Windows 8 and 8.1 Forums


Windows and Processes Opening

  1. #1


    Canada
    Posts : 6
    Windows 8.1 Pro

    Windows and Processes Opening


    Hello,

    I'm experiencing odd crashes with my Windows 8.1 box, where I will experience a spike of lag followed by tray and application forms becoming active windows. It's hard to explain so here's an Image :
    Click image for larger version
    As you can see, there are some pretty odd windows open. The only applications I have launched are Skype, Vuze, Unity, Steam and CCleaner. Everything else has opened itself. I'm not sure, but it seems like a service or process managing active windows is crashing.

    The only leads I have are within event viewer, being an increased number of Service Control Manager errors during any given day. Image Below.
    Click image for larger version
    Note that the errors span 2 days.
    There are also quite a few Information events related:
    Click image for larger version
    The issue with the windows can be fixed by a reboot or logging in and out, however the crash reoccurs a few hours later.

    The other odd events I am getting are Security events. These pertain to Logon / Logoff requests. Here's an Image :
    Click image for larger version
    The hilighted portion happened only a few seconds before a studder/lag spike I experienced similar to the one I feel right before the crashes. (I was already in crashed state when the lag occurred).

    Now, the odd part is that I re-installed my OS (reformatted my drives) since I was experiencing this with Windows 7, and this issue reappeared only 5 or 6 hours after the reinstall. Its also worth noting that I have scanned my drives for bad sectors (Running one SSD for my OS, and the HDD holds my programs and windows temp) and came out with no issues. Ran Memcheck and "sfc /sscannow" as well.

    So I am pretty baffled as to what is going on, especially since there isn't much to go off of.
    Any ideas?

    -jake

      My System SpecsSystem Spec

  2. #2


    Harrisonburg, Va.
    Posts : 10,488
    Windows 8.1.1 Pro with Media Center


    Any ideas?
    Try this batch file---

    dism.bat

    Download it, right click it & choose Properties & Unblock it & right click it & choose Run as administrator.
    You can leave it run in the background. 2 hours or so to complete.
    It might help.
      My System SpecsSystem Spec

  3. #3


    Canada
    Posts : 6
    Windows 8.1 Pro


    Thank you! Quick reply too =)
    I ran DISM right before I did a reinstall, but I'll run it again via your BAT file. It might take a few hours for the issue to reappear (hopefully it doesn't) so lets see what happens.
      My System SpecsSystem Spec

  4. #4


    Harrisonburg, Va.
    Posts : 10,488
    Windows 8.1.1 Pro with Media Center


    The .bat file is a little different way of scanning with sfc & dism.
      My System SpecsSystem Spec

  5. #5


    Canada
    Posts : 6
    Windows 8.1 Pro


    Quote Originally Posted by David Bailey View Post
    Try this batch file---
    Ok so that finished, heres the console return :
    Click image for larger version

    And heres the CBS Log Download (7MB):
    https://mega.co.nz/#!JUwG0SAb!TQZS2G...jdpqxtnSpNepHo

    Alternatively, this is the summary CBS printed :
    Code:
    2014-12-13 23:10:25, Info                  CSI    0000942d [SR] Verify complete
    2014-12-13 23:10:25, Info                  CSI    0000942e [SR] Verifying 10 (0x000000000000000a) components
    2014-12-13 23:10:25, Info                  CSI    0000942f [SR] Beginning Verify and Repair transaction
    2014-12-13 23:10:25, Info                  CSI    00009430 [SR] Verify complete
    2014-12-13 23:10:25, Info                  CSI    00009431 [SR] Repairing 0 components
    2014-12-13 23:10:25, Info                  CSI    00009432 [SR] Beginning Verify and Repair transaction
    2014-12-13 23:10:25, Info                  CSI    00009433 [SR] Repair complete
    2014-12-13 23:10:27, Info                  CBS    Session: 30414692_2819740627 initialized by client DISM Package Manager Provider.
    2014-12-13 23:10:27, Info                  CBS    Client specifies store corruption detect and repair.
    2014-12-13 23:10:27, Info                  CBS    Exec: Session processing started.  Client: DISM Package Manager Provider, Session(Store Corruption Detect/Repair): 30414692_2819740627
    2014-12-13 23:10:27, Info                  CBS    Reboot mark set
    2014-12-13 23:10:27, Info                  CBS    Winlogon: Registering for CreateSession notifications
    2014-12-13 23:10:42, Info                  CBS    Repr: CBS Store check completes
    2014-12-13 23:10:42, Info                  CSI    00009434 StoreCorruptionRepair transaction begun. WcpVersion: [l:78{39}]"6.3.9600.17477 (winblue_r5.141030-1500)".
    2014-12-13 23:10:42, Info                  CSI    00009435@2014/12/14:06:10:42.313 Starting corruption detection (InnerFlags=5)
    2014-12-13 23:14:21, Info                  CSI    00009436@2014/12/14:06:14:21.289 Corruption detection complete. numCorruptions = 0, Disp = 1.
    2014-12-13 23:14:21, Info                  CBS    Repr: CSI meta data corruption found, will commit repair transaction if repair is asked.
    2014-12-13 23:14:21, Info                  CBS    Repr: CSI Store check completes
    2014-12-13 23:14:21, Info                  CBS    Exec:Only CSI metadata corruption found, Process CSI repair.
    2014-12-13 23:14:21, Info                  CSI    00009437 Creating NT transaction (seq 8850), objectname [6]"(null)"
    2014-12-13 23:14:21, Info                  CSI    00009438 Created NT transaction (seq 8850) result 0x00000000, handle @0x1b9bc
    2014-12-13 23:14:21, Info                  CSI    00009439@2014/12/14:06:14:21.290 Beginning NT transaction commit...
    2014-12-13 23:14:21, Info                  CSI    0000943a@2014/12/14:06:14:21.294 CSI perf trace:
    CSIPERF:TXCOMMIT;3962
    2014-12-13 23:14:21, Info                  CSI    0000943b StoreCorruptionRepair transaction completed.
    2014-12-13 23:14:21, Info                  CBS    Repr: Finished repairing CSI store.
    2014-12-13 23:14:21, Info                  CBS    Ensure CBS corruption flag is clear
    2014-12-13 23:14:21, Info                  CBS    Ensure WCP corruption flag is clear
    2014-12-13 23:14:21, Info                  CBS    
    =================================
    Checking System Update Readiness.
    
    
    
    
    Summary:
    Operation: Detect and Repair 
    Operation result: 0x0
    Last Successful Step: Entire operation completes.
    Total Detected Corruption:    0
        CBS Manifest Corruption:    0
        CBS Metadata Corruption:    0
        CSI Manifest Corruption:    0
        CSI Metadata Corruption:    0
        CSI Payload Corruption:    0
    Total Repaired Corruption:    0
        CBS Manifest Repaired:    0
        CSI Manifest Repaired:    0
        CSI Payload Repaired:    0
        CSI Store Metadata refreshed:    True
    
    
    Total Operation Time: 233 seconds.
    
    
    2014-12-13 23:14:21, Info                  CBS    SQM: CheckSur: hrStatus: 0x0 [S_OK], download Result: 0x0 [S_OK]
    2014-12-13 23:14:21, Info                  CBS    Count of times corruption detected: 0
    2014-12-13 23:14:21, Info                  CBS    Seconds between initial corruption detections: -1
    2014-12-13 23:14:21, Info                  CBS    Seconds between corruption and repair: -1
    2014-12-13 23:14:21, Info                  CBS    SQM: Upload requested for report: CheckSurSqm, session id: 142858, sample type: Standard
    2014-12-13 23:14:21, Info                  CBS    SQM: Ignoring upload request because the sample type is not enabled: Standard
    2014-12-13 23:14:21, Info                  CBS    Reboot mark cleared
    2014-12-13 23:14:21, Info                  CBS    Winlogon: Deregistering for CreateSession notifications
    2014-12-13 23:14:21, Info                  CBS    Winlogon: Stopping notify server
    2014-12-13 23:14:21, Info                  CBS    Winlogon: Unloading SysNotify DLL
    2014-12-13 23:14:21, Info                  CBS    Exec: Processing complete, session(Corruption Repairing): 30414692_2819740627 [HRESULT = 0x00000000 - S_OK]
    2014-12-13 23:14:21, Info                  CBS    Session: 30414692_2819740627 finalized. Reboot required: no [HRESULT = 0x00000000 - S_OK]
    2014-12-13 23:14:21, Info                  CBS    Session: 30414693_864552550 initialized by client DISM Package Manager Provider.
    2014-12-13 23:14:21, Info                  CBS    TiWorker: Client requests SFP repair object.
    So what exactly did it find? It definitely repaired something. Think this is related to my issue?
      My System SpecsSystem Spec

  6. #6


    Canada
    Posts : 6
    Windows 8.1 Pro


    Ok.. So the Dism bat did not fix the issue, it only took about 30 minutes after reboot for the issue to appear.
    But I am fairly sure now that it has something to do with Auditing, because right as it happened, the event viewer showed security events but all other categories (System, Application) show nothing.
    Once again, here's a screen shot of the logs:
    Click image for larger version
    Note the issue happened at 12:37

    The logs state the following:
    Logon
    Code:
    A logon was attempted using explicit credentials.
    
    
    Subject:
    	Security ID:		SYSTEM
    	Account Name:		JACOB-PC$
    	Account Domain:		WORKGROUP
    	Logon ID:		0x3E7
    	Logon GUID:		{00000000-0000-0000-0000-000000000000}
    
    
    Account Whose Credentials Were Used:
    	Account Name:		Jacob
    	Account Domain:		Jacob-PC
    	Logon GUID:		{00000000-0000-0000-0000-000000000000}
    
    
    Target Server:
    	Target Server Name:	localhost
    	Additional Information:	localhost
    
    
    Process Information:
    	Process ID:		0x61c
    	Process Name:		C:\Windows\System32\consent.exe
    
    
    Network Information:
    	Network Address:	::1
    	Port:			0
    
    
    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
    Logon
    Code:
    An account was successfully logged on.
    
