Disk thrashing in catroot while running Chrome

[cornflake]

I have noticed rarely my laptop running Windows 8.1 and Sandboxie and Chrome will sometimes have large disk thrashing so constant it slows the computer to be unusable. I've checked in performance monitor and I can see it is a ton of files with the name catroot in the path that are being read when Chrome is running in a Sandboxie sandbox. Why all those files need to be read I don't know. I found two reports about this but they are old:

2015: http://forums.sandboxie.com/phpBB3/view ... 17&t=21660
2012: http://forums.sandboxie.com/phpBB3/view ... 11&t=13706

I may have also reported this before and forgot about it, and I can't find it via search. This happened to me in prior years then went away. Are there other reports of this and why is there so much disk activity in catroot? Is it a bug? It happened this afternoon when I had just one site open, dominos.com.

[Barb@Invincea]

Hi cornflake,

Did this occur after having been browsing for a while, or you had just opened Chrome and that site?
Any Antivirus installed?
Are you running Chrome 64 or 32 bits?
Is your OS 32 or 64 bits?

Any additional information you can provide might be useful.

Regards,
Barb.-

[cornflake]

Sorry, I forgot that information. I'm using Sandboxie 5.17.1 in Windows 8.1 x64. No antivirus other than Windows Defender. I had just opened Chrome 57.0.2987.133 64-bit and I was going to order a pizza, so I went to dominos.com and there is an option pickup or delivery and I chose pickup and then the disk started thrashing (normally at this point it would also show me locations to pick up from). I opened Firefox and was able to complete an order. During this time Chrome was frozen. I left the computer on and when I came back Chrome was working again, and also I reloaded dominos.com and did the same thing just to see what would happen and it worked fine.

[Barb@Invincea]

Hello cornflake,

There were changes in beta 5.17.4 that involved fixing a memory leak (not necessarily related to Chrome, but it might be related to your issue).
Can you please give the latest beta [http://forums.sandboxie.com/phpBB3/view ... 88#p125732], or the latest Stable version (5.18) a try?

Regards,
Barb.-

[cornflake]

Sure, I am going to update to 5.18. Note this issue happens rarely so I don't expect to encounter it for a long time.

[cornflake]

Barb I updated that computer to Sandboxie 5.18 and Chrome 58.0.3029.81 64-bit. Now I have another weird problem which may be related. Whenever I close chrome the processes linger in the sandbox for exactly one minute. During that time I can see lsass.exe eating CPU. I cannot reproduce it in any other sandbox on that machine, just the one that had the catroot issue. I also tried some other computers, Windows 8 and Windows 10 with the same setup and I cannot reproduce there.

[Barb@Invincea]

Hello cornflake,

If you can repro the issue, it will be great if you provide a PML log so that the devs can review it:
https://technet.microsoft.com/en-us/sys ... nitor.aspx
Launch procmon, reproduce the issue in SBIE, stop procmon (hit the magnifying glass) .
Go to File-->Save and upload the log (you may need to use a free file hosting site as the logs tend to be big).

Regards,
Barb.-

[cornflake]

If you can repro the issue, it will be great if you provide a PML log so that the devs can review it

Sorry I can't send that because it likely contains sensitive information. I am still seeing lsass 25% CPU usage when I start Chrome. I don't know if there's disk thrashing or not anymore since I replaced the hard drive with an SSD.

Now I am using:

Sandboxie 5.23.1
Chrome 63.0.3239.84 (Official Build) (64-bit)
OS Name: Microsoft Windows 8.1 Pro
OS Version: 6.3.9600 N/A Build 9600

I did run process monitor and I see lsass repeatedly accessing the same registry entries over and over for the 1-2 min lsass eats CPU:

Clipboard01.gif (104.9 KiB) Viewed 575 times

and this file is accessed often: C:\Users\Username\AppData\Roaming\Microsoft\Protect\CREDHIST

then it stops.

Also there's a dberr file in sandboxed catroot that is being written to repeatedly these lines:

Code: Select all

CatalogDB: 10:09:36 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006
CatalogDB: 10:09:36 PM 12/8/2017: catdbcli.cpp at line #347 encountered error 0x00000006
CatalogDB: 10:09:36 PM 12/8/2017: catdbcli.cpp at line #592 encountered error 0x00000426
CatalogDB: 10:09:36 PM 12/8/2017: catadnew.cpp at line #1950 encountered error 0x00000426
CatalogDB: 10:09:36 PM 12/8/2017: catadnew.cpp at line #958 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006
CatalogDB: 10:09:37 PM 12/8/2017: catdbcli.cpp at line #347 encountered error 0x00000006
CatalogDB: 10:09:37 PM 12/8/2017: catdbcli.cpp at line #592 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: catadnew.cpp at line #1950 encountered error 0x00000426
CatalogDB: 10:09:37 PM 12/8/2017: waitsvc.cpp at line #440 encountered error 0x00000006

I have the process monitor log so if you need more information let me know, but I can't send you the whole file it contains sensitive information.

[Barb@Invincea]

Hello cornflake,

Does Chrome behave differently if you run the same tests outside Sandboxie?
Also, you reported several issues with Chrome in another thread:
viewtopic.php?p=131433#p131433
Please follow the provided steps to try to resolve those first, then re-run your tests (inside and outside) Sandboxie. Be sure to use a new Sandbox with default settings.

Regarding the PML, without the full log the devs cannot review it. If you wish to send it privately, you can send us a link to support@sandboxie.com and we will download it from there so it is not public in the forums.

Regards,
Barb.-

[cornflake]

Does Chrome behave differently if you run the same tests outside Sandboxie?
Also, you reported several issues with Chrome in another thread:
viewtopic.php?p=131433#p131433
Please follow the provided steps to try to resolve those first, then re-run your tests (inside and outside) Sandboxie. Be sure to use a new Sandbox with default settings.

That issue in the other thread is separate. I have Sandboxie installed on many computers, all a mix of Windows 7, 8, 8.1 and 10.

I am not able to reproduce in a new profile in a new Sandbox.

In the Sandbox I notice this issue I deleted all the RegHive files and all folders except for "C:\Sandbox\Username\Chrome\user\current\AppData\Local\Google\Chrome\User Data" (this includes deleting the sandboxed windows catroot) but lsass still eats CPU for 1-2 min every time I start Chrome. I also tried killing SandboxieRpcSs/DcomLaunch/Crypto but it didn't make a difference.

Unfortunately since both the Chrome profile and the Process Monitor log contain sensitive information I cannot offer that more detailed information to the developers. I hope someone else who also has this problem will come forward with a way to reproduce. Thank you for your help.