Stuck in reboot loop

[cluberti]

In looking at the dump, there are two possibilities for this:

// Here's the stack, showing what appears to be Winlogon.exe attempting to display text -
// note there's a module that was injected when the Semaphore lock was requested:
kd> kn
 # ChildEBP RetAddr  
00 f3e1fba8 80465a81 nt!KiDispatchException+0x30e
01 f3e1fc10 8046606b nt!CommonDispatchException+0x4d
02 f3e1fc10 804145da nt!KiTrap03+0x97
03 f3e1fc88 f3e1fce8 nt!ExTryToAcquireResourceExclusiveLite
WARNING: Frame IP not in any known module. Following frames may be wrong.
04 f3e1fc8c a00b14bd 0xf3e1fce8
05 f3e1fc98 a00be963 win32k!GreAcquireSemaphore+0x19
06 f3e1fc9c a000c650 win32k!DEVLOCKOBJ::vLock+0x20
07 f3e1fce8 a0020aba win32k!DC::bSetDefaultRegion+0x4c
08 f3e1fd10 a001b529 win32k!GreCreateDisplayDC+0x135
09 f3e1fd28 a001e12d win32k!GreCreateCompatibleDC+0x24
0a f3e1fd30 bffa0f8f win32k!NtGdiCreateCompatibleDC+0x9
0b f3e1fe14 77e5a17d safemon+0x2f8f
0c 00000000 00000000 USER32!DrawTextExWorker+0x344

In looking at the raw stack, what you see on the stack where the function is missing is a Win32K HANDLELOCK::vLockHandle call, a User32 StaticWndProcWorker call (meaning there's a hook on the WndProc this is using, so someone is going to inject themselves), and then vpc_s3 injects itself. Afterwards there's a callback to Win32K, which is supposed to use the handle it acquired in the GreAcquireSemaphore call to actually call the ExTryToAcquireResourceExclusiveLite. However, it appears the handle is NULL, thus causing the problem.

Like I said, this has two potential culprits - either vpc_s3.sys, or safemon.sys, although I suspect the Connectix VirtualPC driver (vpc-s3.sys) more than I suspect the System Security Monitor driver (especially considering vpc-s3.sys is the Virtual PC virtual video driver miniport), but nothing would surprise me with the System Security Monitor suite either. It's your choice how you want to proceed - one of these two (or both) are causing the problem, so you're going to have to decide which to keep, which to update, etc:

kd> lmvm vpc_s3
start    end        module name
f3c90000 f3c9f220   vpc_s3     (deferred)             
    Image path: \SystemRoot\System32\DRIVERS\vpc-s3.sys
    Image name: vpc-s3.sys
    Timestamp:        Thu May 16 14:00:20 2002 (3CE3F3B4)
    CheckSum:         0001A38A
    ImageSize:        0000F220
    File version:     4.0.2.1
    Product version:  4.0.2.1
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Connectix Corporation
    ProductName:      Connectix Virtual PC
    InternalName:     vpc-s3.sys
    OriginalFilename: vpc-s3.sys
    ProductVersion:   4.02
    FileVersion:      4.02
    FileDescription:  Virtual PC S3 Miniport Driver
    LegalCopyright:   Copyright (C) Connectix Corporation 1999-2001
kd> lmvm safemon
start    end        module name
bff9e000 bffc0200   safemon    (no symbols)           
    Loaded symbol image file: safemon.sys
    Image path: safemon.sys
    Image name: safemon.sys
    Timestamp:        Fri Oct 27 10:52:01 2006 (45421D11)
    CheckSum:         00029436
    ImageSize:        00022200
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I would suggest upgrading to Virtual PC 2004 SP1 anyway, for what it's worth. Connectix 4.x versions were buggy, as was the original VPC 2004 release, but SP1 and 2007 were rock-solid.

[herbalist]

Thank you very much! I'm glad you know how to read those things. To me, that looks like a foreign language. SSM was not the problem. The VPC file is the culprit. It's part of VPC additions that give more integration, more screen resolution options, etc. After uninstalling VPC additions in safe mode, both UR1 and unofficial service pack 5 installed fine. VPC additions are an "all or nothing" arrangement, all contained in an ISO that's captured as a CD. I might be able to extract the ISO and use some or most of the features it adds.

I'm using VPC 5.1. Upgrading is not really an option as the host PC is 98SE. I don't know if a newer version of VPC would work with KernelEX or not. I wholly expect that any possible 9X compatibility was eliminated as soon as MS got it. Except for the rare VNETBIOS errors I get from VPC, this is the first issue I've had with this version. I haven't decided if I going to install Virtual software on the XP system of this PC. If I do, it'll probably be Virtualbox. If I've heard correctly VPC doesn't work well with non-MS guest systems.

Thanks again.