    
    Subject:
    	Security ID:		SYSTEM
    	Account Name:		JACOB-PC$
    	Account Domain:		WORKGROUP
    	Logon ID:		0x3E7
    
    
    Logon Type:			2
    
    
    Impersonation Level:		Impersonation
    
    
    New Logon:
    	Security ID:		Jacob-PC\Jacob
    	Account Name:		Jacob
    	Account Domain:		Jacob-PC
    	Logon ID:		0x6CB560
    	Logon GUID:		{00000000-0000-0000-0000-000000000000}
    
    
    Process Information:
    	Process ID:		0x61c
    	Process Name:		C:\Windows\System32\consent.exe
    
    
    Network Information:
    	Workstation Name:	JACOB-PC
    	Source Network Address:	::1
    	Source Port:		0
    
    
    Detailed Authentication Information:
    	Logon Process:		CredPro
    	Authentication Package:	Negotiate
    	Transited Services:	-
    	Package Name (NTLM only):	-
    	Key Length:		0
    
    
    This event is generated when a logon session is created. It is generated on the computer that was accessed.
    
    
    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    
    
    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
    
    
    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
    
    
    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    
    
    The impersonation level field indicates the extent to which a process in the logon session can impersonate.
    
    
    The authentication information fields provide detailed information about this specific logon request.
    	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    	- Transited services indicate which intermediate services have participated in this logon request.
    	- Package name indicates which sub-protocol was used among the NTLM protocols.
    	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Logoff
    Code:
    An account was logged off.
    
    
    Subject:
    	Security ID:		Jacob-PC\Jacob
    	Account Name:		Jacob
    	Account Domain:		Jacob-PC
    	Logon ID:		0x6CB57D
    
    
    Logon Type:			2
    
    
    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
    I don't understand how it is related to the problem, but does anyone know what it may be? Or any ideas on a course of action?
    Thanks,
    - Jake
      My System SpecsSystem Spec

  7. #7


    Harrisonburg, Va.
    Posts : 10,488
    Windows 8.1.1 Pro with Media Center


    I'm not a log reader.

    There are people here who can.
      My System SpecsSystem Spec

  8. #8


    Trnava
    Posts : 683
    Win 8.1.1 Pro x64


    Those windows seem to be NET Framework related. For starters try to disable it.
    Task Scheduler\Task Scheduler Library\Microsoft\Windows\.NET Framework

    But particularly they are CCC related, try to uninstall it or remove it from startup.

    Additionally you can try to temporarily disable services causing errors, they are not essential.
    Like: Function Discovery Provider Host/HomeGroup Provider/Security Accounts Manager.

    And since you already use CCleaner, you might try WiseCare as well, it might fix some errors.

    P.S.: I assume, that you have the latest drivers: AMD Chipset Drivers / NVIDIA DRIVERS
      My System SpecsSystem Spec

  9. #9


    Canada
    Posts : 6
    Windows 8.1 Pro


    Hmm, the issue seems to be gone for now. I did a system refresh and flashed my BIOS however, I think the problem was with some program I had installed on Windows 7 (my previous OS install) and reinstalled as I was settling in to my new OS. I'm not sure what caused it yet, but Ill try gradually installing programs until I figure out which ones.

    Thanks both of you for your help! It was driving me mad.
    - Jake
      My System SpecsSystem Spec

Windows and Processes Opening
Related Threads
When I open my task manager, there is 13 chrome.exe running at the same time and I don't know why. Chrome is running even though I don't even have Google Chrome on this computer. I use Firefox. There is a lot of chrome.exe running when nothing is on either. My laptop is slowing because of this. I...
How to Set CPU Priority Level of Processes in Windows 8 and 8.1 Windows 8 shares the processor time between all running processes based upon their priority level. If a process has a higher priority, it gets more processor time compared to a process having a lower priority. This tutorial...
Hello. I am currently using Windows 8 Professional (x64) as an administrator. My issue is that often certain programs or software do not exit properly and show up on Task manager as background processes. The issue is that I cannot end these processes because "Access is Denied" and must therefore...
Duplicate processes of applications in Performance & Maintenance
so today i came through this situation. there are duplicate processes created by applications. like google chrome, norton's executable files.is this normal or something to worry ? 24325
Bandwidth limit on processes. in Network & Sharing
Hey. I am downloading games for different services. But I like to to play games while downloading but the ping is high. I have tried netbalancer but the free limit is too low and paying for such software is dump so are there any free software to controll bandwidth?
Random freezes caused by Windows processes in BSOD Crashes and Debugging
I installed windows 8 a couple of days ago and from time to time (every 10-15 minutes) my computer freezes completely for a few seconds (can't even move the cursor). The last few times, immediately after the freeze, I hit ctrl+shift+esc to see what freezes the computer and I once saw some Windows...
Self appearing processes in BSOD Crashes and Debugging
Hello, Just week ago installed Windows 8. From the beginning noticed, that in the task bar appear blank processes, didn't pay any attention then, I just clicked on them and they disappeared. But if you don't click on them, there appear more and more. Here I have took some screens imgur: the...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook