Disk thrashing in catroot while running Chrome

Please post your problem description here

Moderator: Barb@Invincea

Post Reply
cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Disk thrashing in catroot while running Chrome

Post by cornflake » Fri Apr 14, 2017 9:49 pm

I have noticed rarely my laptop running Windows 8.1 and Sandboxie and Chrome will sometimes have large disk thrashing so constant it slows the computer to be unusable. I've checked in performance monitor and I can see it is a ton of files with the name catroot in the path that are being read when Chrome is running in a Sandboxie sandbox. Why all those files need to be read I don't know. I found two reports about this but they are old:

2015: http://forums.sandboxie.com/phpBB3/view ... 17&t=21660
2012: http://forums.sandboxie.com/phpBB3/view ... 11&t=13706

I may have also reported this before and forgot about it, and I can't find it via search. This happened to me in prior years then went away. Are there other reports of this and why is there so much disk activity in catroot? Is it a bug? It happened this afternoon when I had just one site open, dominos.com.

Barb@Invincea
Sandboxie Support
Sandboxie Support
Posts: 2337
Joined: Mon Nov 07, 2016 3:10 pm

Re: Disk thrashing in catroot while running Chrome

Post by Barb@Invincea » Mon Apr 17, 2017 4:04 pm

Hi cornflake,

Did this occur after having been browsing for a while, or you had just opened Chrome and that site?
Any Antivirus installed?
Are you running Chrome 64 or 32 bits?
Is your OS 32 or 64 bits?

Any additional information you can provide might be useful.

Regards,
Barb.-

cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Re: Disk thrashing in catroot while running Chrome

Post by cornflake » Mon Apr 17, 2017 9:21 pm

Sorry, I forgot that information. I'm using Sandboxie 5.17.1 in Windows 8.1 x64. No antivirus other than Windows Defender. I had just opened Chrome 57.0.2987.133 64-bit and I was going to order a pizza, so I went to dominos.com and there is an option pickup or delivery and I chose pickup and then the disk started thrashing (normally at this point it would also show me locations to pick up from). I opened Firefox and was able to complete an order. During this time Chrome was frozen. I left the computer on and when I came back Chrome was working again, and also I reloaded dominos.com and did the same thing just to see what would happen and it worked fine.

Barb@Invincea
Sandboxie Support
Sandboxie Support
Posts: 2337
Joined: Mon Nov 07, 2016 3:10 pm

Re: Disk thrashing in catroot while running Chrome

Post by Barb@Invincea » Tue Apr 18, 2017 10:48 am

Hello cornflake,

There were changes in beta 5.17.4 that involved fixing a memory leak (not necessarily related to Chrome, but it might be related to your issue).
Can you please give the latest beta [http://forums.sandboxie.com/phpBB3/view ... 88#p125732], or the latest Stable version (5.18) a try?

Regards,
Barb.-

cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Re: Disk thrashing in catroot while running Chrome

Post by cornflake » Tue Apr 18, 2017 4:59 pm

Sure, I am going to update to 5.18. Note this issue happens rarely so I don't expect to encounter it for a long time.

cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Re: Disk thrashing in catroot while running Chrome

Post by cornflake » Sat Apr 22, 2017 12:14 am

Barb I updated that computer to Sandboxie 5.18 and Chrome 58.0.3029.81 64-bit. Now I have another weird problem which may be related. Whenever I close chrome the processes linger in the sandbox for exactly one minute. During that time I can see lsass.exe eating CPU. I cannot reproduce it in any other sandbox on that machine, just the one that had the catroot issue. I also tried some other computers, Windows 8 and Windows 10 with the same setup and I cannot reproduce there.

Barb@Invincea
Sandboxie Support
Sandboxie Support
Posts: 2337
Joined: Mon Nov 07, 2016 3:10 pm

Re: Disk thrashing in catroot while running Chrome

Post by Barb@Invincea » Mon Apr 24, 2017 1:06 pm

Hello cornflake,

If you can repro the issue, it will be great if you provide a PML log so that the devs can review it:
https://technet.microsoft.com/en-us/sys ... nitor.aspx
Launch procmon, reproduce the issue in SBIE, stop procmon (hit the magnifying glass) .
Go to File-->Save and upload the log (you may need to use a free file hosting site as the logs tend to be big).

Regards,
Barb.-

cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Re: Disk thrashing in catroot while running Chrome

Post by cornflake » Sat Dec 09, 2017 3:15 pm

Barb@Invincea wrote:
Mon Apr 24, 2017 1:06 pm
If you can repro the issue, it will be great if you provide a PML log so that the devs can review it
Sorry I can't send that because it likely contains sensitive information. I am still seeing lsass 25% CPU usage when I start Chrome. I don't know if there's disk thrashing or not anymore since I replaced the hard drive with an SSD.

Now I am using:

Sandboxie 5.23.1
Chrome 63.0.3239.84 (Official Build) (64-bit)
OS Name: Microsoft Windows 8.1 Pro
OS Version: 6.3.9600 N/A Build 9600

I did run process monitor and I see lsass repeatedly accessing the same registry entries over and over for the 1-2 min lsass eats CPU:
Clipboard01.gif
Clipboard01.gif (104.9 KiB) Viewed 575 times
and this file is accessed often: C:\Users\Username\AppData\Roaming\Microsoft\Protect\CREDHIST

then it stops.

Also there's a dberr file in sandboxed catroot that is being written to repeatedly these lines:

Code: Select all

CatalogDB: 10:09:36 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006
CatalogDB: 10:09:36 PM 12/8/2017: catdbcli.cpp at line #347 encountered error 0x00000006
CatalogDB: 10:09:36 PM 12/8/2017: catdbcli.cpp at line #592 encountered error 0x00000426
CatalogDB: 10:09:36 PM 12/8/2017: catadnew.cpp at line #1950 encountered error 0x00000426
CatalogDB: 10:09:36 PM 12/8/2017: catadnew.cpp at line #958 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006
CatalogDB: 10:09:37 PM 12/8/2017: catdbcli.cpp at line #347 encountered error 0x00000006
CatalogDB: 10:09:37 PM 12/8/2017: catdbcli.cpp at line #592 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: catadnew.cpp at line #1950 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006
I have the process monitor log so if you need more information let me know, but I can't send you the whole file it contains sensitive information.

Barb@Invincea
Sandboxie Support
Sandboxie Support
Posts: 2337
Joined: Mon Nov 07, 2016 3:10 pm

Re: Disk thrashing in catroot while running Chrome

Post by Barb@Invincea » Mon Dec 11, 2017 11:02 am

Hello cornflake,

Does Chrome behave differently if you run the same tests outside Sandboxie?
Also, you reported several issues with Chrome in another thread:
viewtopic.php?p=131433#p131433
Please follow the provided steps to try to resolve those first, then re-run your tests (inside and outside) Sandboxie. Be sure to use a new Sandbox with default settings.

Regarding the PML, without the full log the devs cannot review it. If you wish to send it privately, you can send us a link to support@sandboxie.com and we will download it from there so it is not public in the forums.

Regards,
Barb.-

cornflake
Posts: 231
Joined: Fri May 13, 2011 5:44 pm

Re: Disk thrashing in catroot while running Chrome

Post by cornflake » Mon Dec 11, 2017 10:43 pm

Barb@Invincea wrote:
Mon Dec 11, 2017 11:02 am
Does Chrome behave differently if you run the same tests outside Sandboxie?
Also, you reported several issues with Chrome in another thread:
viewtopic.php?p=131433#p131433
Please follow the provided steps to try to resolve those first, then re-run your tests (inside and outside) Sandboxie. Be sure to use a new Sandbox with default settings.
That issue in the other thread is separate. I have Sandboxie installed on many computers, all a mix of Windows 7, 8, 8.1 and 10.

I am not able to reproduce in a new profile in a new Sandbox.

In the Sandbox I notice this issue I deleted all the RegHive files and all folders except for "C:\Sandbox\Username\Chrome\user\current\AppData\Local\Google\Chrome\User Data" (this includes deleting the sandboxed windows catroot) but lsass still eats CPU for 1-2 min every time I start Chrome. I also tried killing SandboxieRpcSs/DcomLaunch/Crypto but it didn't make a difference.

Unfortunately since both the Chrome profile and the Process Monitor log contain sensitive information I cannot offer that more detailed information to the developers. I hope someone else who also has this problem will come forward with a way to reproduce. Thank you for your help.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests