  LPVOID lpvEnvironment,
  LPWSTR lpszCurDir,
  LPSTARTUPINFOW lpsiStartInfo,
  LPPROCESS_INFORMATION lppiProcInfo
);
The fdwCreate has different values.

Value Description
CREATE_DEFAULT_ERROR_MODE Not supported.
CREATE_NEW_CONSOLE The new process has a new console, instead of inheriting
the parent's
console. This flag cannot be used with the DETACHED_PROCESS flag.
CREATE_NEW_PROCESS_GROUP Not supported.
CREATE_SEPARATE_WOW_VDM Not supported.
CREATE_SHARED_WOW_VDM Not supported.
CREATE_SUSPENDED The primary thread of the new process is created in a
suspended
state, and does not run until the ResumeThread function is called.
CREATE_UNICODE_ENVIRONMENT Not supported.
DEBUG_PROCESS If this flag is set, the calling process is treated as a
debugger,
and the new process is a process being debugged. Child processes of the new
process
are also debugged. The system notifies the debugger of all debug events that
occur
in the process being debugged.
If you create a process with this flag set, only the calling thread (the
thread that
called CreateProcess) can call the WaitForDebugEvent function.

DEBUG_ONLY_THIS_PROCESS If this flag is set, the calling process is treated
as a
debugger, and the new process is a process being debugged. No child
processes of
the new process are debugged. The system notifies the debugger of all debug
events
that occur in the process being debugged.
DETACHED_PROCESS Not supported.

If the program is executed with fdwCreate as DEBUG_PROCESS or
DEBUG_ONLY_THIS_PROCESS,
then if the program comes up with an error it assumes that it has a debugger
associated
with it.

Regards,
Dominic





On Monday, July 29, 2002 at 7:29 am, Charles wrote:
>Occasonally an application crashes, and Task Manager won't let me kill it.
If, under
>the "Applications" tab, I select the application and click "End Task", I
get the
>following error:
>
>This program cannot be closed. If it is being debugged, please resume it or
close
>the debugger first. [Ok]
>
>If I click the "Processes" tab, select the process, and then click "End
Task" I
get
>this error:
>
>The operation could not be completed. Access denied. [Ok]
>
>The application is not being debugged, it just crashed. I am running Win2k,
and
have
>full admin rights. I want to be able to end whatever task I wish. I never
want to
>see Access Denied to anything. Is there any way to do this?
>
>Thanks.
>
>Charles.



===================================
On Monday, July 29, 2002 at 7:29 am, Charles wrote:
>Occasonally an application crashes, and Task Manager won't let me kill it.
If, under
>the "Applications" tab, I select the application and click "End Task", I
get the
>following error:
>


>This program cannot be closed. If it is being debugged, please resume it or
close
>the debugger first. [Ok]
>


>If I click the "Processes" tab, select the process, and then click "End
Task" I get
>this error:
>


>The operation could not be completed. Access denied. [Ok]
>


>The application is not being debugged, it just crashed. I am running Win2k,
and have
>full admin rights. I want to be able to end whatever task I wish. I never
want to
>see Access Denied to anything. Is there any way to do this?




===================================
From: darkstar830  (Original Message) Sent: 1/27/2003 3:11 PM
Just a quick question here.  I am not the user, just trying to support this
product.  Autocad R14 is

installed on a machine with the following specs:

P4 2.2 gig cpu
512 ram
windows 2000 sp2

The program freezes and gets the following error message when you try to
close from task menu:

program cannot be closed if it is being debugged.  Please resume program or
close debugger.

The person cannot close the program, but if they let it sit for a while,
they can shut the program down

without having to restart the system.  Any information out there?

==========================================
Hi Scott,

I have a very similar configuration on one of my PC's, but I have never
had that problem. However, this means nothing, really.

Do you use IE from within IMatch? For example, by running scripts from
the "Web" category?

Can you remember if you have started IE before or after you started
IMatch when the problem occurred?

Have you installed IE 5.5 before or after the RC 1 of IMatch?


IE tends to lock under several conditions, even if IMatch is not running
;-)
Accessing specific web pages, interrupting a download by pressing
"Stop", entering a new URL in the edit control and pressing <Enter>
while a page is being loaded, etc.

Usually, a re-install of IE or running the last service pack for IE 5.5
cleans the installation and everything works fine again.

Any other user with the same effects?

-- Mario



----- Original Message -----
From: "heinphoto" <sjhein@d...>
To: <[hidden email]>
Sent: Samstag, 2. Februar 2002 20:02
Subject: [imatchuserforum] Weird Interaction with IE 5.5?





Hello
Unfortunately, I do not have a solution for you, but I am having the same
sorts of problems with my

Precision 340 (Windows2000). I have been looking around and it seems that
this is a fairly common

problem. I have this "debugger" issue at least once every other day, and I
experience it with just about

every program I run (Word, Excel, IE, Netscape, ProE, SolidWorks, etc). It
is a very frustrating problem

for me because the only way I can shutdown the program is to pull the power
plug out of the back of the

computer. Once my computer has started "debugging" the program, I cannot
exit the program or reboot

until the debugger is finished, which is never. I have tried the advice
given in the Start Menu's Help

section on editing the registry to basically 'disable' debugging, but this
did not work. Every fix I've

seen in these forum messages concerning debugger problems appear to deal
with Internet Explorer and

disabling the debugger within the advanced internet settings. I never went
in and modified these

settings but when I read that this may be the culprit I went and checked the
settings concerning the

debugger. Guess what? My settings already were the recommended "Disable
script....." and do not "Display

a notification...." I'm not sure what the problem is, but I do know that the
above "fixes" do not work

for me. If you find anything out, please post it. I would greatly appreciate
it. If I figure anything

out I will do the same.
thanks


==========================================
I'm just another user of Dell's Precision 340s (we just bought 4 of them)
who is having the exact

problem that is described by these two messages. We are using Windows 2000
on all of them and Office XP

Pro. I'll reiterate that it happens at least every day (an average of 3
times a day if using heavily),

on each workstation and it happens with just about any application. With our
machines, it happens (in

any application) when we are browsing to a file and use the down arrow to
obtain the subdirectory/file

listings. If we abstain from using the down arrow, and use the "up one
level" icon, the problem doesn't

seem to happen. I also disabled the debugger in the registry, but this
didn't help. I'll also add that

most of the software that causes the problem was pre-installed on the
workstation when purchased. The

only application that causes the problem, but wasn't pre-installed seems to
be Autodesk's Land

Development Desktop v2i. Please Moderator, HELP!!!! We're wasting valuable
time with this problem!



==========================================
I have 8 Precision 340's (win 2k pro) and am having this problem on only one
of them. It's also hangs

occasionally on boot, right after the "dell" screen but right before the
black & white "Starting

Windows" screen.

It's the only one of the 340's that came with the free upgrade to CD-RW (the
device is listed as LITE-ON

LTR-24102M in device manager.

Also, I reinstalled the OS and the problem didn't occur until after I had
upgraded to W2K SP2.




==========================================
I have been receiving this error message also when trying to close a hung
application. (Word 2000)
"This program cannot be closed. If it is being debugged, please resume it or
close the debugger first."
I used to think that I had a debugger running that was somehow stopping the
abort process.
But I searched for and renamed mdm.exe, which is the IE script debugger, and
it had no effect on
my problem. I think the real intent of this message is to prevent a B.S.O.D.
(I have Windows 2000)

Anyways, the way to solve your real problem is to stop the hangs. I believe
I have solved mine at this

time.

(It is really solved when it passes the test of time!)

Start finding your problem by going to Control Panel / Administrative Tools
/ Event Viewer.

There are two places to look for errors: System Log and Application Log.

Application log will show you error messages from processes running. Some
error messages may be
caused by the computer hang rather that the original problem. Notice the
timing sequences to determine

this.

System log will show you in particular what happens while you are booting
up, as well as what your

system is doing all the time in the background while you are working on it.
I found two problems in

System log with my Win2k. First, in the background, my PC was trying, every
minute, to contact a

non-existant server. This was caused be Remote Control Software that was
tested on my PC by MIS techs

two months ago (I am in MIS).

I removed that software. Next, during the boot process, I was getting
network client error messages. I

had the latest Novell netware client for Win2k version 4.81 but I had 2
settings that needed adjustment.

Screen print any error messages you get and show them to the appropriatte
people, like network messages
to network techs and Ofiice 97/2000/2002 messages to your Office guru.

The network settings appeared to have solved my problem.


==========================================
Nightmare on Elm Street with Win2k Professional
From: Gregory Alan Bolcer ([hidden email])
Date: Thu Mar 29 2001 - 16:20:00 PST

Next message: Gordon Mohr: "Re: AOL aid in an open source IM project"
Previous message: Chuck Murcko: "Re: 1 meter diagonal LCD displays by 2003
for approx US $3000"
Next in thread: Joseph S Barrera III: "Re: Nightmare on Elm Street with
Win2k Professional"
Reply: Joseph S Barrera III: "Re: Nightmare on Elm Street with Win2k
Professional"
Maybe reply: Josh Cohen: "RE: Nightmare on Elm Street with Win2k
Professional"
Maybe reply: Justin Mason: "Re: Nightmare on Elm Street with Win2k
Professional"
Reply: Tom WSMF: "Re: Nightmare on Elm Street with Win2k Professional"
Maybe reply: Karl Anderson: "Re: Nightmare on Elm Street with Win2k
Professional"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------------
----


Gee, it hasn't been a while since I've done a backup. I have
a lot of important stuff on my Win box, I should back it up
and put it on a CD. Let's see, MSbackup.


Comes up without setting the last file configuration
but appears is going to write a new backup over the old
backup file. Use Jobs-->Load and load the old job.


Disk thrash, Thrash, trashing.....thrashing....THRASH


What the hell?


"Your system is low on virtual memory. Windows is increasing the
size of your virtual memory paging file. During this process, memory
requests for some applications may be denied."


WTF? Task Manager.....


"The Program cannot be closed. If it is being debugged, please
resume it or close the Debugger first. [OK]"


"" ""


"" ""


"" ""


Screw it all, I'll just shut down.



"Saving personal settings..."


Okay,


Any day now.


Still waiting...


4 more minutes of disk thrashing then shut down using front
power button.


"Something about removable disk manager refuses the sleep or shutdown
request."


I wonder if I should pull the plug in the back of the machine, but
am starting to think that even if I did, the machine would keep
disk thrashing--sort of like that scene in Nightmare on Elm Street
where she pulls the phone from the wall.


Gawd, I hope my files are okay.....



--
Gregory Alan Bolcer        | [hidden email]    | work: 949.833.2800
Chief Technology Officer   | http://www.endtech.com | cell: 714.928.5476
Endeavors Technology, Inc. | efax: 603.994.0516     | wap:  949.278.2805


==========================================
re: Cannot End Task with task manager.
Sunday, September 14, 2003 at 10:21 am
Windows 2000 Annoyances Discussion Forum
Posted by Sabrina Veksler   [find other messages by Sabrina Veksler]

Woudl you please send me that app as well? I can't take having to
cold-restart my computer anymore...

I'd be really grateful if this helps. By the way, will this work in tandem
with Windows 2000 SP3 or

would you recommend removing SP3 anyway until Microsoft addresses the
problem? Thank you so much!

-Sabrina


On Tuesday, February 18, 2003 at 6:49 am, dakos wrote:
>What you need is to run the task manager with debug privileges, and this
gives it
>unbelivable powers.
>
>You need to read an article by Jeffrey Richter that explains how the whole
thing
>works, or I can just mail you guys the little program.
>
>Once you have the program, you just run it by c:\>AccessEnable.exe
taskmgr.exe
>This gives the task manager all the power you need.
==========================================

--
Wilhelm K. Schwab, Ph.D.
[hidden email]

"Bill Schwab" <[hidden email]> wrote in message
news:bls0t7$ff9bh$[hidden email]...
>...A program appears to hang (some messages below
> indicate that it probably in fact crashed), and an attempt to close it
using might
> have caused it to be vulnerable where 5.0 was not?

Neither Dolphin's VM nor image call the CreateProcess API, so a Dolphin
process would just inherit whatever settings are used by the application
that starts that process (normally the OS shell, i.e. explorer.exe).

I'd imagine you might also see this if Dr Watson or some other post-crash
analysis tool had hooked up to a crashed process (check the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
registry key entry), but I can't think of any other reason you'd experience
that short of running the Dolphin exe under a debugger.

I usually find the Platform SDK kill utility (or is it NT resource kit?) to
be more effective than the task manager at killing stubborn processes. Other
than that logging off is usually sufficient, rather than a complete reboot,
assuming that the process is running as the logged on user.

Regards

Blair

Blair,

> Neither Dolphin's VM nor image call the CreateProcess API, so a Dolphin
> process would just inherit whatever settings are used by the application
> that starts that process (normally the OS shell, i.e. explorer.exe).

That's what I suspected, but thanks for confirming it.


> I'd imagine you might also see this if Dr Watson or some other post-crash
> analysis tool had hooked up to a crashed process (check the
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
> registry key entry), but I can't think of any other reason you'd
experience
> that short of running the Dolphin exe under a debugger.

Dr. Watson it is.


> I usually find the Platform SDK kill utility (or is it NT resource kit?)
to
> be more effective than the task manager at killing stubborn processes.
Other
> than that logging off is usually sufficient, rather than a complete
reboot,
> assuming that the process is running as the logged on user.

Are you referring to the remote kill utility?  For good or bad, it's not
running for me.  The SysInternals process explorer got a couple of plugs,
and I've had good luck with it, though I've never used it for killing
processes.

BTW, we had a confirmed and repaired network wiring problem, so that _might_
have been the cause.  It definitely caused a problem that occured later, but
I'm not quite ready to blame the lockup on it.  For that to be the case, it
would have had to go bad, miraculously fix itself (or otherwise be
corrected) and then break again.  We've had folks crawling around doing some
wiring, so I suppose it's possible.

Thanks!

Bill

--
Wilhelm K. Schwab, Ph.D.
[hidden email]

"Bill Schwab" <[hidden email]> wrote in message
news:bm4fmu$ijh0c$[hidden email]...
> ...
> Are you referring to the remote kill utility?  For good or bad, it's not
> running for me.  The SysInternals process explorer got a couple of plugs,
> and I've had good luck with it, though I've never used it for killing
> processes.
>...

No, I'm referring to the resource kit kill.exe utility
(http://support.microsoft.com/support/kb/articles/q171/7/73.asp ).  Old Unix
hacks will be comfortable with kill, except for the need to remember to
substitute /f instead of -9 :-). I don't know if it is available for free
download, but I don't doubt that sysinternals.com has an excellent
substitute.

Regards

Blair

Blair,

> I'd imagine you might also see this if Dr Watson or some other post-crash
> analysis tool had hooked up to a crashed process (check the
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
> registry key entry), but I can't think of any other reason you'd
experience
> that short of running the Dolphin exe under a debugger.

Dumb question: could a crash dump in progress be mistaken for one?

I think I have at least identified which external device is causing the
problem to show itself, and I have an idea or two about what it might be.
However, nothing so far explains why the process could not be killed ~:0

Have a good one,

Bill

--
Wilhelm K. Schwab, Ph.D.
[hidden email]

"Bill Schwab" <[hidden email]> wrote in message
news:bmmju4$o5pdc$[hidden email]...
>
> > I'd imagine you might also see this if Dr Watson or some other
post-crash
> > analysis tool had hooked up to a crashed process (check the
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
> > registry key entry), but I can't think of any other reason you'd
> experience
> > that short of running the Dolphin exe under a debugger.
>
> Dumb question: could a crash dump in progress be mistaken for one?

No, I don't think so. The process is not being "debugged" as far as Windows
is concerned, but rather is executing an exception handler.

Regards

Blair