Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: RESOLVED: lsass.exe running @ 50%  w/ Tinker.exe
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

RESOLVED: lsass.exe running @ 50% w/ Tinker.exe

 Post Reply Post Reply Page  <1234>
Author
Message
  Topic Search Topic Search  Topic Options Topic Options
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17287
  Quote molotov Quote  Post ReplyReply Direct Link To This Post Topic: RESOLVED: lsass.exe running @ 50% w/ Tinker.exe
    Posted: 03 October 2008 at 11:43am
It was almost the exact same thing each time, so I could barely tell that it was even Auto-scrolling
I noticed the same as well.  However, during invocation of Tinker, lsass.exe had 336 events, while tinker.exe had 258819 events.
Daily affirmation:
net helpmsg 4006
Back to Top
ikjadoon View Drop Down
Newbie
Newbie
Avatar

Joined: 26 September 2008
Online Status: Offline
Posts: 20
  Quote ikjadoon Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 1:50pm
lol...On my computer, lsass.exe shows up as having 146,000 events, while Tinker has a meager 73,000 events. I would tell you exact numbers, but ProcMon crashed quite a few times on me and I could only glance at the numbers before I couldn't scroll over anymore. Not sure why that happened, but I was able to capture these images:

Here is the set of commands that lsass.exe keeps repeating, followed by a page of Tinker.exe, then this:



Then, out of nowhere, it goes clean; it was when it starts opening up this SECURITY folder that the game actually opens (not fully, of course):



I'm going to try ProcMon again, see what happens right when the game starts to open, but I've been having some trouble with it crashing; maybe too many processes opening up?

~Ibrahim~
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17287
  Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 1:55pm
I'm going to try ProcMon again, see what happens right when the game starts to open, but I've been having some trouble with it crashing; maybe too many processes opening up?

Procmon shouldn't be crashing, regardless of system activity.
Do you have Vista SP1 installed?

The registry activity to HKLM\Security, attributed to lsass, is normal and expected (at least, I also witness it Wink ).

How big (file size, and number of files) is [c:\users\my profile\appdata\roaming]?


Edited by molotov - 03 October 2008 at 1:56pm
Daily affirmation:
net helpmsg 4006
Back to Top
ikjadoon View Drop Down
Newbie
Newbie
Avatar

Joined: 26 September 2008
Online Status: Offline
Posts: 20
  Quote ikjadoon Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 2:17pm
Really? That is so weird. It seems to crash a lot, for some odd reason. It was OK yesterday, but I only ran it twice. Yeah, I have SP1.

Oh. lol, blast nam it! Well, I captured this capture actually just as ProcMon was crashing (it usually happens when I put on a filter and then remove it):



Then the game opens with that black window. I would've scrolled down some, but, yeah. It just opens; I saw winlogin open once, but that might've been a process profiling again. I've noticed that Tinker will only start calling up sound files when the game actually starts to open.

Here is the AppData properties:



Thanks again!

~Ibrahim~

P.S. I've moved many of my user folders to a different hard drive partition; AppData and Favorites are the only two left on my main OS partition. Thought you might want to know.


Edited by ikjadoon - 03 October 2008 at 2:18pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17287
  Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 2:24pm
If you go to Orb -> Run and enter %LOCALAPPDATA%\CrashDumps, does a folder open up?  If so, is there anything in it?

Does procmon only crash if there are over 1,000,000 events (check the status bar)?


Edited by molotov - 03 October 2008 at 2:25pm
Daily affirmation:
net helpmsg 4006
Back to Top
ikjadoon View Drop Down
Newbie
Newbie
Avatar

Joined: 26 September 2008
Online Status: Offline
Posts: 20
  Quote ikjadoon Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 2:26pm
Blast, no. Nothing comes up, minus a dialog box saying it can't find it. :(

Would an old GPU driver cause this? I'm on an old one (December, 2007) because this is the only one that allows my dual monitors to work correctly...

~Ibrahim~
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17287
  Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 2:31pm
Did you see my edit:
Does procmon only crash if there are over 1,000,000 events (check the status bar)?


Would an old GPU driver cause this?
The Procmon crash, or the Tinker problem?

Nothing comes up
OK.  Can you add the following to the registry?
KEY: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\Procmon.exe
VALUE: Type REG_EXPAND_SZ named DumpFolder, with data of c:\ProcmonDumps (please create that folder)

Then, when Procmon crashes, check that folder.

Daily affirmation:
net helpmsg 4006
Back to Top
ikjadoon View Drop Down
Newbie
Newbie
Avatar

Joined: 26 September 2008
Online Status: Offline
Posts: 20
  Quote ikjadoon Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 2:40pm
Oh, blast, I guess not. I want to say so, yes. I'm not positive,but it never crashes in the very beginning.

Old GPU driver: the Tinker issue.

Sure, give me a few moments while I get Tinker running again.

~Ibrahim~

EDIT: I don't seem to have a LocalDumps folder, only Consent, Debug, Excluded Applications, Hangs, Heapcontrolledlist, and Livekernel reports. No Localdumps folder in Windows Error Reporting.


Edited by ikjadoon - 03 October 2008 at 2:43pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17287
  Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 5:12pm
You'd need to create a LocalDumps key in the Windows Error Reporting key, and then a procmon.exe key in LocalDumps, and then add the DumpFolder value with the c:\ProcmonDumps data to the procmon.exe key.
Daily affirmation:
net helpmsg 4006
Back to Top
ikjadoon View Drop Down
Newbie
Newbie
Avatar

Joined: 26 September 2008
Online Status: Offline
Posts: 20
  Quote ikjadoon Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2008 at 5:47pm
Oh......I get it now. Sorry, I was a bit confused; I've actually never made an entire folder (key) in the Registry, just new values. :) Running it again.

~Ibrahim~
Back to Top
 Post Reply Post Reply Page  <1234>

Forum Jump Forum Permissions View Drop Down

Privacy Statement